¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
UKFTT-GRC 2026 1080 [2026] UKFTT 1080 (GRC) InformationRights 1.10.1 2479b9fb57fb97301c88fc9b9f6dc718d111afb6c0c1fb1d5eef4817d4814c78 7.4.0
NCN: [2026] UKFTT 01080 (GRC)
Case Reference: FT/EA/2025/0456
First-tier Tribunal
(General Regulatory Chamber)
Information Rights
Date of hearing 13 May 2026
Decision given on: 23 July 2026
Before
JUDGE CRAGG KC
TRIBUNAL MEMBER RAZ EDWARDS
TRIBUNAL MEMBER KERRY PEPPERELL
Between
GEORGE GREENWOOD
Appellant
and
INFORMATION COMMISSIONER
First Respondent
-and-
THE CABINET OFFICE
Second Respondent
Mr Scherbel-Ball represented Mr Greenwood
Mr Paines represented the Information Commissioner
Mr Mertens represented Cabinet Office
Decision:
By a majority the appeal is allowed in part to the limited extent that the Commissioner has erred in law in not treating s40(5B) as a qualified exemption, and a substituted notice is made to that extent, but the appeal is otherwise dismissed, and no further action by the CO is required.
REASONS
Introduction
1.
This appeal concerns a request by the Appellant made under the Freedom of Information Act 2000 (FOIA) seeking information about whether any current ministers (at the time of the request) had, during the course of their appointment process, declared a criminal conviction, and, if so, how many.
2.
The Cabinet Office (CO) refused to confirm or deny whether such information was held. It relied upon a series of exemptions, including section 40(5B)(a)(i) FOIA, which disapplies the duty to confirm or deny where such confirmation or denial would contravene the data protection principles. At an internal review and in the course of the investigation by the Information Commissioner (the Commissioner) it also relied upon sections 41(2) and 36(3) FOIA.
3.
The Commissioner, by a decision notice dated 12 November 2025, upheld the refusal solely on the basis of section 40(5B)(a)(i) FOIA, concluding that it was unnecessary to consider the alternative grounds. The Appellant now challenges that determination.
4.
The Tribunal held an oral hearing by CVP in which all parties were represented by counsel, and we had a detailed bundle, together with skeleton arguments from all parties. There is a witness statement of Mr Simon Madden, Director of the Propriety and Ethics Team within the Cabinet Office. Mr Madden was not asked any questions in the OPEN part of the hearing, but he was asked questions in the CLOSED part of the hearing, from which the Appellant and his representative were necessarily excluded. The gist of that hearing is referred to below.
5.
It is convenient to state at the outset the Tribunal’s conclusions, which are then explained in full below.
6.
By a majority, the Tribunal concludes that:-
- confirming or denying whether the requested information is held would disclose personal data;
- that personal data constitutes criminal offence data within Article 10 UK GDPR;
- no condition in Schedule 1 to the Data Protection Act 2018 has been established;
- confirmation or denial would therefore involve unlawful processing of personal data;
- section 40(5B)(a)(i) FOIA is engaged;
- section 40(5B)(a)(i) FOIA is properly characterised as a qualified exemption;
- section 36(3) FOIA is also established;
- section 41(2) FOIA is not established; and
- the public interest favours maintaining the exclusion of the duty to confirm or deny.
7.
Accordingly, by a majority, the appeal is dismissed.
8.
The minority view dissents for reasons summarised at the conclusion of this judgment.
The request and the decision notice
9.
The request, made on 5 December 2024, was framed in two parts: first, whether any current ministers had declared a criminal conviction during the appointment process, and secondly, if so, how many. The CO refused to confirm or deny whether it held such information.
10.
The decision notice records, and it is not in dispute, that the CO relied principally on section 40(5B) FOIA. It contended that confirmation or denial as to whether it held the information requested would disclose personal data and, more specifically, criminal offence data. It further contended that, because no condition in Schedule 1 of the Data Protection Act 2018 (DPA 2018) was satisfied, any such processing would be unlawful.
11.
The Commissioner accepted that submission. His reasoning, in essence, was that even a bare confirmation or denial would disclose personal data in two distinct ways. First, because repeated requests over time could, through what is often described as the ‘mosaic effect’, permit the identification of individual ministers who had made such declarations. So for the example the Commissioner accepted the relevance of the hypothetical example given by the CO as follows:-
27.
The Cabinet Office argued that confirming or denying if the information is held provides a snapshot of the data as it stands at the time of the request, and subsequent requests could be used to identify personal data of ministers. For example:
• The Cabinet Office confirms that information is held (which infers that a minister has declared a criminal conviction).
• A single minister then resigns from government (this is not uncommon; since the original request was received and the Cabinet Office’s submissions to the Commissioner, there have been three separate instances where a minister has resigned or been removed from their role).
• A repeat request then confirms that no information is held.
• It could reasonably be determined that the minister that left the government had a criminal conviction. This therefore reveals the personal data of that minister.
…
34.
Furthermore, the Commissioner is persuaded that the hypothetical example set out by the Cabinet Office above describes a specific and clear way in which confirmation or denial, via a series of requests, as to whether information is held could result in it being revealed whether a specific minister has declared a criminal conviction. The Commissioner is satisfied that such information in that scenario is personal data as it clearly relates to an identifiable individual.
35.
On the basis of the hypothetical example, the Commissioner is therefore satisfied that confirming or denying whether information is held could, with a reasonable degree of certainty, result in the disclosure of personal data.
12.
Secondly, because an answer indicating that no information was held would itself convey information about each minister, namely that they had not declared a conviction:-
38.
