Deborah Cox v The Information Commissioner: tribunal narrows scope of FOIA's neither confirm nor deny defence

The First-tier Tribunal (General Regulatory Chamber) has partly allowed an appeal against the Home Office over its handling of a freedom of information request concerning the regulation of animal research establishments, finding that reliance on the "neither confirm nor deny" exemption in section 38(2) of the Freedom of Information Act 2000 had not been adequately justified.

The appeal, brought by Deborah Cox against the Information Commissioner and the Home Office, concerned a request made in March 2025 relating to inspection and audit activity under the Animals (Scientific Procedures) Act 1986. Two elements of the request fell for determination before Judge Brian Kennedy KC, sitting with specialist panel members Susan Wolf and Emma Yates.

The first sought an explanation as to why published guidance requiring annual full system audits for establishments holding special species appeared not to have been followed in practice. The Home Office maintained it held no recorded information answering that question, on the basis that it did not accept any breach had occurred. The tribunal agreed, drawing a clear distinction between recorded information that a public authority holds and an explanation that might be constructed from it. The panel held that FOIA confers a right of access to recorded information, not a mechanism for compelling a public authority to generate an answer to a question, and dismissed the appeal on this point.

The second element concerned a request for details of audits conducted between 2022 and 2024 at the Envigo RMS Belton facility. The Home Office had refused to confirm or deny whether it held such information, invoking section 38(2) on the basis that doing so could endanger the physical or mental health or safety of individuals connected with animal research establishments. The tribunal accepted that animal research is a controversial field in which those involved may face hostility or intimidation, and that this background is capable of engaging section 38 in principle. It held, however, that the provision demands more than evidence of a generally hostile climate. A public authority must establish a sufficiently evidenced causal connection between the specific act of confirming or denying that information is held and a real and significant risk of endangerment.

Having reviewed the evidence, including material already in the public domain such as Companies House filings and Concordat-related documentation, the panel concluded that the Home Office had not met that evidential threshold. While a background risk environment existed, there was insufficient evidence that confirming or denying the existence of the Envigo-related audit records would itself materially increase any risk to an identifiable individual. The appeal was accordingly allowed in respect of this request.

Because section 38(2) was found not to be engaged, the tribunal did not need to resolve the public interest balance, though it noted in passing that the competing interests would likely have been finely balanced had the exemption applied.

Exercising its power under section 58(1) FOIA, the tribunal substituted its own decision for the Commissioner's original notice, directing the Home Office to issue a fresh response to the audit-related request within 35 days without reliance on section 38(2). The tribunal made no finding as to whether the underlying information is in fact held, nor whether any other exemption might apply, leaving those questions for the Home Office's fresh response.