Dunhill v Information Commissioner and Bolton NHS Foundation Trust [2025]

Under the Freedom of Information Act 2000 (FOIA) a person is entitled to the following from a public body:

There are certain exemptions to the above rights. Section 40(5B)(a)(i) of the FOIA creates an exemption from the duty to confirm or deny where doing so would contravene any of the data protection principles under the UK GDPR and/or the Data Protection Act 2018. In practice, this means that a public authority is exempt from the duty if confirming or denying would disclose personal data about an identifiable individual.

Background

Lawrence Dunhill, a journalist for the Health Service Journal, submitted a FOIA request to Bolton NHS Foundation Trust in October 2023. He sought copies of all governance reviews since June 2022, including one conducted by PwC following allegations within the Trust’s leadership.

In response to the request, the Trust confirmed that it held some relevant information but refused to confirm or deny whether it held the PwC review, citing the exemption set out within Section 40(5B)(a)(i) of the FOIA.

Unhappy with the response, Mr Dunhill lodged a complaint with the Information Commissioner’s Office (ICO). The ICO upheld the position adopted by the Trust. Mr Dunhill appealed this decision to the First-Tier Tribunal.

The issues for determination by the Tribunal were as follows:

Tribunal’s Decision

The Tribunal pointed out that the ICO was mistaken on one key point in its determination of the complaint. They had assumed that the Trust had given a neither confirm nor deny response to the whole of Mr Dunhill’s request. This was not the case. As set out above, the Trust had actually accepted that it held some of the information requested. The ‘neither confirm nor deny’ response was limited to the PwC review alone.

The Tribunal ultimately concluded that the ICO had misapplied the exemption in Section 40(5B)(a)(i). The ICO had treated the exemption as absolute. The Tribunal clarified that it is a qualified exemption and therefore the public interest test should be applied. A public body when choosing to rely on this exemption should weigh up privacy v transparency. Applying this test, the Tribunal concluded that Mr Dunhill’s request was in the public interest. The Tribunal therefore disagreed that the Trust was entitled to rely upon Section 40(5B)(a)(i).

The appeal was ultimately allowed. The Tribunal substituted a new decision notice requiring the Trust to respond substantively to the PwC review element of the request within 28 days.