Aled Evans v The Information Commissioner & Anor

This is an appeal against the Decision Notice of the First Respondent (“the Commissioner”) referenced IC-270299-J1M1 dated 28 March 2024.

The Appellant requested information from the Second Respondent (“UHB”) relating to its investigation of a complaint made by the Appellant about the treatment and care of a third party (“the Patient”) at Glangwili General Hospital in 2022.

Upon arrival at Glangwili General Hospital by ambulance, the Patient was held in the ambulance for over 30 hours before being admitted. The Patient remained in the hospital until they died several days later. The Appellant alleges numerous shortcomings in the hospital’s care of the Patient during that period. UHB accepts certain shortcomings, for which it apologises, but not others.

Up to the point of the Decision Notice, UHB refused to disclose the requested information in reliance on s31(1)(g) of the Freedom of Information Act 2000 (“FOIA”) (prejudice to the exercise of a public authority of its functions) read with s31(2)(b) FOIA (for the purpose of ascertaining whether any person is responsible for any conduct which is improper).

Subsequently, in the course of this appeal, UHB has sought to rely on the following additional exemptions from disclosure:

The parties were agreeable to the appeal being determined on the papers. Having reviewed the hearing bundle and having then obtained further information and submissions from UHB, we are satisfied that we can properly determine the issues without a hearing, pursuant to Rule 32(1) of the Tribunal Rules.

We do not consider it necessary to issue a CLOSED judgment in this appeal. It is sufficient for the Tribunal to provide its reasons for its decision in this OPEN judgment.

The Tribunal’s decision is unanimous.

This judgment is structured as follows:

On 23 December 2022, the Appellant complained to UHB on behalf of the Patient, alleging that Glangwili General Hospital had acted negligently in its treatment and care of the Patient.

On 26 July 2023, UHB sent a detailed response to the Appellant’s complaint. UHB said that the complaint had been investigated “in accordance with the formal process for managing complaints, as established by the NHS (Concerns, Complaints and Redress Arrangements) (Wales) Regulations 2011, often referred to as the ‘Putting Things Right Process’. “

On 21 August 2023, the Appellant requested, by reference to UHB’s response of 26 July 2023, “Under the Freedom of Information act that all other information regarding this, which should include but not be limited to, emails, draft copies of reports, etc (to be sent electronically)” (“the Request”).

On 15 September 2023, UHB confirmed to the Appellant that it had identified 56 documents responsive to the Request. UHB refused to disclose certain of the documents in reliance on s21 FOIA (information already accessible to the Appellant), and the balance in reliance on s31(1)(g) FOIA in conjunction with s31(2)(b) FOIA. In relation to that latter category, UHB explained that the responsive information “include[s] emails and draft documents, where for investigation purposes the concern and draft response have been discussed openly between the independent investigation officer and clinical colleagues, who have reviewed documentation and provided professional opinion for consideration as part of the investigative process.”

UHB noted that s31 FOIA is a qualified exemption from disclosure, which means that the information can only be withheld if the public interest in maintaining the exemption outweighs the public interest in disclosure.

In favour of disclosure, UHB said this: “There is public interest in the openness and transparency of information. Disclosure would demonstrate that policies and procedures were followed, and a thorough investigation was undertaken, through the information collected, considered and assessed, as part of the ‘Putting Things Right’ process.”

Against disclosure, UHB said this: “The UHB requires the ability to conduct effective and thorough investigations and disclosure of these documents would inhibit the UHB from undertaking investigations with free and frank discussion. Professional opinion provided by doctors as part of these free and frank discussions allows the investigation officer to ask questions to get a better and fuller understanding of the matter they are investigating.”

UHB concluded: “The UHB has considered that releasing the information under the FoIA, to which the UHB is subject, could inhibit the UHB’s ability to conduct effective investigations which could in turn hinder the UHB’s ability to review practices and learn from patient stories. Whilst the public interest in the openness and transparency of the lessons learnt is strong, it is outweighed by the UHB’s need to undertake thorough unbiased investigations, utilising the professional opinion of trained clinicians to answer the questions that arise. Therefore, the public interest in withholding these documents is greater than the disclosure [sic].”

On 15 September 2023, the Appellant sought an internal review.

On 10 November 2023, UHB maintained its position on internal review. UHB said this:

On 14 November 2023, the Appellant complained to the Commissioner.

The Commissioner investigated. UHB provided detailed submissions to the Commissioner.

By the Decision Notice, the Commissioner decided that, in summary:

By Notice of Appeal dated 20 April 2024, the Appellant submits, in summary:

The grounds of appeal also take issue with several, specific paragraphs of the Decision Notice, namely submissions made by UHB to the Commissioner which the Commissioner describes in the Decision Notice before articulating his decision. They are as follows:

Although we understand that UHB was not joined as a Respondent to the appeal until 9 September 2024, UHB nevertheless filed a Response to the appeal, on 31 May 2024.

By that Response, UHB submitted a “List of principle [sic] issues” which we set out in full:

By an Amended Response to the appeal dated 9 September 2024, the Commissioner submits, in summary, that the Appellant has failed to set out in the grounds of appeal why the Commissioner’s Decision Notice is not in accordance with the law or why the Commissioner ought to have exercised his discretion differently. Accordingly, the Commissioner stands by his decision as set out in the Decision Notice and has no further submissions.

