Patricia Murray v The Information Commissioner

Preliminary matters

1. In this decision , we use the following terms to denote the meanings shown: Appellant: Patricia Murray. Authority: Royal Free London NHS Foundation Trust. Commissioner: The Information Commissioner (the Respondent). Decision Notice: The Decision Notice of the Commissioner dated 17 April 2025, reference IC-343697-S0Z9 , relating to the Request. Department of Health case: The decision of the Court of Appeal in Department of Health v Information Commissioner and Lewis [2017] EWCA Civ 374. DPA: The Data Protection Act 2018. Duty to Disclose: The duty of a public authority to communicate requested information which it holds, pursuant to section 1(1)(b) (set out in paragraph 29). Farrand case: The decision of the Upper Tribunal in Farrand v Information Commissioner & London Fire and Emergency Planning Authority [2014] UKUT 310 (AAC). FOIA: The Freedom of Information Act 2000. Ground 1: The first of the Appellant’s grounds of appeal, as referred to in paragraph 19.a. Ground 2: The second of the Appellant’s grounds of appeal, as referred to in paragraph 19.b. Ground 3: The third of the Appellant’s grounds of appeal, as referred to in paragraph 19.c. Ground 4: The fourth of the Appellant’s grounds of appeal, as referred to in paragraph 19.d. Infringement Notice: The infringement notice issued to Celixir by the MHRA, as referred to in paragraph 9. MHRA: The Medicines & Healthcare products Regulatory Agency. Press Release: Celixir’s press release on 6 April 2020, referred to in paragraph 6 (quoted in the Appellant’s request for information on 13 September 2020 and in the Request). Public Interest Test: The test, pursuant to section 2(2)(b) (set out in paragraph 32), as to whether, in all the circumstances of the case, the public interest in maintaining the exemption to the Duty to Disclose outweighs the public interest in disclosing the information. Request: The request for information made to the Authority by the Appellant dated 8 August 2024 (following on from her request on 13 September 2020, referred to in paragraph 7 ) , as set out in paragraph 11. Requested Information: The information which was requested by way of the Request. Spivack case: The decision of the Upper Tribunal in NHS Business Authority v Information Commissioner & Spivack [2021] UKUT 192 (AAC). Tribunal Rules: The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009. UK GDPR: The General Data Protection Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018.

2. Unless the context otherwise requires (or as otherwise expressly stated), references in this decision : a. to numbered paragraphs are references to paragraphs of this decision so numbered; b. to any section are references to the applicable section of FOIA; c. to any Article are references to the applicable Article of the UK GDPR. Introduction

3. This was an appeal against the Decision Notice, which (in summary) decided that the Authority was entitled to rely on section 40(2) (personal information) to withhold the Requested Information. Background to the Appeal

4. The background to the appeal is as follows. Background and context preceding the Request

5. We understand that Celixir (as referred to in the Request) is a regenerative medicine company and that it sponsored a trial of its stem cell based therapy for heart failure at the Royal Brompton Hospital in London. Celixir is now known as Cardiogeni plc, but as the name ‘Celixir’ was used in the Request and in the Decision Notice we use that name in this decision for consistency.

6. On 6 April 2020, Celixir issued a press release which stated: “ The first patient was successfully dosed in the Company’s Heartcel clinical trial of its novel Imp cells in patients with cardiomyopathy on 16 March 2020 and is now in the follow up stage ”.

7. On 13 September 2020, the Appellant made a request for information to the Authority which included the following: “ According to Celixir’s press release, the first patient was treated on 16 March 2020. The trial has since been stopped and Celixir are being investigated by the MHRA. I request the following information:-

1. Did staff at the Royal Free thaw and culture the cells that were used to treat the patient on 16 March?

2. If not, did the Royal Free provide a vial of Celixir’s frozen cells to the Royal Brompton for administration to the patient on 16 March? ”.