Furthermore, the Commissioner wishes to emphasise that his decision that confirming or denying would result in the disclosure of personal data does not rest solely on the hypothetical example described at paragraph 27. Rather, in his view if the Cabinet Office complied with section 1(1)(a) and if it was the case – at the point that the request was submitted – that no information was held, then revealing that would still involve the disclosure of personal data regardless of any mosaic effect of future requests. This is because such a response would confirm that each current minister had not declared any current convictions.
13.
The Commissioner further concluded that the information was, by its nature, criminal offence data, and that no condition permitting its processing was satisfied. It followed, in his view, that confirmation or denial would be unlawful, and that the exemption applied:-
42.
Given the nature of the information being sought by the request, namely whether ministers have declared a criminal conviction during their appointment process, the Commissioner is satisfied that as well as confirmation or denial with the request allowing for the disclosure of personal data of ministers this would also result in the disclosure of criminal offence data.
…
45.
Furthermore, criminal offence data is particularly sensitive and therefore warrants special protection. It can only be processed, which includes confirming or denying whether the information is held in response to a FOI request, if one of the stringent conditions of Schedule 1, Parts 1 to 3 of the DPA 2018 can be met.
…
47.
As a result there can be no legal basis for confirming whether or not the requested information is held; providing such a confirmation or denial would breach data principle (a) as disclosure would not be lawful and therefore the second criterion of the test set out above at paragraph 14 is met.
14.
Having reached that conclusion, the Commissioner did not consider the alternative exemptions.
The appeal
15.
The Appellant appealed against the decision notice on 9 December 2025. As to s.40(5B) FOIA , the Appellant advances three principal grounds of challenge. First, he contends that confirming or denying whether the requested information is held would not involve the disclosure of personal data . The request is said to seek only aggregate or statistical information relating to a relatively large group of ministers, from which no individual could be identified. In particular, the Appellant submits that the Commissioner’s reliance on ‘mosaic’ identification through hypothetical future requests is speculative and inconsistent with the requirement that identification must be realistically achievable.
16.
Secondly, the Appellant submits that if there is processing of personal data then it would be lawful . He argues that the information either does not amount to ‘criminal offence data’, or, if it does, that lawful bases exist under Article 6 UK GDPR and Schedule 1 DPA 2018, including substantial public interest and journalism conditions. He contends that the Commissioner has taken an unduly narrow approach which fails to reflect the importance of freedom of expression and democratic accountability.
17.
Thirdly, the Appellant argues that s.40(5B) FOIA is a qualified exemption , not an absolute one. He submits that it is not listed among the absolute exemptions in s.2(3) FOIA, and that the Commissioner therefore erred in failing to conduct a public interest balancing exercise. In that context, he relies on what he describes as a compelling public interest in transparency as to whether those holding ministerial office have criminal convictions, or have declared them as part of the appointments process.
18.
The Appellant also advances grounds of appeal in respect of the CO’s reliance on ss.36 and 41 FOIA. As to s.36 FOIA , the Appellant challenges both the reasonableness of the qualified person’s (QP’s) opinion and the public interest balance. He submits that the QP’s opinion is inadequately reasoned and unsupported by evidence, and that the Cabinet Office’s case rests on speculative assertions of a ‘chilling effect’ on candour in the ministerial appointments process.
19.
As to s.41 FOIA , the Appellant submits that the exemption is misconceived. He argues that the information in question—criminal convictions—cannot possess the necessary quality of confidence as a matter of law, and that, in any event, a confirmation or denial would not disclose actionable confidential information about any identifiable individual. He further contends that the CO has not established who could bring a claim, has impermissibly conflated confidentiality with privacy, and has failed to demonstrate that any breach of confidence action would succeed, particularly in light of the strong public interest in disclosure.
Legal Framework
20.
The starting point is section 1 FOIA, which confers a right of access to information. Section 1(1) provides:-
Any person making a request for information to a public authority is entitled— (a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b) if that is the case, to have that information communicated to him.
21.
Section 1(6) FOIA makes clear that the right under section 1(1)(a) is ‘referred to as ‘the duty to confirm or deny’’.
22.
That duty is subject to exemptions contained in Part II of FOIA. Section 2 of FOIA states that:-
2.
— Effect of the exemptions in Part II.
(1)
Where any provision of Part II states that the duty to confirm or deny does not arise in relation to any information, the effect of the provision is that where either— (a) the provision confers absolute exemption, or (b) in all the circumstances of the case, the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the public authority holds the information, section 1(1)(a) does not apply.
(2)
In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that— (a) the information is exempt information by virtue of a provision conferring absolute exemption, or (b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.
(3)
For the purposes of this section, the following provisions of Part II (and no others) are to be regarded as conferring absolute exemption— [a list is then set out which does not include s40(5B)].
23.
In the present case, the principal exemption relied upon is section 40 FOIA, which governs the treatment of personal data.
40.
— Personal information.
(1)
Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.
(2)
Any information to which a request for information relates is also exempt information if—
(a)
it constitutes personal data which does not fall within subsection (1), and
(b)
the first, second or third condition below is satisfied.
(3A)
The first condition is that the disclosure of the information to a member of the public otherwise than under this Act — (a) would contravene any of the data protection principles…
(3B)…
(4A)
(5A)
The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1)
24.
Section 40(5B) FOIA provides, so far as material:-
The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies— (a) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)— (i) would (apart from this Act ) contravene any of the data protection principles…
25.
Section 40(7) FOIA provides:-
In this section— ‘the data protection principles’ means the principles set out in— (a) Article 5(1) of the UK GDPR… ‘personal data’ and ‘processing’ have the same meaning as in the Data Protection Act 2018 …
26.