On 11 October 2024, UHB filed further submissions, settled by Counsel, in compliance with case management directions of Judge Buckley of 23 September 2024, by which UHB submits the following:

Additionally, UHB provided copies and explanations of legislative and policy material indicating the framework in which the Appellant’s complaint about the treatment and care of the Patient had been considered, relevant to the engagement of s31(1)(g) FOIA.

In that context, UHB first addressed the National Health Service (Concerns, Complaints and Redress Arrangements) (Wales) Regulations (SI 2011/704) (“the 2011 Regulations”), sketching the content and scope of 2011 Regulations to illustrate:

Second, UHB addressed the ‘Putting Things Right: Guidance on dealing with concerns about the NHS from 1 April 2011” (Version 4, May 2023) (“the PTR Guidance”), explaining that:

Third, UHB addressed its legal status and functions:

By its submissions of 11 October 2024, UHB submits that s31(1)(g) FOIA is engaged, when read with s31(2)(b) FOIA, for the following reasons:

In its submissions of 11 October 2024, UHB offers a submission in the alternative on s31(2)(j) FOIA, as follows:

On 25 October 2024, UHB filed further submissions, again in compliance with case management directions of Judge Buckley of 23 September 2024.

Those submissions addressed:

We summarise each submission in turn.

In relation to both s36(2)(b)(ii) and s36(2)(c) FOIA UHB submits that UHB’s Chief Executive, Professor Philip Koer, has, as the Qualified Person whose opinion is required by s36 FOIA, provided a reasonable opinion in which he identifies potential prejudice which is more likely than not to occur in the event of disclosure of the requested information.

In relation to s36(2)(b)(ii) FOIA, UHB submits, in summary: professionals would be less willing to engage with the PTR process in future, since they would be concerned about their professional opinion being disclosed to the world at large, and potentially used against them. It is further reasonable to conclude that that would inhibit UHB’s ability to undertake a thorough investigation, since investigators rely on the free and frank exchange of views between medical professionals to understand the quality of the care that has been provided.

In relation to s36(2)(c) FOIA, UHB submits, in summary: the PTR process (a public service) would be undermined in other ways by disclosure:

In relation to s41(1) FOIA, UHB submits, in summary, as follows:

In relation to s40(2) FOIA, UHB submits, in summary, that:

In relation to the public interest test, UHB submits, that if s41(1) FOIA and s40(2) FOIA are engaged, no public interest issue arises to be determined.

In relation to s31 and 36 FOIA, UHB submits that these exemptions protect an overlapping set of public interests, concerned chiefly with the effectiveness of the PTR process, but also with the effectiveness of the wider health services provided by UHB, and other NHS providers. Given the extent of the overlap, UHB invites the FTT to aggregate the weight of the qualified exemptions that it is claiming.

UHB submits that the public interest in maintaining the exemptions lies in avoiding the prejudices the exemptions envisage. Disclosure would have a chilling effect on the willingness of medical professionals reviewing care provision, witnesses to potential malpractice or poor care, employees accused of potential malpractice or poor care, and patients and their relatives/carers, to participate in the PTR process.

UHB submits that the PTR process serves a number of very important public interests:

As regards the public interest in disclosure, UHB submits, in summary, as follows:

UHB submits that the public interests in maintaining the exemptions, either singly or in aggregate, significantly outweigh the public interest in disclosure of the withheld information.

The relevant FOIA legal framework is as follows.

Section 1 FOIA provides as follows:

Section 2 FOIA provides as follows:

Section 31 FOIA provides as follows:

Section 36 FOIA provides as follows:

Sections 31 and 36(2) FOIA are subject to a public interest test which is found at s2(2)(b) FOIA: “in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.”

Section 40 FOIA provides as follows:

“Personal data” is defined by s3(2) of the Data Protection Act 2018 (“DPA”) as “any information relating to an identified or identifiable living individual”.

S3(3) DPA defines “identifiable living individual” as:

“Processing” is defined by s3(4) DPA in a number of ways, relevantly for current purposes as “disclosure by transmission, dissemination or otherwise making available” (s3(4)(d) DPA).

Article 5 UK GDPR identifies the data protection principles. Relevant for current purposes is Article 5(1)(a) which provides that “personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.”

Article 6 UK GDPR provides for specific circumstances in which processing of personal data is lawful, including, relevantly for current purposes: Article 6(1)(f) UK GDPR: “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”

Section 41 FOIA provides as follows:

Sections 40 and 41 FOIA are not subject to a public interest test.

Section 58 FOIA provides as follows:

The import of s58 FOIA is that the right of appeal to the First-tier Tribunal involves a full merits consideration of whether, on the facts and the law, the public authority’s response to the FOIA Request is in accordance with Part 1 of FOIA (Information Commissioner v Malnick and ACOBA [2018] UKUT 72 (AAC); [2018] AACR 29, at paragraphs [45]-[46] and [90]. In accordance with the decision of the Upper Tribunal in Montague v Information Commissioner and DIT [2022] UKUT 104 (AAC), at [86], “the public authority is not to be judged on the balance of competing interests on how matters stand other than at the time of the decision on the request which it has been obliged by Part 1 of FOIA to make.”

We read an OPEN bundle, a CLOSED bundle containing the withheld information, and updated versions of both the OPEN and CLOSED bundles.