8. The Authority gave the answer “no” to the first of the above questions and answered “yes” to the second.

9. On 17 July 2024, Celixir was issued with an infringement notice by the MHRA, relating to a failure by Celixir to comply with good clinical practice regulations.

10. Footnote 2 to the Infringement Notice stated “ It was subsequently confirmed that the patient in question had been administered a placebo. ”. The Infringement Notice also stated: “ To date we have no information that the patient, who was dosed has been informed, and you are required to provide to the MHRA any documents to enable us to confirm that we have correctly identified and contacted the patient. ”. The Request

11. On 8 August 2024, the Appellant (following on from her request on 13 September 2020 ) contacted the Authority and requested information in the following terms: “ I would like to ask a follow-up question on the response below. Regarding the questions about Celixir’s press release, question 2 asked “did the Royal Free provide a vial of Celixir’s frozen cells to the Royal Brompton for administration to the patient on 16th March?” Your replied “Yes”. I would like to ask if the vial that was provided was labelled “CLXR-H-18-004-3” or “CLXR-HPL-19-002”. ”.

12. The Authority responded on 4 September 2024. It refused to provide the Requested Information, citing section 40(2).

13. The Appellant contacted the Authority on 5 September 2024, requesting an internal review. The Authority responded on 4 December 2024, upholding its position.

14. The Appellant complained to the Commissioner about the Authority’s response to the Request and the Commissioner subsequently issued the Decision Notice. The Decision Notice

15. The Commissioner considered that the scope of his investigation was to determine if the Authority had correctly applied section 40(2) to withhold the Requested Information.

16. In the Decision Notice, the Commissioner determined (in summary) that: a. the Requested Information constituted personal data; b. the Requested Information also constituted special category data; c. none of the conditions required for lawful processing of the special category data were satisfied; d. disclosure of the Requested Information would therefore breach the first data protection principle (see paragraph 36.c); and e. consequently the Requested Information was exempt under section 40(2).

17. The Commissioner accordingly concluded that the Authority was entitled to rely on section 40(2) to withhold the Requested Information.

18. The Decision Notice did not require the Authority to take any further steps . The appeal The grounds of appeal

19. The Appellant’s grounds of appeal related to four main issues which, in summary, were as follows: a. The Commissioner erred in concluding that the Requested Information constituted personal data. We refer to this below as “Ground 1”. b. The Commissioner erred in concluding that the Requested Information constituted special category data. We refer to this below as “Ground 2”. c. The Commissioner erred in failing to properly weigh the public interest in disclosure of the Requested Information. We refer to this below as “Ground 3”. d. The Commissioner erred in failing to consider ‘less intrusive’ measures than full disclosure. We refer to this below as “Ground 4”.

20. We comment below on the material aspects of the Appellant’s grounds of appeal, as well as other relevant submissions of hers in respect of the appeal. The Tribunal’s powers and role

21. The powers of the Tribunal in determining this appeal are set out in section 58, as follows: “(1) If on an appeal under section 57 the Tribunal considers— (a) that the notice against which the appeal is brought is not in accordance with the law, or (b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal. (2) On such an appeal, the Tribunal may Review any finding of fact on which the notice in question was based. ”.

22. In summary, therefore, the Tribunal’s remit for the purposes of this appeal was to consider whether the Decision Notice was in accordance with the law. In reaching its decision, the Tribunal may review any findings of fact on which the Decision Notice was based and the Tribunal may come to a different decision regarding those facts. Essentially, the Tribunal is empowered to undertake a ‘full merits review’ of the appeal before it (so far as the Decision Notice is concerned). Mode of hearing

23. The appeal was determined by the Tribunal without an oral hearing. An oral hearing had been scheduled for the appeal, although the Commissioner had stated that he would not attend or be represented at the hearing and was content to rely on his written submissions. Shortly before the scheduled hearing date, the Appellant contacted the Tribunal to explain that she was unable to attend the hearing, for reasons which we don’t record here but which were well-founded and understandable. The Appellant therefore stated that she would be content for the Tribunal to determine the appeal on the papers, especially given that Commissioner would also not be attending the hearing.

