NHS Bodies: 5 years of ICO decisions

By Dr Minh Alexander NHS whistleblower and former consultant psychiatrist 18 April 2017 

Summary: This piece reports on patterns in five years’ data of upheld complaints about NHS responses to FOI requests. The picture is one of a multi-billion corporation throwing its weight about and sometimes defying even the ICO. There have been over 500 ICO decision notices about NHS bodies, and almost 200 upheld complaints. Two NHS bodies emerge as behaving especially badly: NHS England and the Department of Health. There are signs suggestive of politicisation by public servants whose duty it is to be neutral, and various games are evident. At the Department of Health, repeated spurious claims have been made that disclosure of information would prejudice the effective conduct of public affairs or infringe on ministerial prerogative, which have been rejected by the ICO. The Department has absurdly even refused to provide data on grounds of national security, also rejected.

The Freedom of Information Act (FOIA) is one of the most useful and powerful tools for holding power to account.

The establishment resents this and some have tried unsuccessfully so far, to weaken and dismantle FOI provisions. 1

Those who resist transparency typically complain that FOI is a costly disruption to the smooth running of government.

The reality is that the government and its satellites spend much more on public relations than on responding to FOI requests.  2 Clearly then, the FOIA is an important protection against government spin, and supportive of democratic values and the public interest.

If governments were more open and routinely published more information, there would not be such a demand for information via the FOIA.

The NHS has been described as a ‘denial machine’, and its relationship with the Freedom of Information provisions has not always been straightforward. 3

Based on the Information Commissioner’s recent annual reports, about 10-12% of complaints to the ICO relate to the Health sector. 4

In 2012, an ICO audit of 15 NHS hospitals and trusts, focussing on protection of personal data under the Data Protection Act, concluded that: “…27% fell within the limited assurance range”. 5

I looked at five years’ published data on decisions by the Information Commissioner’s Office about NHS bodies, including the Department of Health. The extracted data about NHS bodies is available here:

ICO NHS decisions 1 April 2012 to 31 March 2017

In the five year period 1 April 2012 to 31 March 2017 (roughly corresponding with the interval in which Jeremy Hunt has been Secretary of State for Health), according to decision notices published by the ICO, there were a total of 533 complaints to the ICO about NHS bodies, of which 198 were upheld.

The Department of Health and NHS England together accounted for about a fifth of all the NHS complaints (n = 108), and a quarter of the upheld complaints (n = 50).

These complaints will represent only a proportion of the concerns about NHS bodies’ response to FOI data requests. This is because not all requesters complain formally to ICO, and decision notices are only issued in a proportion of complaints. In the last two years for which there is published data, the ICO issued about one decision notice for every five complaints received.

Screen Shot 2017-04-19 at 12.16.30

Attrition can be expected, as in any process that is under-pinned by complicated law, there is inequality of arms. NHS bodies can hoodwink, outgun and intimidate complainants by abusing a bottomless public purse.


Grounds upon which the ICO upheld complaints

All the ICO decisions in the five year period related to complaints about NHS bodies’ responses to FOI requests. In a handful of cases, there was an indirect relationship to the Data Protection Act because complainants had wrongly requested personal data via FOI, instead of the DPA.

In some cases, the breaches identified by the ICO were relatively minor or were limited failures set against largely appropriate disclosure. However, some breaches related to substantive failure to disclose all or most of the legitimately requested data.

The most frequent featured grounds for the ICO upholding complaints was ‘Section 10’ – delay in meeting the statutory deadline of 20 working days in responding to FOI requests. Section 10 featured in over half (111) ICO decisions.

Repeatedly misapplied grounds for not disclosing – either because they were not at all engaged or because they were over-ridden by the public interest – included:

Section 43 – commercial interests 6 (28 cases)

Section 41 – information given in confidence 7 (16 cases)

Section 36 – prejudice to the effective conduct of public affairs 8 (11 cases)

Section 40 – protection of personal data 9 (8 cases)


Action ordered by ICO

 Public authorities are required to comply with ICO orders within 35 calendar days, or risk High Court action:

Failure to comply may result in the Commissioner making written certification of this fact to the High Court pursuant to section 54 of the FOIA and may be dealt with as a contempt of court.”

The ICO required no further action by NHS bodies in 34.3% (68 of 198) cases of upheld complaints. Often, this was because data had been provided by the time of the ICO decision, or because of technical errors which did not affect the substantive outcome of the case.

In 27.2% (54 out of 198) cases of upheld complaints, the ICO ordered NHS bodies that had failed to respond, or withheld data on incorrect grounds, to either provide the requested data or to issue valid grounds for refusal.