Personal data is defined in section 3(2) DPA 2018 which states that ‘‘Personal data’ means any information relating to an identified or identifiable living individual.’ That definition is mirrored in Article 4(1) UK GDPR, which provides:-
‘Personal data’ means any information relating to an identified or identifiable natural person… an identifiable natural person is one who can be identified, directly or indirectly…
27.
The meaning of ‘identifiable’ in this context has been the subject of judicial consideration. In Miller v Information Commissioner [2018] UKUT 229 (AAC) , the Upper Tribunal held that identifiability is not confined to the information in isolation, but extends to information ‘in the possession of, or likely to come into the possession of, a person other than the data controller after disclosure’ ( Miller at [10]).
28.
The Tribunal further emphasised that the assessment must take account of the capabilities of a ‘motivated intruder’, including the likelihood that journalists or other investigators will combine disclosed information with other data sources, and pursue lines of inquiry using ordinary investigative techniques ( Miller at [11]–[14]).
29.
At the same time, the limits of that approach were clarified in NHS Business Services Authority v Information Commissioner and Spivack [2021] UKUT 192 (AAC) , where the Upper Tribunal stressed that the relevant question remains whether it is possible to identify a particular individual, and that the analysis must be grounded in a realistic assessment rather than speculation ( Spivack at [21]–[22]).
30.
It follows that section 40(5B)(a)(i) FOIA requires the Tribunal to determine whether confirmation or denial would involve processing that contravenes the data protection principles, and in particular the principle of lawfulness.
31.
That principle is set out in Article 5(1)(a) UK GDPR:-
Personal data shall be: (a) processed lawfully, fairly and in a transparent manner in relation to the data subject…
32.
Where personal data is engaged, the lawfulness of processing is governed by Article 6 UK GDPR, which provides, materially:-
Processing shall be lawful only if and to the extent that at least one of the following applies— … (e) processing is necessary for the performance of a task carried out in the public interest… (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party…
33.
However, where the data relates to criminal convictions and offences, more stringent requirements apply. Article 10 UK GDPR provides:-
Processing of personal data relating to criminal convictions and offences… shall be carried out only under the control of official authority or when the processing is authorised by domestic law…
34.
That domestic authorisation is provided, through the DPA 2018. Section 10(5) DPA 2018 provides:-
The processing meets the requirement in Article 10… only if it meets a condition in Part 1, 2 or 3 of Schedule 1.
35.
The potentially relevant conditions include:
Paragraph 29 (Consent):
The data subject has given consent to the processing.
Paragraph 32 (Manifestly public data):
The processing relates to personal data which has clearly been made public by the data subject.
Paragraph 13 (Journalism etc):
This condition is met if— (a) the processing consists of the disclosure of personal data for the special purposes… (e) the controller reasonably believes that publication… would be in the public interest.
36.
Unless one of the Schedule 1 conditions is satisfied, the processing of criminal offence data is unlawful. As the Upper Tribunal made clear in Cox v Information Commissioner and Home Office [2018] UKUT 119 (AAC) , FOIA does not operate to compel a public authority to engage in processing which would otherwise be unlawful. The structure of section 40 FOIA reflects that principle, ensuring that the data protection regime is not undermined by disclosure obligations.
37.
The consequence is that, where confirmation or denial would involve the unlawful processing of personal data, the duty under section 1(1)(a) FOIA (see above) does not arise.
38.
The alternative exemptions relied upon by the CO are also noted. Section 36(3) FOIA provides:-
The duty to confirm or deny does not arise… if… in the reasonable opinion of a qualified person, compliance with section 1(1)(a)… would… be likely to… prejudice the effective conduct of public affairs.
39.
Section 36(5) provides that, in the case of a government department ‘a qualified person means any Minister of the Crown.’
40.
The Tribunal’s task in relation to section 36 FOIA is not to substitute its own view for that of the Qualified Person, but to assess whether the opinion is ‘substantively reasonable’, applying the approach set out in Information Commissioner v Malnick [2018] UKUT 72 (AAC) . If that threshold is met, the opinion also carries weight in the public interest balancing exercise, in accordance with Department for Work and Pensions v IC and Zola [2016] EWCA Civ 758 .
41.
Section 41(2) FOIA provides:-
The duty to confirm or deny does not arise if… the confirmation or denial… would… constitute an actionable breach of confidence.
42.
The requirements of an actionable breach of confidence are those identified in Coco v A N Clark (Engineers) Ltd [1969] RPC 41 , namely that the information must have the necessary quality of confidence, must have been imparted in circumstances importing an obligation of confidence, and that there must be an unauthorised use resulting in detriment. In the FOIA context, it is necessary to go further and demonstrate that a claim would have a real prospect of success.
The evidence of Mr Madden
43.
Simon Madden is the Director of the Propriety and Ethics Team at the CO, with direct responsibility for the processes by which ministerial appointments are scrutinised. He has given a written statement in OPEN and CLOSED and gave evidence in the CLOSED session.
44.
His evidence describes a process which is, of its nature, both sensitive and confidential. Prospective ministers are asked to provide information which may bear upon their suitability for office. That information may include, but is not limited to, past criminal conduct. The system depends fundamentally upon candour.
45.
Mr Madden explains that there is no statutory obligation requiring ministers to disclose such matters. The system is therefore reliant on voluntary disclosure, informed by an expectation of confidentiality. It is, he says, essential that prospective appointees are able to provide information in the confidence that it will not subsequently be disclosed in a way that could identify them.
46.