24. We accordingly proceeded on the basis that we would consider the appeal without an oral hearing (having regard to the overriding objective in rule 2 of the Tribunal Rules), unless we concluded during our deliberations that it would be necessary to seek further submissions from the Appellant.

25. Ultimately, in light of the detailed submissions from the parties, including the written skeleton argument received from the Appellant, we considered that the appeal was suitable for determination on the papers in accordance with rule 32 of the Tribunal Rules. We were satisfied that it was fair and just to conduct the appeal in this way. The evidence and submissions

26. The Tribunal read and took account of an open bundle of evidence and pleadings, as well as a separate bundle of authorities from the Commissioner and a written skeleton argument from the Appellant.

27. All of the contents of the above were taken into account, even if not directly referred to in this decision.

28. The Tribunal was sent some further submissions from the Appellant, which were received after the Tribunal’s consideration of the appeal and accordingly those subsequent submissions were not taken into account. The relevant statutory framework We acknowledge the Practice Direction dated 4 June 2024 ( https://www.judiciary.uk/guidance-and-resources/practice-direction-from-the-senior-president-of-tribunals-reasons-for-decisions/ ) and particularly paragraph 9, which refers to the First-tier Tribunal not needing to specifically refer to relevant authorities. We include references to the applicable legislative framework, to provide relevant context, but (apart from reference s to some of the parties’ arguments ) have accordingly not referred to the applicable case law. and legal principles General principles

29. Section 1(1) provides individuals with a general right of access to information held by public authorities. It provides: “ Any person making a request for information to a public authority is entitled— (a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b) if that is the case, to have that information communicated to him. ”.

30. In essence, under section 1(1), a person who has requested information from a public authority is entitled to be informed in writing whether it holds that information. If the public authority does hold the requested information, that person is entitled to have that information communicated to them. However, those entitlements are subject to the other provisions of FOIA, including some exemptions and qualifications which may apply even if the requested information is held by the public authority. Section 1(2) provides: “ Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14. ”.

31. Accordingly, section 1(1) does not provide an unconditional right to be told whether or not a public authority holds any information, nor an unconditional right of access to any information which a public authority does hold. The rights contained in that section are subject to certain other provisions of FOIA, including section 2.

32. Section 2(2) addresses potential exemptions to the Duty to Disclose. That section provides: “ In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that— (a) the information is exempt information by virtue of a provision conferring absolute exemption, or (b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information. ”.

33. The effect of the above is that some exemptions which are set out in Part II of FOIA are absolute and some are subject to the Public Interest Test. Section 2(3) explicitly lists which of those exemptions are absolute (and, pursuant to that section, no other exclusions are absolute). Section 40(2) is included in that list, so far as relating to cases where the first condition referred to in that section is satisfied.

34. Accordingly, in summary, the exemption to the Duty to Disclose in section 40(2) is an absolute exemption only in cases where that first condition is satisfied, otherwise the exemption is subject to the Public Interest Test. Section 40 – personal information

35. So far as is relevant for the purposes of the appeal, section 40 provides: “… (2) Any information to which a request for information relates is also exempt information if— (a) it constitutes personal data which does not fall within subsection (1), and (b) the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act — (a) would contravene any of the data protection principles… ”.

36. Section 40(7) sets out applicable definitions for the purposes of section 40, by reference to other legislation, the applicable parts of which are as follows: a. Section 3(2) of the DPA defines “personal data” as “ any information relating to an identified or identifiable living individual ”. The “processing” of such information includes “ disclosure by transmission, dissemination or otherwise making available ” ( section 3(4) (d) of the DPA) and so includes disclosure under FOIA. b. The “data protection principles” are those set out in Article 5(1) and section 34(1) of the DPA. c. The first data protection principle, in Article 5(1)(a), is that personal data shall be: “ processed lawfully, fairly and in a transparent manner in relation to the data subject ”. d. A “data subject” is defined in section 3 of the DPA and means “ the identified or identifiable living individual to whom personal data relates ”.