In 36.8% (73 out of 198) cases of upheld complaints the ICO actively ordered NHS bodies to release specific information that had been wrongly withheld.

In one case, the ICO ordered an NHS body to specify what data was covered by the exemptions upon which it was relying.

In four cases the ICO ordered NHS bodies to provide assistance to complainants to clarify and refine their requests.

The possibility of deliberate brinkmanship is raised by the fact that in 19.2% (38 of 198) upheld complaints, NHS bodies ‘voluntarily’ provided responses after a complaint had been made to the ICO.

Three Department of Health and six NHS England cases were included in these 38 cases.



FOI requests deemed ‘vexatious’

Under Section 14 FOIA 10, public authorities can declare requests ‘vexatious’.

Some resort to the tactic of threatening to declare requests vexatious if you insist once too often on the facts, as opposed to meekly accepting the spin.

The NHS was found by the ICO to have inappropriately declared FOI requests ‘vexatious’ on eleven occasions.

Of some concern the Care Quality Commission – which is supposed to lead by example – tried to evade transparency about its chief officers’ activity regarding the Winterbourne View scandal. 11

Also, the Department of Health was found to have incorrectly classified as ‘vexatious’ a request about the activities of its Private Finance Unit. 12


Variation over time

There has not been great variation over time, save for the last financial year, which saw an upward swing in both the numbers of total complaints and upheld complaints, and the proportion of upheld complaints:


In this last turbulent year which saw the junior doctors’ contract dispute, the Department of Health and NHS England together accounted for one third (50 of 149) of all complaints against the NHS and 42% (28 of 67) of all upheld complaints against the NHS.

Similarly, examination of complaints against the Department of Health and against NHS England over the last 5 years shows spikes in 2016/17. 13


Type of NHS bodies complained against

The complaints to the ICO related to 95 NHS bodies, which break down as follows:


Health and Safety Executive (HSE) and PHSO

For completeness, although the HSE and PHSO are not strictly speaking part of the NHS, they are – in theory – an important part of NHS oversight, and they are supposed to support transparency.

However, they too have been the subject of unfavourable ICO decisions.


None of the upheld complaints about the PHSO and HSE related to the Health Service.

However, five of the complaints about the PHSO that were not upheld by the ICO related to medical advisors, who are used on an anonymous basis by the PHSO. 14

Of course, in the tangled regulatory undergrowth, the PHSO has a reciprocal remit to investigate complaints about the ICO.

In 2014 PHSO disclosed via FOI that it had fully or partly upheld a total of 9 out of 739 complaints received about ICO, in the 9 years between 1 April 20015 and 31 March 2014.

That’s a one a year – or 1.2%.

Complaints about ICO upheld by PHSO

PHSO FOI disclosure 29 May 2014, Ref. FDN-190468:



In 2015/16, the PHSO investigated eleven of 120 complaints received about the ICO, and upheld or partly upheld two of these complaints. 15

The circularity and inherent conflicts in the system raise questions about objectivity.


Repeat offenders

The ICO received between one and 32 upheld complaints on each of the 95 NHS bodies that were subject to complaints, with an average number of 2 upheld complaints per body.

These are the NHS bodies which attracted the highest number of upheld complaints to ICO:


In other words, 11.6% (11) of the 95 bodies accounted for 39.2% (209 0f 533) of all complaints, and 46% (92 of 198) of all upheld complaints.

This group of 11 repeat offenders had a higher ICO uphold rate than average: sub-group average 44.3% vs the overall average of 37.1%.

Despite being in existence for only four of the five years, NHS England attracted the second highest number of total complaints (48), and the highest number of upheld complaints (31).

Even allowing for two legacy PCT cases that are included in these 31 upheld complaints , NHS England remains top of the league.


NHS England: the silent treatment

 An examination of the 31 upheld complaints against NHS England reveals a tendency to ignore FOI requests (11 cases) or stall with assurances and apologies for delay, but without any response materialising (six cases) or to be tardy (five cases).

Extraordinarily, in five cases where NHS had failed to respond at all or to respond substantively, the failure continued even after ICO intervention.

This bloody mindedness may be explained by the politically sensitive nature of the information requested in several of these cases:



Department of Health: State Secrets

 Examination of the 19 upheld complaints against the Department of Health shows some examples of exemption carpet bombing, and a rather absurd readiness to claim State Secrets.