After our initial deliberation on 17 September 2025, we identified and directed the provision of further material from UHB which we required in order to deliberate further. That material was filed on 21 October 2025, 3 November 2025 and 6 November 2025.

One of the items we directed was a colour-coded mark-up of the withheld information indicating those parts of the withheld information which UHB contends are subject to the various exemptions relied on. In response to that direction, UHB has provided a marked-up set of the withheld information but coloured only to show that information which is personal data. UHB explains the rationale for this approach as follows:

The OPEN hearing bundle contained two witness statements relied on by UHB.

The first statement was made on 16 September 2024 by Katie Marie Jenner, Senior Corporate Information Officer at UHB.

The second statement was made on 5 November 2024 by Louise O’Connor, Assistant Director (Legal Services/Patient Experience) at UHB.

By her statement, Ms Jenner explains, in summary, as follows:

By her statement, Ms O’Connor explains as follows:

It is important at the outset that we should clarify a number of matters.

First, we must explain the Tribunal’s role: it is to determine whether UHB has discharged its legal obligations under FOIA. It is not our role to determine whether any entity or person is or might be responsible for any alleged harm done to the Patient or is or might be responsible for improper conduct. It is not our role to make any finding of fact in relation to the Patient’s care and treatment. It is not our role to determine whether, as the Appellant alleges, UHB has covered up or sought to cover up matters relating to the Patient’s care and treatment. We have been shown the withheld information only so that we might identify whether UHB is entitled to withhold it under the FOIA exemptions claimed.

Second, we must explain what disclosure under FOIA is: although the Appellant may only want the withheld information for his own purposes and/or that of the Patient’s family, either because they wish to see it for their own satisfaction, or to provide it to the Ombudsman, or to use it for litigation, disclosure under FOIA is regarded as what is called “disclosure to the world”. That means that even though the Appellant or the Patient’s family may have no intention of disclosing the information to the world, and propose only to keep or use it for a specific purpose in a limited context, that is irrelevant. FOIA is not about disclosing information to limited parties for limited purposes but disclosing information to anyone and everyone. It is in that context that we must assess whether UHB is entitled to rely on the information being exempt from disclosure because it engages one of the exemptions from disclosure afforded by FOIA.

Third, some of the exemptions in FOIA are what are called qualified exemptions, which means that even if they are engaged, we must still assess whether the public interest in maintaining that exemption is outweighed by a public interest in disclosure, sometimes called “the public interest balance” or “the public interest test”. We identify below those exemptions relied on by UHB which are qualified exemptions and set out our analysis of the public interest balance in relation to each.

Fourth, and finally, the majority of the exemptions on which UHB seeks to rely were only introduced in the appeal in October 2024, after UHB was joined as a party to the appeal by the Tribunal on 9 September 2024. A public authority may rely on exemptions for the first time before the Tribunal, subject only to the FTT’s powers to control its own procedure: Information Commissioner v Home Office [2011] UKUT 17 (AAC).

We are satisfied that UHB notified the parties and the Tribunal as soon as practicable in this appeal of its reliance on the exemptions in issue, and that the Appellant has had sufficient opportunity to address those further exemptions before the appeal was heard, if he so wished. We are not aware that the Appellant has done so.

We take in turn below each exemption under FOIA on which UHB relies to refuse the Request.

We start our analysis of s31 FOIA by noting that in his grounds of appeal, the Appellant submits that s31 FOIA relates specifically to information leading to criminal acts, and, as we understand his submission, is irrelevant to the issues in the appeal, because he is requesting information to progress his complaint with the Ombudsman.

It is correct that s31(1) FOIA is headed “law enforcement” but that is a broad umbrella term indicating the scope and reasons for the exemptions in s31 FOIA. As Judge Turnbull noted in Stevenson v Information Commissioner and North Lancashire PCT EA/2011/0119:

S31(1) FOIA is not, therefore, applicable only to information relating to criminal acts.

A public authority’s “functions” are any power or duty exercisable by it for a specified purpose whether conferred by or under statute, common law or royal prerogative: Stevenson v Information Commissioner [2013] UKUT 181 (AAC) (“Stevenson”); confirmed in DVLA v Information Commissioner and Williams [2020] UKUT 334 (AAC).

UHB submits that it has a duty under Regulation 10 of the 2011 Regulations to investigate concerns that are duly raised and fall within the 2011 Regulations.

Regulation 4 (Duty to make arrangements) provides that:

Regulation 2 defines “concern” (“pryder” in Welsh) as:

Regulation 10 (Requirement to consider concerns) provides:

Regulation 13 (Matters about which concerns may be notified) provides that:

Regulation 2(1) defines “primary care provider” as

UHB submits that the definition of primary care provider is such that Regulation 13 covers concerns about almost all of the healthcare provided at UHB’s hospitals, community hospitals, centres and clinics.

UHB concludes that investigation of such concerns is thus a “function” of UHB (subject to Regulations 18 - 20 of the 2011 Regulations, which provide for certain concerns to be investigated instead by a primary care provider instead of a responsible body).

We interpret Regulation 10 as prescribing how a responsible body should handle a concern of a type which satisfies the lettered sub-sections, rather than as imposing a duty to investigate per se.

We read Regulation 4 as imposing a duty on UHB to handle and investigate any complaint, notification of an incident concerning patient safety or, save in respect of concerns notified in respect of primary care providers or independent providers, a claim for compensation, and to do so in accordance with the 2011 Regulations.