37. To be lawful , the processing must meet one of the bases for lawful processing, which are set out in Article 6(1). Article 9 – special categories of personal data

38. Article 9 addresses some particular categories of personal data (set out in Article 9(1) and known as ‘special categories of personal data’) which are prohibited from being processed unless certain conditions (set out in Article 9(2); see below) are met. Pursuant to Article 9(1), the special categories of personal data are defined as: “ …personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation… ”.

39. So far as is relevant for current purposes, therefore, the special categories of personal data include “data concerning health”. Article 4 (15) defines “data concerning health” as: “ personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status. ”.

40. Recital 35 of the UK GDPR also specifies that personal data concerning health: “ should include all data pertaining to the health status of a data subject which reveal information relating to the past, current or future physical or mental health status of the data subject. ”.

41. Recital 35 of the UK GDPR also goes on to provide that this includes: “ any information on, for example, a disease, disability, disease risk, medical history, clinical treatment or the physiological or biomedical state of the data subject independent of its source… ”. Conditions for the processing of special categories of personal data

42. As noted above, special categories of personal data are prohibited from being processed unless certain conditions are met, as set out in Article 9(2). In other words, to be lawful, the processing of special categories of personal data must satisfy one of the conditions set out in in Article 9(2) - in addition to having another lawful basis for processing under Article 6(1) . For the purposes of the appeal, the following of those conditions are relevant.

43. Article 9(2)(a) provides (so far as is relevant): “ the data subject has given explicit consent to the processing of those personal data for one or more specified purposes… ”.

44. Article 9(2)(e) provides: “ processing relates to personal data which are manifestly made public by the data subject ”.

45. Article 9(2)(g) provides: “ processing is necessary for reasons of substantial public interest, on the basis of domestic law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and interests of the data subject ”. Discussion and findings The scope of the appeal

46. The Appellant made some allegations regarding Celixir and its activities (including allegations of fraud and misrepresentations) and regarding its CEO. We consider that it is therefore important to stress the scope of the appeal.

47. As we noted in paragraph 21 (and summarised in paragraph 22), the scope of the Tribunal’s jurisdiction relates to the lawfulness of the Decision Notice. In particular, the fundamental issue which we needed to determine was whether the Decision Notice was correct to conclude that the Authority was entitled to rely on section 40(2) to refuse to disclose the Requested Information . Any other issues are beyond the Tribunal’s powers to determine and fall outside of the scope of the appeal.

48. Accordingly, the appeal was not about the lawfulness or otherwise of the activities of Celixir or its CEO, any issues relating to the clinical trial it conducted, or any related matters. We have no jurisdiction to determine any such issues. The purpose of the Request

49. Whilst FOIA is “motive blind”, the following may provide some helpful context for the purposes of our discussion below.

50. The Appellant stated that the Requested Information (namely, whether the vial provided to the Royal Brompton Hospital on 16 March 2020 by Celixir was labelled “CLXR-H-18-004-3” or “CLXR-HPL-19-002”) would determine whether the patient to whom the content of the vial was administered received cells or a placebo. The labelling on the vial is also referred to below as the ‘batch number’.

51. It was also evident from the Appellant’s submissions that a factor in seeking the Requested Information was that knowing whether or not the patient was administered a placebo would reveal whether Celixir misled the MHRA (in respect of the Infringement Notice stating that it had been confirmed that the patient had been administered a placebo). In this regard, we reiterate our comments above about the scope of the appeal (although see also our comments below regarding the public interest in respect of Ground 3). Ground 1

52. The basis of Ground 1 was that the Commissioner erred, in the Decision Notice, in concluding that the Requested Information constituted personal data.