Of particular importance is his evidence as to the risk of identification. He explains how repeated requests over time could, in his view, enable an individual to be identified. The key feature of his reasoning is the fluid nature of ministerial office. Changes in office do not always occur in large groups. There are many occasions on which a single minister leaves or joins government. If one takes a response at time A as a baseline, and compares it with a response at time B following such a change, it may be possible, by process of elimination, to identify the individual concerned.
47.
That is not advanced as a theoretical possibility. Mr Madden points to concrete examples of ministerial movement over relatively short periods. His evidence is that, in practice, the type of investigative activity required is well within the capacity of journalists and others with a strong interest in the subject.
48.
He also addresses the institutional consequences. In his view, confirmation or denial would risk undermining confidence in the confidentiality of the appointments process. That, in turn, could lead to less candid disclosures, and thereby impair the ability of the Prime Minister and officials to make informed decisions.
49.
The ‘gist’ of the CLOSED session where Mr Madden was asked questions, is as follows:-
2.
Mr Madden was asked questions about the ministerial appointments process, described in paragraphs 20-23 of the open witness statement. Mr Madden was asked about the detail of how information was sought during that process, what information was sought, and how it was recorded.
3.
Mr Madden also explained that records from the ministerial appointments process are retained for at least the full duration of the Parliamentary term.
4.
Mr Madden was asked about the ‘mosaic’ and ‘chilling effect’ arguments, with regard to his closed evidence and the closed exhibits. He explained that there was a clear expectation of confidentiality during the process, from both sides. He also explained that there was strong encouragement that putative appointees should be candid during the process, but there was no legal obligation on putative appointees to disclose information.
Consideration of the arguments and decision
50.
Against that statutory and jurisprudential background, a central issue for determination is whether confirming or denying whether the requested information is held would involve the unlawful processing of personal data. If it would, section 40(5B)(a)(i) is engaged and the duty to confirm or deny does not arise.
Section 40(5B) FOIA
Personal data
51.
The parties’ submissions raise three principal issues: (i) whether the requested information is personal data at all, including in the ‘zero answer’ scenario (where it would be said that no ministers had made a declaration); (ii) (if it is personal data) whether it constitutes criminal offence data; and (iii) whether any lawful basis for processing exists.
52.
The Commissioner and the CO submit that the exemption is engaged because any confirmation or denial would disclose personal data. They rely on the established approach (see above) that identifiability must be assessed not in isolation but by reference to all information reasonably likely to be available to a ‘motivated intruder’, including the possibility of combining responses and other data over time (the ‘mosaic effect’).
53.
On that basis, they contend that the existence (or absence) of declarations of criminal convictions by ministers could, through repeat requests or correlation with known ministerial changes, lead to the identification of specific individuals. Further, and importantly, they argue that even a response that the number is zero—i.e. that no minister has declared a criminal conviction—would constitute the disclosure of personal data because it conveys information relating to each member of the defined class of ministers, namely that they do not have such a characteristic.
54.
The Appellant’s primary case is that the information requested is not personal data at all. He submits that it is merely statistical information about a relatively large cohort and incapable of identifying any individual. In particular, he argues that the Commissioner’s reliance on future hypothetical requests and contingent scenarios is impermissible, and that identification requires more than speculation or the narrowing of a pool. In relation to the ‘zero answer’ point, the Appellant contends that a response that no declarations are held does not disclose personal data about individual ministers, but merely indicates the absence of records held by the CO.
55.
In our view, the Commissioner’s analysis (and that of the CO) is the correct approach on this issue. First, as to identifiability, the authorities require the Tribunal to consider not only information immediately available but also information that is likely to come into the possession of others, including through further investigation or requests. The Appellant’s attempt to confine the analysis to material already in the public domain at a single point in time is inconsistent with the case law we have cited above. In our view, it is neither speculative nor impermissible to consider the realistic possibility that interested investigators, including journalists, may pursue further information and combine it with responses such as the one sought in this request.
56.
Secondly, and more directly on the ‘zero answer’ issue, we accept the Commissioner’s submission that a negative response can itself comprise personal data. Where the request is framed by reference to a defined and identifiable class of individuals, an answer that none of the members of that class has the relevant characteristic conveys information about each of them—namely that they do not have that characteristic (in this case of not having made a declaration about criminal convictions). The Appellant’s attempt to characterise such a response as merely about record-keeping is not accepted by the Tribunal: the substance of the answer, as it would be understood by a reasonable recipient, is to provide information about the status of the ministers themselves.
Lawfulness of processing – criminal offence data
57.
The parties differ fundamentally as to whether the information sought constitutes criminal offence data within the meaning of Article 10 UK GDPR. This issue is central to the appeal because, if Article 10 applies, the processing cannot be lawful unless one of the conditions in Schedule 1 DPA 2018 is satisfied.
58.
The Commissioner and the CO submit that the information sought plainly falls within Article 10. They argue that confirmation or denial of whether information is held would communicate information bearing directly upon whether one or more serving ministers have criminal convictions. In their submission, the phrase ‘relating to criminal convictions and offences’ is deliberately broad and encompasses information from which the existence or absence of criminal convictions may reasonably be inferred.
59.
The Appellant submits that the request is concerned not with criminal convictions themselves but with whether declarations were made during an appointments process. He contends that the focus of the request is procedural rather than substantive and that the information sought is therefore one step removed from the criminal convictions themselves.
60.
The majority of the Tribunal concludes that Article 10 is engaged. The minority view is for a contrary conclusion for the reasons summarised at the conclusion of this judgment.
61.
It is convenient to begin with the language of Article 10 itself. The provision applies to ‘personal data relating to criminal convictions and offences’. The phrase ‘relating to’ is broad. In ordinary language, information may relate to a criminal conviction even where it does not disclose the conviction directly. The statutory language does not require the information itself to identify a particular offence, set out the details of a conviction, or name the relevant individual. Rather, the question is whether the information bears a sufficient relationship to criminal convictions or offences.
