Steven Armstrong v Information Commissioner: tribunal upholds NHS Resolution's refusal to confirm expert reports

The First-tier Tribunal (General Regulatory Chamber) has dismissed an appeal against a decision notice finding that NHS Resolution was entitled to refuse to confirm or deny holding expert medical opinions sought by a man pursuing a potential negligence claim over his mother's death.

In Steven Armstrong v The Information Commissioner [2026] UKFTT 1123 (GRC), Judge Stephen Roper, sitting with members Kate Grimley-Evans and Dr Phebe Mann, considered an appeal against an Information Commissioner's decision notice which held that section 40(5A) of the Freedom of Information Act 2000 applied to a request made by Steven Armstrong. Mr Armstrong had asked NHS Resolution, the body responsible for handling claims against the NHS, to provide expert opinions obtained in connection with his claim, stating that the request should be treated as a data access or freedom of information request if necessary.

NHS Resolution treated the request as a subject access request and largely refused it on the basis of legal professional privilege. Following an unsuccessful internal review, in which the authority indicated that section 40(1) of FOIA would in any event have prevented disclosure of Mr Armstrong's own personal information, he complained to the Information Commissioner. The Commissioner concluded that the correct response under FOIA would have been to neither confirm nor deny holding the requested information, on the basis that doing so would itself disclose whether Mr Armstrong had made a claim, which the Commissioner regarded as his personal data.

Mr Armstrong appealed on several grounds, arguing among other things that information derived from his late mother's medical records could not constitute his own personal data, that the Commissioner had failed to assess the actual content of the requested information, and that disclosure could be restricted to him alone rather than released to the world at large.

The tribunal rejected each of these arguments. It found that the Commissioner had not treated information about Mr Armstrong's mother as his personal data, but had instead focused on the narrower point that confirming or denying whether the requested material was held would reveal whether Mr Armstrong had made a claim against the NHS, a fact which related to him and by which he was identifiable. On that basis, the tribunal held that no assessment of the underlying content of the expert opinions was required in order for the exemption to be engaged.

The tribunal also rejected Mr Armstrong's argument that the Commissioner had acted improperly by relying on an exemption not cited by NHS Resolution, finding that both the Commissioner and the tribunal were free to consider exemptions under section 40 proactively where personal data might otherwise be disclosed unlawfully. On the question of restricted disclosure, the panel confirmed the established position that release of information under FOIA is disclosure to the public generally, and that neither anonymisation nor a confidentiality undertaking from the requester could alter that position or the underlying finding that the information constituted his personal data.

Points concerning NHS Resolution's reliance on legal professional privilege, along with other complaints about the authority's conduct of the underlying claim, were found to fall outside the tribunal's jurisdiction, which was confined to the lawfulness of the decision notice itself and did not extend to the handling of the subject access request.

Having found that section 40(5A) was correctly applied and that the public interest favoured maintaining the exclusion of the duty to confirm or deny, the tribunal dismissed the appeal in full.