53. As we have noted, section 3(2) of the DPA defines “personal data” as “ any information relating to an identified or identifiable living individual ”. An ‘identifiable’ living individual is one who can be identified, directly or indirectly. It may be helpful to quote the explanation of this definition given in the Farrand case: A t paragraph 18 of that case . “ It… [provides] for two possibilities: (i) the data alone may allow the data subject to be identified; (ii) identification may require the addition of other information. The important issue is whether the data can be related to a living individual, not whether that person can be identified from any particular part of the data. ”.

54. The Decision Notice recorded the Commissioner’s finding that, because the Infringement Notice had referred to only one patient receiving a placebo, the patient was identifiable.

55. In essence, the Appellant asserted that the stated position in the Farrand case did not extend to the batch number, on the basis that it is an ‘inert’ manufacturing code with no nexus to identify any individual and was therefore not data ‘about’ a patient who is ‘identifiable’. Likewise, the Appellant argued that the Press Release and the Request referred only to an anonymised “patient”, with no identifiable details.

56. The Commissioner submitted, in his response to the appeal, that there was no dispute that the Requested Information ‘relates to’ an individual, on the basis that it relates to one living individual (the patient) who was administered the content of the vial. The Commissioner accordingly asserted that there was no dispute that the first limb of the definition in section 3(2) of the DPA is met, but rather that the relevant issue for Ground 1 was the second limb of that definition; whether the individual is ‘identified or is identifiable’ from the Requested Information.

57. We consider that the Commissioner was mistaken in his view that there was no dispute that the Requested Information ‘relates to’ an individual. We understood the Appellant to dispute that any aspect of the Requested Information met the definition of ‘personal data’. Indeed, part of the Appellant’s argument was that the Commissioner wrongly conflated the Request with ‘personal data’. The Appellant submitted that a batch number is a manufacturing code and “is a product identifier, not a person identifier” because it contains no biographical content about the patient and is not linked to patient identifiers in any public dataset. The Appellant therefore argued, essentially, that revealing the batch number would only show if the vial contained cells or a placebo but that this did not make the patient identifiable.

58. The Commissioner’s view was that the patient was identifiable because only one patient had been referred to in the Press Release, the Infringement Notice (which referred to only one patient ‘receiving a placebo’) and the Request (see paragraph 71). The Commissioner did not consider that the batch number itself could identify an individual, but that the patient could identify themselves, or could be identified by the Appellant or by the patient’s friends and/or family.

59. The Commissioner considered that the patient could be so identified using information already known to those people or when combined with information from other sources. His view was that information in a news report or academic paper might lead those people (or another interested party) to “put the pieces together” and identify if a particular person was involved in Celixir’s clinical trial. Accordingly, taking into account considerations regarding indirect identification, particularly the ‘motivated intruder test’, the Commissioner’s view was that identification of the patient could occur even without the batch number.

60. The correct test for ‘personal data’, as set out in the Spivack case, is (having regard to the definition of “personal data” in section 3(2) of the DPA) whether or not a living individual could be identified, directly or indirectly – and that is a binary test; either they could or they could not. The Spivack case went on to say that “ The test has to be applied on the basis of all the information that is reasonably likely to be used, including information that would be sought out by a motivated inquirer… ”.

61. Both parties accepted that the test for ‘personal data’, as set out in the Spivack case, involves an assessment of ‘all means reasonably likely to be used’, although the Appellant argued that, as the batch number could not be linked to a person’s identity via any public dataset, then the definition of personal data was not met. The Appellant also considered that the Commissioner had erred in taking into account hypothetical scenarios such as people “piecing together information” or unevidenced matters such as news reports or academic papers. The Appellant also submitted that the ‘motivated intruder’ test was wrongly applied by the Commissioner.

62. The Appellant’s position was that, as potential identification of an individual involved the use of means ‘reasonably likely’ to be used, this required a plausible, evidence ‑ based pathway and accordingly that speculation or conjecture was insufficient. The Appellant sought to distinguish the Spivack case on the basis that, in that case, pharmacy data could theoretically have been linked to named individuals but that there was no such link in respect of the Requested Information.