In one case (Ref. FS50406024) 16 the Department claimed the following exemptions under the FOIA:

Section 21– Information reasonably accessible to the applicant by other means 17

Section 23 – Security bodies 18

Section 24 – Safeguarding national security 19

Section 27 – International relations 20

Section 35(1)(a) and (d) – Government policy – formulation and development of government policy, operation of ministerial private office 21

Section36 – Prejudice to the effective conduct of public affairs 8

Section 38 – Health and Safety of any individual 22

Section 40(2) – Personal data of others 9

Section 41 – Information provided in confidence 7

Section 44 – Disclosure of the information is prohibited under any enactment 23

So what prompted this barrage of resistance? Answer: “a request for ministerial diaries”.

The ICO to its credit swept aside most of the Department of Health’s exemptions:

The Commissioner’s decision is that the DoH has correctly applied section 23 and section 40(2) where relied upon to make the relevant redactions. However the Commissioner considers that the DoH incorrectly applied the other exemptions.”

In fact, the ICO rejected the Department of Health’s claims of ministerial privileges and prejudice to the conduct of public affairs on 13 occasions in the five years in question:


An interesting detail revealed by ICO decision notices against the Department of Health is that Ministers are rather wont to hold meetings without minutes:

  • There were no minutes of five meetings between Jeremy Hunt and Boots Alliance, Royal College of Surgeons, Price Waterhouse Coopers, Academy of Medical Royal Colleges, “a group of health organisations” (cases FS50604562, FS50604567, FS50604573, FS50604583, FS50604561)
  • There were also no minutes of two meetings between the Parliamentary Under Secretary of State at the Department of Health and the General Medical Council, the Royal College of Surgeons (cases FS50604568, FS50604556).

One could be forgiving for wondering if this practice is to avoid being held to account under FOI.


Closing ranks on the hottest potatoes?

Amongst the complaints against the NHS that were upheld by the ICO, there were 11 cases in which information had been requested about junior doctors’ training and their industrial dispute and related issues of weekend deaths, but resisted by the Department of Health, NHS England and the GMC:


So, in conclusion, do we believe Mr Jeremy Hunt when he claims that he is building the safest and most transparent health service in the world?

Hunt KPMG comments


In 2015, the government set up the Commission on Freedom of Information


This is a submission by the National Union of Journalists:


The union also opposes introducing charges for the supply of information, expanding the basis for refusing requests, strengthening powers to deny access to certain types of information and any potential redundancies among those who are currently employed to respond to requests for information. Furthermore, we are concerned about the composition of the existing Commission because it excludes working journalists and civil society representatives. This implies the FOI requester’s perspective has not been considered within the deliberations so far. “

2 FOI costs, sure – but nowhere near as much as PR, FOI Man (Paul Gibbons) 9 October 2015


3 Labour’s denial machine over hospital death rates, Steven Swinford, Laura Donnelly, Patrick Sawer, Telegraph 14 July 2013


4 ICO annual reports 2014/15, 2015/16


5 ICO Audit outcomes analysis, NHS, 2012


6 Section 43 exemption: Commercial interests:


7 Section 41 exemption: Information provided in confidence


8 Section 36 exemption: Prejudice to effective conduct of public affairs


9 Section 40 exemption: Personal information


10 Section 14 exemption: Vexatious requests


11 ICO decision against a claim by CQC that an FOI request about various matters, including Winterbourne View, was ‘vexatious’


12 ICO decision against a Department of Health claim that an FOI request about the activities of its Private Finance Unit was ‘vexatious’


13 Upwards swings in 2016/17 in the number of complaints about DH’s and NHS England’s responses to FOI requests:


NB NHS England came into being on 1 April 2013

14 ICO decisions about FOI requests to the PHSO about its medical advisors






15 PHSO report: Complaints about UK governments and agencies, and some UK public organisations 2015/16


16 ICO decision notice in the case where the Department of Health claimed 11 different categories of exemptions, of which only two were upheld by the ICO:


17 Section 21 exemption – Information reasonably available to applicant by other means


18 Section 23 exemption– Security bodies


19 Section 24 exemption– Safeguarding national security


20 Section 27 exemption – International relations


21 Section 35 exemption – Government policy


22 Section 38 exemption– Health and Safety of any individual


23 Section 44 exemption– Prohibitions on disclosure





7 thoughts on “NHS Bodies: 5 years of ICO decisions

  1. Wonderful and very revealing. Just one word of caution. The ICO always threaten High Court action if their decision notices requiring disclosure are not followed. I don’t believe this has ever been carried out. At least not in the public sector. They tend to be more punitive towards smaller, private organisations who err.

    Liked by 3 people

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s