We accept that the 2011 Regulations, by Regulation 4, impose a duty on UHB to investigate, thus making investigation of a concern, as defined, a “function” of UHB. However, for the reasons which follow, we do not accept that such a function, derived from the 2011 Regulations, is “for the purpose of ascertaining whether any person is responsible for any conduct which is improper”.

S31(1) and s 31(2) FOIA taken together draft prescriptively, identifying nine public interest activities (in this case, the exercise by a public authority of its function to investigate a concern, as defined) which are then further defined by reference to ten very precise purposes (in this case, the purpose of ascertaining whether any person is responsible or any conduct which is improper).

Although we accept that investigation pursuant to the 2011 Regulations of a concern, as defined, is a function of UHB (within the meaning of s31(1)(g) FOIA in the sense identified in Stevenson), that is not, in our view a function for the very precise purpose of ascertaining whether any person is responsible for any conduct which is improper. It is a function to investigate. Nothing in the 2011 Regulations indicates any function for the precise purpose envisaged by s31(2)(b) FOIA; that is to say the 2011 Regulations do not confer a power or duty to be exercised by UHB for the specified purpose of ascertaining whether any person is responsible for any conduct which is improper.

We accept that it may become evident during an investigation that a person might be responsible for conduct which is improper, but it seems to us that that is a product of the investigative function, not its purpose.

We note UHB’s submission that there is nothing in the PTR Guidance which restricts the type of concern that a person can raise; that is to say, that there is no restriction on a person raising a complaint alleging improper conduct, which means that ascertaining whether a person is responsible for any improper conduct falls within UHB’s function to be discharged by the PTR process.

It is correct that the PTR Guidance is silent as to that. However, the PTR Guidance is not statute, common law or royal prerogative which, per Stevenson, are the instruments by which a public authority’s functions are created.

Rather, the PTR Guidance is simply guidance on the handling of concerns: it says that it will assist staff in interpreting the 2011 Regulations, and that arrangements for handling concerns in line with the requirements of the 2011 Regulations represent a significant cultural change for the NHS in Wales in the way in which it deals with things that go wrong, introducing a single and consistent method for grading and investigating concerns, as well as more openness and involvement of the person raising the concern.

In any event, nothing in the PTR Guidance points to the purpose of the PTR process being the ascertainment of whether a person is responsible for any improper conduct, that being the precise, prescriptive function required by s31(1)(g) FOIA read with s31(2)(b) FOA.

In the current context of a medical or healthcare setting, it seems to us that ascertainment of that responsibilitymeans deciding or determining whether a person is responsible for improper conduct.

In our view, the word “improper” viewed in the context of the purposes identified in s31(2) in the context of “law enforcement” (and, notably, as distinct from a failure to comply with the law (s31(2)(a) FOIA) connotes an issue of professional conduct, for example a serious and significant falling short of professional standards, whether with or without a breach of ethical standards.

Ascertaining whether a person is rather than may be responsible for such conduct seems to us to fall properly within the remit of a professional body or disciplinary tribunal in a professional conduct context.

There is nothing before us which indicates that UHB, whether by a PTR process or otherwise, is itself the entity to ascertain, in the sense of determine or decide in that context whether a person is responsible for improper conduct, even if the concern under investigation by UHB alleges such conduct or UHB identifies evidence which might point to such conduct. UHB has not provided us with any evidence that investigation of a concern in the PTR process includes UHB determining or deciding whether any of its staff is responsible for improper conduct as we construe it.

By UHB’s response to the Appellant’s complaint, dated 26 July 2023, UHB told the Appellant that:

There is nothing in UHB’s articulation of the outcome of its investigation to the Appellant which suggests that it had sought to ascertain or had ascertained whether any person was responsible for conduct which was improper. Rather it is an explanation of the Patient’s care and treatment together with an acknowledgment of certain shortcomings therein, and the learnings taken on board.

UHB submits that it matters not that it was no part of the instant investigation to ascertain whether any person was responsible for conduct which was improper because it is the chilling effect of potential disclosure in this case which would prejudice future PTR investigations, including those where ascertaining improper conduct may be a feature.

That submission is predicated, however, on UHB having a function, that is to say a power or duty conferred by or under statute, the common law or Royal Prerogative, precisely to ascertain whether any person is responsible for any conduct which is improper. UHB submits that such a function derives from the 2011 Regulations. We have rejected that submission. We see nothing in the 2011 Regulations which confers such a duty.

It is, in our view, irrelevant that disclosure might have a chilling effect which would prejudice future PTR investigations generally; the very thing which must be at risk of prejudice is the exercise of a function for the purposes of ascertaining whether any person is responsible for any conduct which is improper, in the sense we have defined “improper”. That does not, for the reasons we have given, include a PTR investigation, regardless of whether such an investigation may elicit evidence which points to the possibility of such responsibility.

Accordingly, we do not accept that UHB has a function, within the meaning of s31(1)(g) FOIA, to ascertain whether any person is responsible for improper conduct, and, on that basis, we find that s31(1)(g) FOIA read with s31(2)(b) FOIA is not engaged. Accordingly, the issue of the public interest balance does not arise.

UHB submits that pursuant to s12A of the 2006 Act, UHB has a duty, and thus a function, to secure quality in health services, and a duty pursuant to Rule 49 of the 2011 Regulations to learn from its investigations to improve its services. For convenience, we repeat those provisions below.