63. We agree with the Appellant that the Commissioner took into account some factors which are speculative in nature (such as news reports or academic papers), on the basis that no evidence was before us that there were any such news reports or academic papers relevant to a potential identification of the patient.

64. Incidentally, however, we understand why the Commissioner considered that there may be some such news reports or academic papers. The Commissioner and the Authority both took the view that the trial at the Royal Brompton Hospital would have had some publicity and that there is likely to be some academic interest. Indeed, the Press Release was a form of publicity regarding the clinical trial and the Request itself is demonstrative of there being some interest in the trial and in the administration of the vial to the patient. Also, as the Authority pointed out to the Commissioner, the Appellant may well have further relevant knowledge as she was able to provide the batch numbers from the vials when making the Request.

65. However, even disregarding the factors taken into account by the Commissioner which are speculative in nature, in our view the patient is identifiable in any event for the reasons we refer to.

66. The Press Release, the Infringement Notice and the Request (together with the Appellant’s earlier request on 13 September 2020) all referred to a single “patient”. Accordingly, the relevant context on the facts of this case is that there is reference to one person (the patient), who was administered the contents of the vial, and the date on which those contents were administered (16 March 2020).

67. Given that context, we consider that the Commissioner was correct to conclude that the patient was identifiable. This is information about one specific person, what was biologically administered to them and on what date. We consider that this information makes the patient identifiable. The patient could identify themselves based on this information (knowing that they were in the Royal Brompton Hospital on that date and that they either know that they were administered the vial and/or that they took part in the clinical trial).

68. We also agree with the Commissioner’s views that the patient could be identified by their friends and family, if they knew that the patient was taking part in the trial and/or by knowing the date on which the patient was at the Royal Brompton Hospital on the date of administration of the vial. Likewise, we consider that staff at the hospital would be able to identify the patient based on the hospital records or by simple knowledge of the fact that only one patient was given the vial as part of the trial.

69. The Appellant argued that there was no evidence to support the view that the patient would be identifiable, by their family or friends or by any other ‘motivated intruder’. Likewise, the Appellant also argued that the Commissioner had provided “no plausible chain or means” reasonably likely to be used for identifying the patient.

70. As we have noted, whether or not an individual can be identified includes ‘indirect’ identification, and the test is applied on the basis of all the information that is ‘reasonably likely’ to be used, including information that would be sought out by a motivated inquirer. Aside from our comments that the patient could identify themselves based on the information in question, we find that the other means of identification we have referred to are based on information ‘reasonably likely’ to be used, such that the patient is identifiable.

71. Also, potential disclosure of information under FOIA involves consideration of the information sought and the request for that information. Accordingly, in this case, consideration of disclosure of the Requested Information also means assessing whether the patient would be ‘identifiable’ taking into account the wording of the Request. In other words, the Request itself forms part of the context in which potential identification of an individual takes place. In this case, the Request (which also involves consideration of the Appellant’s earlier request on 13 September 2020) included reference to the Press Release and to “the patient”.

72. Consequently, even disregarding the potential for a ‘motivated intruder’ who does not have a connection with the patient to identify them, we find that the patient is identifiable, by their friends and family (and by the patient themselves), based on the information we have referred to, in conjunction with the Request (and the additional context provided by the Appellant’s earlier request on 13 September 2020).

73. For the above reasons, we do not accept the Appellant’s argument that the Commissioner wrongly conflated the Request with ‘personal data’. We also find, for the reasons we have given, that the Requested Information constitutes personal data (of the patient), taking into account the wording of the Request (combined with the preceding request dated 13 September 2020).

74. Accordingly, we find that the Commissioner was correct to conclude in the Decision Notice that the Requested Information constitutes personal data.