62.
In the view of the majority, such a relationship plainly exists here. The request asks whether any current ministers declared criminal convictions during the ministerial appointments process and, if so, how many. The significance of any response lies entirely in what it reveals about criminal convictions. If the answer is that information is held, the response communicates that one or more ministers declared criminal convictions. If the answer is that information is not held, the response communicates that no minister did so. Either answer conveys information bearing directly upon (or relates to) the existence or absence of criminal convictions within the identified group.
63.
The majority do not consider it possible, in this context, to separate information about declarations from information about convictions themselves. The declaration is not an independent subject matter. Rather, it is the mechanism through which information regarding criminal convictions is communicated within the appointments process. The request therefore concerns information relating to criminal convictions notwithstanding that it is framed by reference to declarations.
64.
The Tribunal has already concluded, unanimously, that confirmation or denial would disclose personal data (see above) Once that conclusion is reached, it follows that the information in question constitutes personal data which relates to criminal convictions and offences.
65.
The majority further consider that this conclusion accords with the underlying purpose of Article 10. Parliament and the UK GDPR recognise that information concerning criminal convictions is particularly sensitive because its disclosure may carry risks of stigma, prejudice, reputational damage and unfair treatment. Those concerns arise whether the information is disclosed directly or indirectly. A construction limiting Article 10 to information expressly identifying convictions would, in the majority's view, fail adequately to reflect that protective purpose.
66.
It follows that the lawfulness of any confirmation or denial cannot be assessed solely by reference to Article 6 UK GDPR. Article 10 imposes additional requirements, and section 10(5) DPA 2018 provides that those requirements are met only where a condition in Parts 1, 2 or 3 of Schedule 1 is satisfied.
67.
The Appellant submits that suitable conditions exist, including conditions based upon substantial public interest and journalism. The majority are not persuaded.
68.
First, there is no evidence that any affected minister has consented to the disclosure of the information. The consent condition is therefore unavailable.
69.
Secondly, we are not satisfied that the condition relating to manifestly public data applies. The fact that information concerning some criminal convictions may in certain circumstances have entered the public domain does not demonstrate that the relevant data subjects have themselves clearly made the information public for the purposes of paragraph 32. The request is directed to declarations made in a confidential appointments process, not to information voluntarily and publicly disseminated by ministers themselves.
70.
Thirdly, we do not accept that the journalism condition assists the Appellant. Disclosure under FOIA is disclosure to the public at large. It is not disclosure by the CO acting for journalistic, academic, artistic or literary purposes. Nor does FOIA operate by permitting a public authority to disclose criminal offence data to the world at large merely because a requester happens to be a journalist.
71.
We have carefully considered whether any other relevant Schedule 1 condition has been established. None has been identified on the evidence before the Tribunal. We therefore conclude that no Schedule 1 condition is satisfied.
72.
The consequence is that the requirements imposed by Article 10 and section 10(5) DPA 2018 are not met.
73.
The majority accept that the Appellant advances legitimate interests of genuine weight. The request concerns standards in public life, ministerial accountability and democratic scrutiny. Those are important considerations and we fully recognise the public significance of the issue raised by the request.
74.
However, Article 10 establishes a distinct statutory regime for criminal offence data. Even if a lawful basis under Article 6 could otherwise be identified, that would not be sufficient. The additional statutory requirements governing criminal offence data must also be met. In the present case they are not.
75.
The majority therefore conclude that confirmation or denial of whether the requested information is held would be unlawful and would contravene Article 5(1)(a) UK GDPR.
76.
Accordingly, the majority conclude that section 40(5B)(a)(i) FOIA is engaged because confirmation or denial would contravene the data protection principles. Whether that exemption ultimately justifies maintaining the refusal depends upon the further issues addressed below, including the question whether section 40(5B) FOIA is absolute or qualified and, if qualified, the outcome of the public interest balancing exercise.
` Is s.40(5B) an absolute exemption?
77.
The dispute as to whether s.40 (5B) FOIA is an absolute exemption requires the Tribunal to reconcile what might be described as the clear textual structure of FOIA, in particular s.2, with the underlying purpose of s.40 , namely to ensure that the Act does not require a public authority to process personal data unlawfully.
78.
The starting point is the wording of s.2(3) FOIA. That provision identifies the exemptions which are to be treated as absolute and does so in clear and restrictive terms: only the provisions there listed, “and no others”, confer absolute exemption. It is common ground that s.40 (5B) FOIA is not included within that list, whereas other sub-sections of s40 FOIA are included.
79.
The Appellant submits that on a straightforward reading of the statute, Parliament has specified those exemptions which are absolute. Where a provision is not included in s.2(3), it must follow that it is qualified, with the consequence that, once engaged, it remains subject to the public interest balancing exercise under s.2(1)(b).
80.
The Commissioner and the CO advance a different analysis. They submit that s.40 (5B) FOIA should not be regarded as a freestanding exemption at all, but rather as adjectival to the substantive personal data exemption. The substantive exemption in s.40(2) , when read with the ‘first condition’ in s.40 (3A), is absolute where disclosure would contravene the data protection principles. Section 40 (5B)(a)(i) FOIA imports precisely the same test into the NCND context. It would therefore, they submit, be incoherent for that test to give rise to an absolute exemption in the context of disclosure, but only a qualified exemption in the context of confirmation or denial.
81.