S12A of the 2006 Act provides:

Regulation 49 of the 2011 Regulations provides:

We are prepared to accept that a PTR investigation, and the required learnings from it, are sufficiently integral to UHB’s functions to secure quality in health services under the 2006 Act and to learn from its investigations pursuant to Regulation 49, as to constitute activities whose purpose is the protection of persons other than persons at work against risk to health or safety arising out of or in connection with the actions of persons at work.

Although we read the language of s31(2)(j) FOIA as redolent of health and safety legislation operative in the workplace, rather than naturally engaging failures in medical standards, we cannot deny that the goals of the PTR process include protections against risk to health or safety in a medical or hospital setting arising out of or in connection with the actions of persons working in those settings.

S31(1)(g) is prejudice-based exemption. The approach to be taken in prejudice cases was set out in the First Tier Tribunal decision of Hogan v Information Commissioner[2011] 1 Info LR 588, as approved by the Court ofAppeal in Department for Work and Pensions v Information Commissioner[2017] 1 WLR 1:

S31(1)(g) FOIA is a qualified exemption, which means that it only applies if in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.

Taking, first, the applicable interest: we consider that this is the discharge of UHB’s functions for the purpose of protecting persons other than persons at work against risk to health and safety arising out of or in connection with the actions of persons at work.

Taking, second, the necessary causal relationship between disclosure and a prejudice which is real, actual or of substance: we find a causal relationship between disclosure and risk to the discharge of UHB’s function. On the basis of the witness evidence before us, we are satisfied that disclosure would be likely to cause a chilling effect on future investigations, and that such a prejudice is real, actual and of substance.

We are prepared to accept that, in an investigative context, if a person is asked to provide honest, accurate and comprehensive information or opinion about the subject matter of a complaint in the knowledge that their contribution will be disclosed to the world at large, which is what a FOIA disclosure is, they may well, even if only unconsciously, tailor or restrict their contribution, or possibly decline to contribute at all, to protect themselves or others. Reduced or withheld contributions in that context diminish the quality of an investigation to the detriment of effective remediation or risk mitigation. That is prejudice which is real, actual and of substance.

Taking, third, the issue of likelihood: the question of the meaning of likelihood in the current context was addressed by the Tribunal in John Connor Press Associates v Information Commissioner (EA/2005/0005, 25 January 2006): “We interpret the expression “likely to prejudice” as meaning that the chance of prejudice being suffered should be more than a hypothetical or remote possibility; there must have been a real and significant risk.” In so doing, the Tribunal drew on the judgment of Munby J in R (on the application of Lord) v Secretary of State for the Home Office [2003] EWHC 2073 (Admin) (a Data Protection Act case) who said: “Likely connotes a degree of probability that there is a very significant and weighty chance of prejudice to the identified public interests. The degree of risk must be such that there ‘may very well’ be prejudice to those interests, even if the risk falls short of being more probable than not.” [100].

We adopt the interpretation of “likely to prejudice” as meaning that the chance of the prejudice being suffered is more than a hypothetical or remote possibility; there is a real and significant risk.

We do not accept that disclosure would cause prejudice. There is no clear evidence before us which indicates that, such as an example of disclosure having had precisely the effect for which UHB contends now.

Rather, we consider that disclosure would be likely to cause the prejudice.

We are assisted in this determination by the evidence given by Ms O’Connor whose work at UHB since 2009 includes: strategic responsibility and implementation of the 2011 Regulations; operational management of legal services; people experience; complaints; and patient support services teams; a wider remit for bereavement (care after death) services and arts and health. Ms O’Connor has been employed by UHB and its predecessor organisation since 1992, in a range of various roles, including oversight of complaints management. Ms O’Connor was involved in the review of the effectiveness of the 2011 Regulations in 2015 and the current Welsh Government refresh of the 2011 Regulations and Putting Things Right Guidance, in her role as Co-Chair of the all-Wales Heads of Patient Experience Network.

Ms O’Connor’s evidence in this context is speculative but not unprincipled. We consider that her roles and experience make her well placed to opine on the likely effect of disclosure, and we find her articulation of the consequent risk compelling. Her evidence is sufficient to persuade us that disclosure would be likely to cause the prejudice feared by UHB, namely prejudice to the exercise by UHB of its functions for the purpose of protecting persons other than persons at work against risk to health or safety arising out of or in connection with the actions of persons at work.

We accept that s31(1)(g) FOIA read with s31(2)(j) FOIA is engaged.

Accordingly, we must determine whether the public interest in maintaining the exemption is outweighed by the public interest in disclosure.

In favour of disclosure in this case is transparency in relation to the care and treatment received by the Patient, specifically whether the withheld information illuminates anything of import which is not apparent in UHB’s response to the Appellant of 26 July 2023.

Although we accept that this matter is of the greatest importance to the Appellant and the Patient’s family, and it is not inconceivable that were any of the withheld information to be disclosed under FOIA, it might encourage others to come forward indicating wider or more systemic issues meriting investigation (as to which we make no judgment), viewed in the round, we consider that the public interest in disclosure under FOIA in this case is relatively modest.

By the time of UHB’s refusal of the Request, there had been a PTR investigation. UHB had provided a detailed response to the Appellant, admitting shortcomings. UHB said in its response that “There were clearly areas where the standard of care was not as we strive to achieve. We have undertaken the learning from this...”

