White v The Information Commissioner [2026]

Diane White (Appellant) made a Freedom of Information Act (FOIA) request on 14 November 2024 to Bryn Siriol Respite Service (Authority). As part of this request, she asked for confirmation of the number of persons residing in Carmarthenshire who used the service in Aberystwyth.

The Authority responded on 2 January 2025 and provided an anonymised figure of “five or less” explaining that the data had been aggregated due to the risk of identification arising from the low numbers.

Unhappy with the response and wanting a precise number, the Appellant lodged a complaint with the Information Commissioner. The Commissioner issued a decision notice and concluded that the Authority was entitled to withhold the exact number in accordance with Section 40(2) of the FOIA.

The Appellant did not accept the Commissioner’s findings and lodged an appeal with the First-tier Tribunal seeking to challenge the decision notice.

The Law

Section 40(2) of the FOIA exempts an Authority from disclosing information in response to FOIA request if it is personal data of a third party and disclosing it would contravene a data protection principle.

Personal data is defined by Section 3(2) of the Data Protection Act 2018 as information relating to an identified or identifiable living individual.

In accordance with Article 5(1)(a) of the UK GDPR, processing must be lawful, fair and transparent. Whether processing is lawful is assessed by reference to Article 6(1) of the UK GDPR which sets out the lawful bases for processing data.

One of the lawful bases is legitimate interest in which a controller is required to establish the following: (1) a legitimate interest; (2) necessity; and (3) conduct a balancing exercise between the legitimate interest and the data subject’s rights.

Tribunal’s Decision

The Tribunal was tasked with determining whether the Commissioner’s decision notice was correct.

The Tribunal was satisfied that the requested information constituted personal data in line with the definition present within the Data Protection Act 2018. The Tribunal had the benefit of open and closed evidence. Having regard to the closed evidence, the Tribunal was satisfied that disclosure of the precise number could confirm the identity of an individual by elimination and that identification would be reasonably likely.

The Tribunal accepted that there is a general legitimate interest in transparency in relation to the allocation of publicly funded care services. The Tribunal however found that the Appellant’s interest was a personal one and that she was ultimately trying to ascertain whether a particular individual was the sole user of the service from Carmarthenshire. The Tribunal was not satisfied that the disclosure of the exact number was necessary to meet the legitimate interest relied upon because the disclosure of “five or less” already provided a measure of transparency.

The Tribunal then turned its attention to the balancing exercise and concluded that disclosure of the precise number would add little to public understanding but would materially interfere with data subjects’ rights and therefore that the balance fell against disclosure.

The appeal was dismissed accordingly.

Comment

The above is a reminder that authorities can legitimately withhold data in response to a FOIA request if the data in question is personal data (i.e. data relating to an identified or identifiable living individual). If you are unsure as to your position in relation to a FOIA request it is important that you seek legal advice as soon as possible.