That submission has an internal logic. It is also grounded in the broader principle, reflected in authority such as Cox v Information Commissioner , that FOIA does not require a public authority to undertake processing which would be unlawful under the data protection regime. The Commissioner submits that, once a tribunal has concluded that confirmation or denial would amount to unlawful processing, it is conceptually difficult to see how a public interest balancing exercise could properly reintroduce a potential obligation to act in that way.
82.
The Tribunal has reached a unanimous view on this issue. In our view, firstly, as a matter of statutory construction, we do not consider that it is open to the Tribunal, by a process of implication or purposive construction, to extend the category of absolute exemptions beyond those expressly identified, especially given the words ‘and no others’ included in the limiting provision.
83.
Secondly, while it is correct that s.40 (5B)(a)(i) employs the same operative language as the ‘first condition’ in s.40 (3A), the use of identical wording does not compel identical treatment for the purposes of s.2 FOIA. Parliament has, elsewhere in FOIA, treated provisions which are closely related in subject matter differently in terms of whether they are absolute or qualified. The statute does not adopt a uniform structural approach.
84.
It seems to us that recognising s.40 (5B) FOIA as a qualified exemption can be explained in practice as follows. If a conclusion has been reached that processing would be unlawful under UK GDPR (as in this case), that will constitute a factor of weight in the public interest exercise under s.2(1)(b) FOIA, but there may be wider public interests in some cases which outweigh the UK GDPR conclusion in some cases. If a conclusion has been reached in a case that processing would be lawful under UK GDPR, that may be reinforced by the application of the public interest test, but also raises the possibility that a wider public interest in NCND nevertheless means that disclosure does not take place.
85.
For those reasons, we conclude—albeit not without hesitation—that s.40 (5B) FOIA is properly to be characterised as a qualified exemption. The Tribunal is ultimately driven by the statutory language. Section 2(3) FOIA is clear in its terms. Section 40 (5B) does not fall within the list of absolute exemptions. In those circumstances, we do not consider that it is open to us to reach a different conclusion.
86.
It follows from our conclusion that section 40 (5B) FOIA is a qualified exemption that the Tribunal must undertake the public interest balancing exercise required by section 2 FOIA. This requires a broader assessment of the public interests engaged by confirmation or denial in the FOIA context. See below.
Section 36 FOIA
87.
Having reached that conclusion on s40 (5B) FOIA, (subject to the public interest test), the Tribunal will consider the other exemptions relied upon by the CO starting with s36(3) FOIA. The question is whether the CO was entitled to rely on s.36(3) FOIA to neither confirm nor deny whether it holds the requested information, on the basis that such confirmation or denial would, or would be likely to, prejudice the effective conduct of public affairs. This requires consideration of (i) whether there was a reasonable opinion of the QP that the relevant prejudice would arise, and (ii) whether the public interest favours maintaining the exemption.
88.
The CO submits that s.36(3) FOIA is engaged. It relies on the opinion of a Minister acting as QP and on evidence from Mr Madden. The CO's QP was Abena Oppong-Asare MP, then Parliamentary Secretary for the Cabinet Office. Her opinion is dated 30 April 2025. It is not disputed that she is a QP within s.36(5)(a) FOIA as a Minister of the Crown. Her opinion is that confirming or denying whether the requested information is held would otherwise prejudice the effective conduct of public affairs under s.36(2)(c) FOIA.
89.
The opinion itself provides no reasoning or explanation — it is, in the Appellant’s words, ‘a barely stated opinion’. The QP has not given evidence to the Tribunal to support it. The CO relies on a detailed submission provided to the QP prior to her opinion (available in open in redacted form and in closed in unredacted form).
90.
The CO's case, as developed by Mr Madden and the submission to the QP, is that:-
(a)
providing a substantive response would damage confidence in the ministerial appointments process, since ministerial appointees have a clear expectation that the pre-appointment process is confidential.
(b)
This would erode the Prime Minister's ability to exercise discretion in making ministerial appointments — a core constitutional function.
(c)
If officials cannot guarantee confidentiality, appointees will be less candid and frank, thereby diminishing the quality of information declared during vetting.
(d)
Ms Oppong-Asare herself underwent the ministerial appointments process, making her particularly well-placed to assess the harms.
91.
The Appellant challenges both the reasonableness of the QP’s opinion and the weight to be afforded to it when considering the public interest. He submits that the CO’s case rests on speculative claims of a ‘chilling effect’, which the authorities caution must be carefully scrutinised. In addition, the Appellant advances a more specific point concerning the threshold test applied by the QP. He submits that the advice provided to the QP expressed the relevant prejudice in terms that it ‘would be likely’ to occur, whereas the QP’s opinion appears to adopt a formulation concluding that prejudice ‘would’ occur. It is said that the failure to explain this shift undermines the coherence and reasonableness of the opinion.
92.
In our view, while that submission is properly raised, it does not render the QP’s opinion unreasonable. Section 36(3) FOIA is expressly framed in the alternative: the question is whether compliance with the duty would, or would be likely to, prejudice the effective conduct of public affairs. The statutory test is therefore satisfied where there is a reasonable opinion that either is met. The fact that internal advice to the QP may have been couched in slightly different terms, or that different formulations were used in the course of the decision-making process, does not in itself demonstrate any error of principle. What matters is whether the QP ultimately formed a view that satisfies the statutory threshold and whether that view was one reasonably open on the material before her.
93.
Having regard to the substance of the CO’s case, we are satisfied that the threshold is met. The reasoning advanced—namely that confidentiality promotes candour, and that dilution of that confidentiality may deter full disclosure—is coherent and rational. It reflects a practical understanding of how sensitive vetting processes operate and of the incentives affecting those required to provide information. The potential consequences for the quality of information available to the Prime Minister, and hence for the effectiveness of ministerial appointments, are sufficiently clear to support a reasonable opinion that prejudice would at least be likely, even if the Tribunal would not itself have reached the same conclusion.