We note UHB’s submission that the Ombudsman has considered the matter and declined to take it further. By his letter of 22 January 2024, the Ombudsman said that he had considered the information provided, which we take to mean information provided by the Appellant, and included UHB’s response to the Appellant of 26 July 2023 at the conclusion of the PTR process.

The Ombudsman said this:

The Ombudsman went on to address discrete parts of UHB’s response to the Appellant, including specific aspects of the Patient’s treatment, explaining why, on the basis of the explanations given by UHB in relation to those aspects of treatment, he saw no basis for further investigation by him, and why.

However, the Ombudsman’s investigation and findings all post-date the refusal of the Request, which is the point in time at which we must assess the balance of the public interest. We do not consider, therefore, that these matters weigh in the balance of public interests which we must undertake.

We should observe at this juncture that we do not accept UHB’s characterisation, by Ms Jenner’s evidence, that the Appellant may have sought to mislead the Tribunal by saying that he requires the withheld information in order to pursue his complaint to the Ombudsman.

It is correct that the Ombudsman has already opined but it may be that the Appellant proposes to pursue matters with the Ombudsman, and considers that he needs the withheld information to do so. Whatever the position, the Appellant is unrepresented and attempting in very difficult circumstances where UHB has admitted shortcomings in the Patient’s care but declined to provide the requested information, to navigate the complex territory of FOIA and the hinterland of the legislation relating to UHB’s status and functions. It is not appropriate for UHB to characterise the Appellant’s approach in this way, even speculatively.

On the other side of the scales, in favour of maintaining the exemption from disclosure, we consider that the there is a very strong public interest in protecting the health and safety of patients, and that anything which would detract from a full and complete PTR process would prevent the best lessons from being learned and the best remedial action from being taken. In our view, that would diminish the protections for the health and safety of patients, not just in UHB but more widely.

We are not much persuaded by UHB’s submissions relating to the impact of disclosure on staff morale, and by extension staff retention and recruitment. It seems to us that there is something of a long stretch between disclosure of investigation files in this case adversely impacting a Just Culture environment and consequently staff retention and recruitment in rural Wales generally. We accept that UHB will wish to keep the well-being of its staff in mind, but we consider this issue to be of very limited weight on this side of the scales.

Balancing the interests we have identified, we are satisfied that the public interest in maintaining the exemption from disclosure pursuant to s31(1)(g) read with s31(2)(j) FOIA substantially outweighs any public interest in disclosure.

Reliance on s36 FOIA requires the opinion of a qualified person (“the QP”).

Professor Kloer, the Chief Executive of UHB, is authorised as the QP pursuant to s36(5)(gb) (ii) FOIA.

Professor Kloer was shown the withheld information in a submission prepared for him by UHB, which sought his opinion as to whether s36(2)(b)(ii) and s36(2)(c) FOIA were engaged.

The submission advanced the following arguments as to why prejudice would occur:

The submission identified counter-arguments as follows:

The submission identified other factors taken into account as follows:

The submission posited the following as reasons why disclosure would prejudice the free and frank exchange of views for the purposes of deliberation (s36(2)(b)(ii) FOIA):

The submission posited the following as reasons why disclosure would otherwise prejudice the effective conduct of public affairs (s36(2)(c) FOIA):

Professor Kloer signed the submission, adopting its contents as his opinion, on 25 October 2024.

Professor Kloer’s opinion need only be substantively reasonable, not procedurally reasonable. It is not for the Commissioner or the Tribunal to substitute their opinion for that of Professor Kloer as the QP.

UHB submits that the potential prejudice it fears from disclosure would, rather than would be likely to, occur. Thus, UHB aims to clear the higher threshold.

In the case of each of s36(2)(b)(ii) FOIA and s36(2)(c) FOIA, Professor Kloer opines that the potential prejudice envisaged is more likely than not to occur for the reasons he gives.

We are not immediately convinced that such prejudice would occur in either context, although we readily accept that such prejudice would be likely to occur. Nevertheless, we remind ourselves that the QP's opinion need only be reasonable. The fact that we may not be convinced that such prejudice would occur, and that we think instead that it would only be likely to occur, does not make unreasonable his opinion that such prejudice would occur. In this regard, we bear in mind the evidence of Ms O’Connor which we consider articulates cogently the consequences of disclosure, and are prepared to accept that, viewing all the evidence in the round, Professor Kloer’s opinion is reasonable, and that the feared prejudice would occur.

We note that Professor Kloer’s opinion was sought and given a little over a year after refusal of the Request, UHB coming late to reliance on s36 FOIA. In our view, however, having reviewed the facts and matters pertaining as at the date of refusal of the Request, Professor Kloer’s opinion, posited as applicable as at the date of refusal of the Request, is still reasonable.

The withheld information does not consist exclusively of the exchange of views between UHB employees participating in the PTR investigation. However, we are satisfied that that withheld information which does not consist of such views is integral to the formation, articulation, consideration and exchange of those views, including the working drafts of the letter of response to the Appellant, and that, taking an appropriately holistic view of the withheld information, s36(2)(b)(ii) and s36(2)(c) FOIA are each engaged in respect of the totality of the information.

Having found each exemption is engaged, we must determine whether the public interest in maintaining the exemption is outweighed by the public interest in disclosure.