75. We should also briefly comment on a further point made by the Appellant, which was to the effect that the Requested Information could not constitute personal data because this would mean that the publication by the MHRA of the Infringement Notice would also be an unlawful disclosure of special category personal data. The Appellant considered that this would be an “absurd result” and that it was “inconceivable” that the MHRA would act unlawfully in that regard.

76. It is not part of our remit to assess the lawfulness of the MHRA’s actions in publishing the Infringement Notice, but we do not accept (as a premise) that it is “inconceivable” for the MHRA to have acted unlawfully. This is because it is conceptually conceivable that any organisation may act unlawfully regarding the processing of personal data (whether intentionally or not) and that no organisation is infallible (particularly taking into account the potential for human error).

77. We therefore do not accept the Appellant’s argument that it would be wrong to conclude that the Requested Information constituted personal data, on the basis that it would mean that the Infringement Notice also included disclosure of personal data. More importantly, our assessment above has been undertaken independently of any consideration as to whether or not the Infringement Notice involved any unlawful processing of personal data. Ground 2

78. Given our finding that the Requested Information constitutes the personal data of the patient, we now turn to address Ground 2, relating to whether the Commissioner erred in concluding that the Requested Information constituted special category data (as referred to in paragraph 38).

79. The Appellant’s position was that the Commissioner, in the Decision Notice, misapplied Article 9 by classifying the batch number of the vial as health data. The Appellant argued that the Commissioner’s conclusion that the Requested Information concerns the health information of the patient conflates the content of the vial (which the Appellant stated was not sought by the Request) with its identifier and that the batch number is a manufacturing code, not a medical record. The Appellant further argued that, pursuant to the Spivack case, there was a requirement for “direct linkage” to an individual’s medical condition and that in the Spivack case, even pharmacy dispensing data was deemed not to be personal data where identification required costly or impractical means.

80. As we have noted, the definition of ‘special category data’ in Article 9 includes “data concerning health”, which in turn is defined as covering data which reveals information about an individual’s health status, and this includes any clinical treatment.

81. For the reasons we have given, the Requested Information is personal data and it relates to a batch number of a vial for administration to the patient - and knowing the batch number would reveal whether the patient was given a placebo or not. We therefore find that the Requested Information comprises personal data concerning health, relating to the provision of health care services, which would reveal information about the patient’s health status.

82. Accordingly, we find that the Commissioner was correct to conclude in the Decision Notice that the Requested Information constitutes special category data for the purposes of Article 9. Ground 3

83. Ground 3 was the Appellant’s contention that the Commissioner erred in failing to properly weigh the overwhelming public interest in disclosure of the Requested Information. In connection with this, the Appellant contended that the Commissioner did not consider the application of one of conditions in Article 9(2) which would permit the processing of special categories of personal data; namely, Article 9(2)(g) regarding processing which is necessary for reasons of substantial public interest.

84. In this case, given our finding that the Requested Information comprises special category personal data, the relevant processing would be the disclosure of it by the Authority to the public under FOIA.

85. Essentially, the Appellant considered that the condition in Article 9(2)(g) would be met on the basis that disclosure of the Requested Information would expose potential misconduct of Celixir and its CEO (regarding alleged fraud of the CEO and sanctions imposed on Celixir in Greece for misconduct of clinical trials cited by the Appellant). The Appellant also stated that the Infringement Notice conflicts with Celixir’s claims, raising concerns about the integrity of the clinical trial in question. The Appellant also raised concerns that Celixir had falsely claimed that it has an ongoing EU trial.

86. Linked to the foregoing (and as we have already noted), part of the Appellant’s rationale in seeking the Requested Information was that knowing whether or not the patient was administered a placebo would reveal whether Celixir misled the MHRA.

87. We understand why the Appellant considers that disclosure of the Requested Information would be in the public interest, given the concerns that she has raised. However, the key word in Article 9(2)(g) is that the processing must be “necessary” for reasons of substantial public interest.