Public interest ( sections 40 (5B) and 36(3) FOIA
94.
It follows that the unanimous view of the Tribunal is that both section 40 (5B) and section 36(3) FOIA are engaged as qualified exemptions and subject to a public interest test. From the point of view of the majority that is on the basis that Article 10 GDPR is met and processing is unlawful under the GDPR.
95.
The Tribunal must therefore undertake a single evaluative assessment under section 2 FOIA.
96.
We begin with the public interest in maintaining the exemptions.
97.
First, there is a substantial public interest in protecting personal data. That consideration has particular force in the present case because the information constitutes criminal offence data within Article 10 UK GDPR.
98.
Secondly, there is a very strong public interest in ensuring that public authorities are not required to undertake unlawful processing of personal data. The majority have concluded that no applicable Schedule 1 condition has been established and that confirmation or denial would therefore be unlawful. That factor attracts considerable weight.
99.
Thirdly, there is a substantial public interest in preserving confidence in the ministerial appointments process. The evidence of Mr Madden demonstrates that the process depends in part upon candid disclosures being made in circumstances where confidentiality is expected.
100.
Fourthly, there is a public interest in avoiding prejudice to the effective conduct of public affairs. We have already concluded that the opinion of the QP was reasonably formed and that section 36(3) is engaged.
101.
Fifthly, there is a public interest in ensuring that those responsible for ministerial appointments continue to receive full and frank information relevant to decisions concerning high public office.
102.
Against those considerations stands the public interest in disclosure.
103.
The Tribunal recognises that this public interest is substantial. The request concerns standards in public life and the integrity of those holding ministerial office. Ministers exercise significant public power and there is a legitimate public interest in scrutiny of systems intended to ensure their suitability for office.
104.
We also recognise the important role of investigative journalism and the wider public interest in understanding the categories of information held by government.
105.
The question is whether this substantial public interest in disclosure outweighs the public interest in maintaining the exemptions.
106.
In the view of the majority it does not. The information sought constitutes criminal offence data. Parliament has afforded such information enhanced protection. The majority have concluded that confirmation or denial would involve unlawful processing because no Schedule 1 condition has been established. The public interest in avoiding unlawful processing carries very significant weight.
107.
When that consideration is taken together with the public interests recognised by section 36(3), including the preservation of candour within the ministerial appointments process and the effective conduct of public affairs, the balance falls in favour of maintaining the exemptions.
108.
The Tribunal therefore concludes, by a majority, that the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in confirmation or denial.
Section 41 FOIA
109.
The Tribunal has also considered whether the CO was entitled to rely on s.41(2) FOIA so as to neither confirm nor deny whether it holds the requested information, on the basis that such confirmation or denial would constitute an actionable breach of confidence. This requires consideration, in the NCND context, of whether (if the information were held) it would possess the necessary quality of confidence, have been imparted in circumstances importing an obligation of confidence, and whether confirmation or denial would involve an unauthorised use of that information to the detriment of the confider.
110.
The CO submits that, if held, the information would plainly have the necessary quality of confidence. It emphasises that the request concerns the declaration (or non-declaration) of criminal convictions by ministers during the appointments process, which it characterises as inherently sensitive personal information. It further contends that the information would have been provided in circumstances importing a clear obligation of confidence: prospective ministers engage with the CO in the course of a confidential disclosure process, and there is an expectation that such information will not be disclosed.
111.
As to detriment, the CO relies on authority that it is sufficient that the confider would not wish the information to be disclosed; loss of control over private information is itself a form of detriment. On this basis, it submits that even confirming or denying whether such information is held would undermine the confidentiality of the process and expose it to the risk of a successful breach of confidence claim. It further contends that no public interest defence would succeed, given the strong public interest in maintaining the confidentiality of the appointments process and preserving candour in disclosures.
112.
The Appellant challenges that analysis. His principal submission is that the information in question—declarations about criminal convictions—cannot as a matter of law possess the necessary quality of confidence. He relies on authority establishing that there is ‘no confidence in iniquity’ and that criminal convictions, as matters determined in public proceedings, are not confidential. He submits that the CO’s position is therefore conceptually flawed: if the underlying information is not capable of being confidential, the claim fails at the first limb.
113.
In the alternative, the Appellant argues that even if information about the declaration of convictions were capable of engaging confidentiality, the CO has failed to demonstrate how a claim would arise in this case. He points out that the request does not seek to identify any individual, and that a response would not, in itself, disclose confidential information about a particular person (even if identification of one or more of the Ministers may be possible in the future). The CO has not identified any specific individual who could bring proceedings. He argues that any claim would in any event be defeated by the public interest in disclosure, particularly in relation to the integrity of those holding ministerial office.
114.
The Tribunal has reached a unanimous view on this issue. In our view, there are significant difficulties with the CO’s reliance on s.41(2) FOIA, and we are not persuaded that it is applicable in this case. While we accept that information disclosed in the context of the ministerial appointments process is, in general, provided in circumstances importing an obligation of confidence, that does not resolve the prior question of whether the information itself has the necessary quality of confidence. The authorities relied upon by the Appellant indicate that criminal convictions, as matters of public record determined in open court, do not ordinarily attract protection under the law of confidence.
115.
The CO seeks to distinguish this by focusing on the fact of declaration within a confidential process, rather than the conviction itself. There is some force in the submission that the circumstances in which information is communicated may, in appropriate cases, attract an obligation of confidence even if the underlying facts are not wholly private. However, in the present context the claim is not directed to the detailed contents of a confidential exchange but to the existence or absence of declarations at a highly generalised level. It is not clear that such information, detached from identifiable individuals and specific content, can realistically be said to have the necessary “quality of confidence” such as to found a cause of action.