In relation to s36(2)(b)(ii) FOIA: we accept that there is a strong public interest in transparency and accountability generally relating to medical care in a hospital setting, particularly in the challenging circumstances of Covid in 2022, and that that interest was arguably heightened so soon thereafter as September 2023, the date of refusal of the Request.

However, while we accept that this matter is of the utmost importance to the Appellant and the Patient’s family, that does not equate to a strong public interest in disclosure in this case. We consider that any public interest in disclosure is substantially outweighed by the public interest in the free and frank exchange of views for the purposes of an effective PTR process generally.

We accept that the PTR process relies on the willingness of medical professionals to review and give their professional opinion on the subject matter of complaints. We accept that they would not expect the information generated in that context to be disclosed to the world at large, and that where that possibility is in prospect, they may well be considerably more circumspect in their participation in an investigation.

Additionally, the prospect of disclosure may inhibit witnesses of fact, whose evidence as to what happened or did not happen, and the reasons therefor, may be critical to the formation of professional views, and a free and frank exchange of those views for the purposes of deliberation. In our view, such inhibition would be significantly to the detriment of the investigation process and outcome, and consequently, UHB’s ability to learn lessons and take remedial action.

Accordingly, we find that there is therefore a strong public interest in maintaining the exemption which outweighs any public interest in disclosure in this case.

In relation to s36(2)(c) FOIA: again, we acknowledge that there is a strong public interest in transparency and accountability generally to medical care in a hospital setting, particularly in the challenging circumstances of Covid in 2022, and that that interest was arguably heightened so soon thereafter as September 2023, the date of refusal of the Request. Again, however, we consider that the public interest in disclosure in this case is relatively modest.

We accept Ms O’Connor’s evidence of the need to put in place arrangements to manage the stress caused by complaints; ensuring staff have confidence in the process and are willing to be frank and, where appropriate, self-critical to improve their own performance and the overall standard of care. We readily accept that the prospect of disclosure to the world at large of information generated in the course of a PTR process may well diminish the willingness of staff to engage in the process.

We also consider that the prospect of disclosure to the world of information generated in a PTR process, including patient medical information, may discourage patients from advancing complaints, in many cases making insoluble, or at least very difficult to resolve, a real tension between a desire for investigation on the one hand and appropriate privacy for the patient on the other.

There is a strong public interest in the PTR process being “maximised” to its full potential both by UHB and any other body operating it: enabling redress (up to the sum of £25,000) without requiring the cost, strain and time of litigation; identifying evidence which might suggest improper conduct justifying further investigation; and enabling lessons to be learned for remediation and future risk management.

Accordingly, we find that there is a strong public interest in maintaining the exemption which outweighs any public interest in disclosure in this case.

The withheld information is replete with personal data of UHB’s employees. We are satisfied that the withheld information is personal data within the meaning of s3(2) DPA, and that its disclosure under FOIA would constitute processing within the meaning of s3(4)(d) DPA.

We must determine whether disclosure of that data under FOIA would contravene Article 6(1)(f) UK GDPR: specifically, would disclosure be lawful, fair and transparent?

Dealing with the first requirement of lawfulness: resolving that issue involves consideration of three questions (South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55) [18]:

Question c. above was framed by reference to the Data Protection Act 1998, which is now replaced by the DPA and the UK GDPR. It should therefore now reflect the words used in the UK GDPR - whether such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

We must determine these questions as at the time of refusal of the Request: 15 September 2023.

In relation to the first question of legitimacy: in his Notice of Appeal, the Appellant says that he requires the withheld information to pursue his complaint with the Ombudsman. We are prepared to accept that as at the time of refusal of the Request, and regardless of whether the Appellant then required the withheld information at that time for the purposes of pursuing his complaint with the Ombudsman or a complaint against UHB, or simply for his own understanding of the care of the Patient, the Appellant was pursuing a legitimate interest: attempting to understand the care and treatment of the Patient and the circumstances and cause of the Patient’s death. In our view, the relationship of the Appellant and the Patient to each other was such as to reinforce the legitimacy of that interest.

In relation to the second question of necessity: the word “necessary’ in this context must be interpreted consistently with its interpretation in EU jurisprudence, from which the concept derives in the GDPR and carries over into the UK GDPR. There it has a specific meaning: reasonable necessity rather than strict or absolute necessity. The processing to which the word “necessary” applies must be proportionate to the aim pursued by that processing and entail the minimum interference with the privacy rights of the data subject that will achieve the aim in question (R (Ali & another) v Minister for the Cabinet Office & another [2012] EWHC 1943 (Admin) [76]). It requires the consideration of alternative measures, so the measure must be the least restrictive means of achieving the legitimate aim in question (Goldsmith International Business School v Information Commissioner and the Home Office [2014] UKUT 563 (AAC)) [39] and South Lanarkshire [27]. For something to be necessary, there must be no other reasonable means of achieving it: Information Commissioner v Halpin [2020] UKUT 29 (AAC).

We do not consider that disclosure of the withheld personal data is necessary for the purposes of understanding the care and treatment of the Patient and the circumstances and cause of the Patient’s death. What is most obviously necessary to know in that context are the acts and omissions of the hospital, not the personal data of individuals who may be responsible for those acts or omissions or who may be participating in the PTR investigation.

