John Peters v IC (Allowed)

Factual and Procedural Background

This opinion concerns an appeal by the Appellant against the rejection by the First Respondent of his complaint that the Second Respondent had wrongly refused to disclose certain information under section 1(1)(b) of the Freedom of Information Act 2000 (FOIA). The appeal was decided on the papers without a hearing.

The Appellant suffers from chronic fatigue syndrome/myalgic encephalomyelitis (CFS/ME) and disputes certain research findings about the condition’s aetiology. The Appellant requested anonymised patient-level data from a trial (referred to as the SMILE Trial) conducted by the Second Respondent involving children aged 12 to 18 with mild or moderate CFS/ME. The trial compared specialist medical care with specialist medical care plus the Lightning Programme (LP), which is derived from osteopathy, life coaching, and neuro-linguistic programming.

The requested data included various outcome measures such as physical functioning scores, school attendance, fatigue scale scores, pain scores, and questionnaire results at multiple time points. The Second Respondent confirmed it held the requested information but refused disclosure relying on the exemption in section 40 FOIA, asserting that the information constituted personal data of research participants, and that disclosure would breach data protection principles.

The First Respondent upheld the Second Respondent’s refusal, applying the ‘motivated intruder’ test and concluding that there was a reasonable likelihood that individuals could be identified by combining the requested data with other information such as school attendance records. The Appellant challenged this decision before the Tribunal.

Legal Issues Presented

1. Whether the requested anonymised trial data constitutes personal data under section 40(2) FOIA and the Data Protection Act 1998.
2. Whether the ‘motivated intruder’ test is satisfied, i.e., whether a motivated intruder could reasonably identify trial participants by combining the requested data with other information.
3. Whether disclosure of the requested information would breach the data protection principles, in particular the first principle (DPP1) concerning fairness.
4. The scope of the Appellant’s FOIA request and whether age and gender data fall within it.
5. The applicability of the Data Protection Act 2018 to the request and appeal.

Arguments of the Parties

Appellant's Arguments

• The Appellant argued there was no realistic basis for the University’s fear that a motivated intruder could identify trial participants by combining the requested data with school attendance records, given the confidentiality and protection of those records.
• He contended that a motivated intruder should not be assumed to have prior knowledge and that the motivated intruder test excludes those with such knowledge.
• The Appellant submitted that no one would have a motivation to identify participants, as campaigners seek only to assess the trial’s methodology and conclusions, not to identify individuals.
• He disputed the assertion that information available on blogs or forums could facilitate reidentification, noting the data’s age and lack of such identifying information.
• The Appellant maintained that the requested data did not include age and gender, which he confirmed were outside the scope of his request.

First Respondent's Arguments

• The First Respondent initially upheld the Second Respondent’s refusal, applying the motivated intruder test and concluding that the requested data constituted personal data because reidentification was more than remote and reasonably likely.
• She recognised that the question of whether the data was truly anonymised was finely balanced and expressed some reservations about the strength of the evidence provided by the Second Respondent.
• The First Respondent suggested that parts of the request relating to two questionnaires might represent personal data or might not be held for FOIA purposes.
• She recommended that the Second Respondent be joined as a party to provide further representations on the risk of reidentification.

Second Respondent's Arguments

• The Second Respondent argued that the requested information was sensitive and personal data derived from children’s physical and mental health records, and that the participants or their parents had not consented to public disclosure.
• It asserted that a motivated intruder could identify participants by triangulating the trial data with school attendance records, which showed unusually low attendance for trial participants, making them stand out.
• The Second Respondent clarified that the recruitment centre was based in Bath and that participants were mainly drawn from between three and nine schools in that area, not the larger number of schools suggested by the Appellant.
• It emphasized that school attendance records, while confidential, were accessible to various professionals and that inadvertent disclosure to a motivated intruder was possible.
• The Second Respondent maintained that even a small risk of reidentification was unacceptable and that the data was appropriately classified as ‘controlled data’, shared only with bona fide researchers under strict conditions.
• It distinguished the present case from a prior Tribunal decision regarding a larger national adult trial, noting the smaller and more geographically limited cohort here.

Table of Precedents Cited

Court's Reasoning and Analysis

The Tribunal began by clarifying the scope of the Appellant’s FOIA request, concluding that age and gender were not within it. The core legal issue was whether the requested anonymised trial data constituted personal data under section 40(2) FOIA, which depends on whether individuals could be identified from the data alone or combined with other information accessible to the public or the data controller.

The Tribunal examined the ‘motivated intruder’ test, which assumes a competent, determined person with access to public resources but no prior knowledge or criminal means. The Tribunal noted that the test sets a threshold higher than an average person’s ability but lower than someone with specialist expertise.

The Tribunal considered the arguments and evidence regarding the likelihood of reidentification by triangulating the trial data with school attendance records or other sources such as social media. It found that although school attendance records might be accessible to some professionals, they are confidential and protected by motivated defenders, making unauthorized access unlikely.

The Tribunal further reasoned that low school attendance is not unique to CFS/ME and cannot conclusively identify trial participants, especially given that the trial participants represent only a small subset of children with such attendance patterns. Moreover, even if a motivated intruder assumed poor attendance indicated trial participation, they would lack certainty and could only make an educated guess, which does not amount to personal data disclosure under the law.

The Tribunal found no credible evidence that other sources could facilitate reidentification. It also rejected the Second Respondent’s argument that making data available to researchers under controlled conditions was relevant to the personal data issue.

Accordingly, the Tribunal concluded that the requested information did not constitute personal data and therefore the exemption under section 40(2) FOIA did not apply. It noted that had the data been personal, disclosure would likely breach data protection principles, but this was not determinative as the data was not personal.

The Tribunal also considered the effect of the Data Protection Act 2018 and concluded that the outcome would be the same under the newer legislation.

Holding and Implications

The Tribunal ALLOWED the appeal.

The Second Respondent was ordered to disclose the requested anonymised trial data to the Appellant, except for age and gender, which were outside the scope of the request.

This decision means that the exemption under section 40(2) FOIA is not available to withhold the requested information in this case. The Tribunal did not establish any new legal precedent beyond applying existing principles to the facts, and the ruling is limited to the specific circumstances of this appeal.