116.
Further, s41(2) FOIA requires the Tribunal to consider whether confirmation or denial would itself amount to an actionable breach. Yet the CO has not shown how a cause of action would arise from such a disclosure. A claim in breach of confidence ordinarily requires the unauthorised use of identifiable confidential information.
117.
Drawing these matters together, we are not satisfied that the CO has demonstrated that confirming or denying whether the information is held would expose it to a real and substantial risk of a successful breach of confidence claim. We are not persuaded that the information in question possesses the necessary quality of confidence in the circumstances of this case, nor that the requirements of actionability are met in the NCND context.
118.
Accordingly, while the CO’s reliance on ss.40 (5B) and 36(3) FOIA succeeds, we would not uphold the exemption s41(2) FOIA.
Conclusion
119.
For these reasons, by a majority, the Tribunal concludes that confirmation or denial of whether the requested information is held would disclose personal data and criminal offence data within Article 10 UK GDPR.
120.
No Schedule 1 DPA 2018 condition has been established and confirmation or denial would therefore involve unlawful processing.
121.
Section 40 (5B)(a)(i) FOIA is engaged and operates as a qualified exemption. Reliance on section 36(3) FOIA is also established. The public interest in maintaining those exemptions outweighs the public interest in confirming or denying whether the information is held.
122.
The Tribunal does not uphold reliance upon section 41(2) FOIA.
123.
Accordingly, the appeal is allowed in part to the limited extent that the Commissioner has erred in law in not treating s40 (5B) as a qualified exemption, and a substituted notice is made to that extent, but is otherwise dismissed, and no further action by the CO is required.
Signed: Judge Cragg KC Date: 17 July 2026
The minority view
1. The minority view disagrees with the majority's conclusion that the requested information constitutes personal data relating to criminal convictions and offences within the meaning of Article 10 UK GDPR. In my judgment, that conclusion does not give sufficient weight to the nature of the ministerial appointments process from which the information is derived.
2. The evidence before the Tribunal was not that prospective ministers are asked a direct, specific or closed question as to whether they have criminal convictions. Rather, prospective ministers are asked to provide information that may bear upon their suitability for office. Criminal conduct may be one matter which an individual chooses to disclose, but it is neither the sole nor the inevitable subject matter of that process. The evidence was that information disclosed may extend to a broad range of issues bearing on propriety, suitability and fitness for office. The process therefore concerns suitability for ministerial appointment rather than criminal convictions as such.
3. The minority view is that this feature of the process is of central importance. Prospective ministers are required to exercise their own judgement as to what information ought properly to be disclosed. The process depends upon candour. There is no statutory obligation to disclose particular matters and no requirement that every potentially relevant issue be reported. Equally, the evidence was that the process is not one of verification but of voluntary disclosure. What is being assessed is therefore the extent to which individuals choose to disclose matters that they consider relevant to suitability for office.
4. The request itself must be viewed against that background. Although it refers to declarations of criminal convictions, it does not seek information about criminal convictions themselves. It asks whether ministers disclosed matters during the appointments process. In my judgment, the distinction between those two concepts is not merely semantic but substantive. The information sought concerns what individuals chose to disclose in response to a broad suitability inquiry. It does not concern the underlying question of whether any individual in fact has a criminal conviction.
5. A positive response to the request would establish only that one or more ministers disclosed information which they considered ought to be declared during the appointments process. A negative response would establish only that no such declaration was made. Neither response establishes whether any minister does or does not have a criminal conviction. The process does not determine whether a conviction exists, whether any disclosed matter amounts to a conviction in law, whether any disclosure is complete or accurate, or whether a person with a conviction chose to disclose it. The information sought is therefore concerned with disclosure behaviour within the appointments process rather than criminal status.
6. The majority places too much emphasis on the proposition that a declaration derives its significance from the underlying conviction. Whilst that is true to an extent, it does not follow that information about a declaration is necessarily information relating to a criminal conviction for the purposes of Article 10. The declaration has significance not merely because of any underlying conduct but because it forms part of a broader process designed to assess suitability for public office. What is being examined is the operation of that process and the candour exercised within it.
7. The minority view accepts that the phrase ‘relating to’ in Article 10 is broad. However, it cannot be without limit. If every record, note, disclosure or administrative process in which criminality may be mentioned were automatically treated as criminal offence data, Article 10 would extend well beyond the protection of information concerning criminal convictions and offences themselves. Such an approach risks expanding Article 10 beyond its intended purpose and into information relating to how individuals respond to administrative processes in which criminality may form only one aspect of a wider inquiry.
8. The purpose of Article 10 is to provide enhanced protection for information concerning criminal convictions and offences because of the particular risks of stigma, prejudice, reputational damage and unfair treatment associated with disclosure of such matters. The present request does not seek that information. It seeks information about disclosures made in the course of a confidential appointments process which depends upon individual judgement and candour. In my judgment, that subject matter is sufficiently removed from criminal convictions themselves that Article 10 is not engaged.
9. The appeal would therefore have been allowed. If Article 10 does not apply then the weighty interests recognised by the majority would mean that the provisions of Art 6(1)(f) would be satisfied and processing would be lawful and the public interest balance in relation to s40 (5B) and s36 FOIA would have been in favour of disclosure. The appropriate outcome would have been a substituted decision notice requiring the CO to comply with section 1(1)(a) FOIA by confirming or denying whether the requested information is held and, if the information is held, either to disclose it or identify any further exemption relied upon.