In relation to the third question of the rights, freedoms and legitimate interests of individuals, assuming, contrary to what we have found, that disclosure is necessary to meet that interest, we find that that interest is overridden by the privacy rights of UHB’s employees.

We accept that such employees, participating in what they will likely understand to be an internal investigation in the first instance, have a reasonable expectation of privacy in relation to their personal data collected in such an investigation.

We accept that there is a real risk, and a risk which such employees would expect their employer to be alive to and guard against in that context, that were their personal data to be disclosed to the world at large, that may result in use of their data with serious, adverse and ungovernable consequences for them; for example where an aggrieved person may consider an employee to have been at fault, that person might use the personal data to contact the employee, or to publish information about them.

We find that disclosure of the withheld personal data would breach the data protection principle in Article 5(1)(a) UK GDPR. Accordingly, the personal data in the withheld information is absolutely exempt from disclosure pursuant to s40(2) FOIA.

We note, for completeness, that in UHB’s submissions of 11 October 2024 (paragraph 10), UHB referred to s40(2) FOIA as a qualified exemption. We consider that that must be an error. S40(2) FOIA is not a qualified exemption. There is no separate public interest balancing test to determine.

The exemption is absolute. FOIA does not require the application of a separate public interest test. However, FOIA requires us to consider whether disclosure of confidential information outwith FOIA would constitute an actionable breach of confidence, and that entails consideration of a public interest defence to such an action. Accordingly, the issue is whether in all the circumstances, it is in the public interest that the duty of confidence should be breached.

The requirements to establish a breach of confidence are set out in Coco v A N Clark (Engineers) Ltd [1969] RPC 41:

It is well established that a living patient’s medical information is subject to a duty of confidence. There is a strong presumption against disclosure of such information. A correspondingly strong public interest defence must be raised to justify disclosure.

In Webber v IC and Nottinghamshire Healthcare NHS Trust [2013] UKUT 648 (AAC) (“Webber”) the Upper Tribunal considered the application of s41(1) FOIA to the medical records of a deceased person. That case concerned a request by a mother for the medical records of her son, who had died while compulsorily detained in a hospital. The Appellant in that case had declined a suggestion that she should apply to be appointed as the deceased's personal representative and should then exercise the right of those holding that office to inspect medical records under the

The Upper Tribunal’s decision in Webber established certain points of principle which are binding on us:

We accept that the strictures against breaching confidence in the Patient’s medical information extend to what UHB characterises as “secondary information”, that is to say information recording analysis or discussion about the Patient’s medical information whose disclosure would effectively disclose the content of that medical information.

UHB submits that the fact that the Ombudsman has concluded that the care received by the Patient was not a matter which warranted further investigation in the public interest, indicates that it is very unlikely that a public interest defence to a breach of confidence action could be sustained.

We bear in mind that we must assess this issue as at the date of refusal of the Request, 15 September 2023, and that it was only subsequently, in 2024, that the Ombudsman declined to investigate the matter. We do not, therefore, take the Ombudsman’s decision into account in this context.

As it is, and bearing in mind the principles identified in Webber, we are unable in this case to identify a public interest defence to a putative breach of confidence in the Patient’s medical and secondary information.

We determine that the Patient’s medical information and secondary information is exempt from disclosure pursuant to s41(1) FOIA.

It is important to bear in mind that s41(1)(a) FOIA requires the information in issue to have been obtained “from any other person”. Thus, information created by UHB itself, whose disclosure would not disclose the Patient’s medical information or secondary information, would not automatically fall to be considered exempt under s41(1) FOIA.

We have considered carefully all the withheld information. To the extent that it contains information created by UHB itself which does not include the Patient’s medical information or secondary information, we consider that it is appropriate to take a holistic view of the withheld information; any information created by UHB itself is insubstantial and it is not practicable meaningfully to divorce it from the Patient’s medical information or secondary information.

Even were it possible to do so, we are satisfied that the information created by UHB itself would fall to be exempt from disclosure pursuant to s36(2)(b)(ii) and s36(2)(c) FOIA, for the reasons we have given.

It is open to UHB to seek to aggregate the public interests in maintaining the qualified exemptions from disclosure claimed pursuant to s31 FOIA and s36 FOIA.

We do not consider it necessary for UHB to do so in order to sustain its position in this appeal that it is not obliged to disclose the requested information under FOIA.

In the case of each of s31(1)(g) read with s31(2)(b), s36(2)(b)(ii), and s36(2)(c) FOIA we are satisfied that the public interest in maintaining the exemption from disclosure under each provision is sufficiently strong to justify refusal of disclosure of the entirety of the withheld information.

In conclusion: UHB was not entitled to refuse to disclose the requested information in reliance on s31(1)(g) read with s31(2)(b) FOIA. To the extent that the Decision Notice effects only the Commissioner’s decision that UHB was entitled to refuse to disclose the requested information in reliance on s31(1)(g) read with s31(2)(b) FOIA, because that is the only exemption on which UHB relied in its refusal of the Request in September 2023, the Decision Notice is not in accordance with the law.

However, for the reasons we have given, we find that UHB was entitled to refuse to disclose the requested information in reliance on s31(1)(g) read with s31(2)(j) of FOIA, and on s36(2)(b)(ii), s36(2)(c), s40(2) and s41(1) of FOIA, as we have variously set out. Accordingly, pursuant to s58(1)(a) FOIA, we substitute the Commissioner’s decision with the notice at the head of this judgment.