88. Accordingly, even if we were to accept that the concerns raised by the Appellant amounted to substantial public interest, the disclosure of the Requested Information must be necessary for that purpose. In our view it is not necessary, because there are other means by which the Appellant’s concerns could be met, including by way of a complaint to the MHRA.

89. We accept that the Decision Notice did not address the potential application of the condition in Article 9(2)(g), but we do not consider that the Decision Notice involved an error in law in that regard, given our conclusion that such condition is not met.

90. For completeness, we also briefly address the application of the other conditions for processing of special categories of personal data in Article 9(2) which were referred to in the Decision Notice (even though these were not challenged by the Appellant in the appeal).

91. First, we agree that the other only potentially applicable conditions for disclosure of the Requested Information are those in Article 9(2)(a) (explicit consent from the data subjects) and Article 9(2)(e) (data made manifestly public by the data subject).

92. Secondly, as the Decision Notice recorded, there was no evidence or indication that the patient (being the data subject of the Requested Information, for the reasons we have noted) had consented to the Requested Information being disclosed or that the patient had manifestly (or ‘deliberately’) made the Requested Information public.

93. Accordingly, for the reasons we have given, we find that the Commissioner was correct to conclude in the Decision Notice that no conditions were met to enable lawful processing of the Requested Information (as special category personal data). Ground 4

94. The essence of the Appellant’s argument regarding Ground 4 was that the Commissioner erred in failing to consider the possibility of anonymised disclosure of the Requested Information. The Appellant considered that this should have been considered as a ‘less intrusive’ measure than full disclosure of the Requested Information, especially given the Commissioner’s stated position regarding the patient being identifiable through the Requested Information.

95. The Commissioner, in his response to the appeal, asserted that it was “very unlikely” that any anonymisation or other less intrusive measure could be used to avoid identification of the patient, given that the Requested Information was information held concerning the label on the vial. The Appellant argued that the Commissioner had provided no reasoning as to why anonymisation was not feasible.

96. Given our conclusions above that the Requested Information constitutes the patient’s personal data and that the patient would be identifiable by disclosure of it, we find that it would not be possible to anonymise the Requested Information or employ any other measures to avoid identification of the patient. In other words, for the reasons we have given, the Requested Information (regarding the labelling on the vial, which would confirm whether or not the patient was administered with a placebo) is inextricably linked with the patient’s personal data and so we consider that it is not possible to disclose the Requested Information without also releasing the patient’s personal data. Other points

97. The Appellant submitted in her skeleton argument that one of the issues to be determined in the appeal was that, if the Requested Information constitutes personal data, whether disclosure of it would nevertheless comply with the first data protection principle (requiring processing to be lawful, fair and transparent). The Appellant asserted that disclosure of the Requested Information would be lawful under Article 6(1)(f). Article 6(1)(f) relates to processing of personal data which is necessary for the purposes of legitimate interests (unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject).

98. The Appellant had not argued this point in her earlier submissions but only raised it in her skeleton argument. Nevertheless, we would briefly observe that it is not necessary to consider the application of Article 6(1)(f) because disclosure of the Requested Information would, in any event, be unlawful for the reasons we have given above. Summary

99. For the reasons we have given, we conclude that: a. the Requested Information constitutes the personal data of the patient and is also ‘special category’ personal data (on the basis that it relates to the patient’s health data); b. no conditions under Article 9(2) for the processing of that special category data by disclosure under FOIA are satisfied, and therefore there is no lawful basis for such disclosure; c. it is not possible to anonymise the Requested Information in respect of such disclosure; d. such disclosure would therefore contravene the first data protection principle; and e. consequently the Requested Information is exempt from disclosure under section 40(2). Final conclusions

100. For all of the reasons we have given, we find that the Decision Notice was correct to conclude that the Authority was entitled to rely on section 40(2) to refuse to disclose the Requested Information.

101. We therefore dismiss the appeal. Signed: Stephen Roper Date: 11 March 2026 Judge of the First-tier Tribunal