When a 'Small Number' Becomes Personal Data: FOIA Request for Care Service Figures Dismissed

NCN: [2026] UKFTT 00957 (GRC) Appeal Number: FT/EA/2026/0011 First-tier Tribunal (General Regulatory Chamber) Information Rights Heard on: 24 June 2026. Decision given on: 26 June 2026. Before Judge Brian Kennedy KC With Specialist Panel members Miriam Scott and Kate Grimley Evans. Between: [APPELLANT] Appellant and The Information Commissioner Respondent Decision: The appeal is Dismissed. REASONS Introduction:

1. Where a seemingly statistical request concerns a very small cohort which, on the evidence, in substance comprises a small number by which disclosure of the precise figure can, and will in this case, constitute disclosure of personal data and will ordinarily be unlawful under section 40(2) FOIA. Background:

2. This is an appeal brought by the Appellant against the impugned Decision Notice (“DN”) of the Information Commissioner (“Commissioner”) dated 18 December 2025.

3. The underlying request, made on 14 November 2024, sought the number of persons residing in Carmarthenshire who attended Bryn Siriol Respite Service in Aberystwyth, the public authority (“PA”).

4. The PA responded on 2 January 2025, providing an anonymised figure of “ five or less ”, explaining that the data had been aggregated due to the risk of identification arising from low numbers.

5. The Appellant sought the precise number. Following a complaint from the Appellant, the Commissioner concluded that the PA was entitled to withhold the exact number under section 40(2) FOIA but had breached section 17 in failing to provide a timely refusal notice.

6. The present appeal challenges the Commissioner’s substantive conclusion in the DN. Chronology:

7. The material chronology is not in dispute and may be summarised as follows: (a) 14 November 2024 – FOIA request submitted. (b) 2 January 2025 – Response issued (“five or less”). (c) 10 January 2025 – Appellant seeks internal review and exact number. (d) 4 April 2025 – Complaint made to the Commissioner. (e) 18 December 2025 – DN issued. (f) 8 January 2026 – Appeal lodged. The Issues:

8. The Tribunal must determine, on a de novo basis, whether the Commissioner’s conclusion in the impugned DN under section 40(2) FOIA was correct.

9. The issues arising are: (1) Whether the withheld information (the precise number) constitutes personal data. (2) If so, whether disclosure would contravene Article 5(1)(a) UK GDPR, in particular by failing the Article 6(1)(f) legitimate interests’ test. (3) The role of identifiability, including application of the “motivated intruder” approach. (4) The balance between transparency and the rights and freedoms of the data subject. The Relevant Law:

10. Section 40(2) FOIA exempts from disclosure information which is the personal data of a third party where disclosure would contravene a data protection principle. 11. “Personal data” is defined in section 3(2) of the Data Protection Act 2018 as information relating to an identified or identifiable living individual.

12. The relevant data protection principle is Article 5(1)(a) UK GDPR: that processing must be lawful, fair and transparent.

13. Lawfulness falls to be assessed by reference to Article 6(1), in this case Article 6(1)(f), requiring: (i) a legitimate interest, (ii) necessity and (iii) a balancing exercise between that interest and the data subject’s rights.

14. In assessing identifiability, the Tribunal adopts the “motivated intruder” approach as applied by the Commissioner. Discussion and Findings: a) Whether the information is personal data;

15. The Tribunal is satisfied that the requested information constitutes personal data relating to Data Subjects.

16. While the withheld information is numerical in form, the question is whether disclosure of the precise number would enable identification, directly or indirectly, of a living individual.

17. Small numbers increase the risk of identification but are not determinative; the assessment is fact-sensitive and requires a realistic, not merely theoretical, route to identification.

18. The Tribunal has had regard to both open and closed evidence.

19. The closed material establishes that in fact the relevant cohort is effectively small as there was a low number meeting the criteria of the request.

20. Disclosure of the precise number could therefore confirm the identity of an individual by elimination within a small and locally understood cohort.

21. The context of a specialised care setting, involving service users, families and staff with existing knowledge, materially increases the likelihood of identification.

22. Applying the motivated intruder approach, the Tribunal is satisfied that identification would be reasonably likely.

23. The Tribunal are unanimous in finding the withheld information therefore constitutes personal data. b) Lawfulness and the legitimate interests test 24. The Tribunal accept that there is a general legitimate interest in transparency in relation to the allocation of publicly funded care services.

25. However, the Appellant’s interest is (on the evidence) a personal one—namely whether a particular individual, is the sole service user from Carmarthenshire. Necessity:

26. The Tribunal accepts that disclosure of “five or less” already provides a measure of transparency.

27. The incremental value of disclosing the precise number is limited.

28. The Tribunal is not satisfied that disclosure of the exact number is necessary to meet the legitimate interest relied upon. Balancing exercise:

29. The balancing exercise in this case is not a finely poised one.

30. The information concerns the private life of vulnerable individuals receiving care in a specialist setting. The closed material demonstrates that disclosure of the precise number would, in reality, identify an individual within a small and locally understood cohort.

31. The intrusion into the data subject’s rights would therefore be both direct and foreseeable. The risk is real rather than speculative and includes the possibility of unwanted attention, stigma or targeting in a sensitive and capacity-constrained service context.

32. By contrast, the legitimate interest in further disclosure is modest. The information already disclosed (“five or less”) provides a meaningful degree of transparency.

33. Disclosure of the precise number would add little to public understanding but would materially interfere with data subjects rights.

34. The balance therefore falls decisively against disclosure. There is no lawful basis under Article 6(1)(f), and disclosure would be unlawful within the meaning of Article 5(1)(a). Conclusion:

35. The Tribunal has considered the evidence and the applicable law afresh, as required by its jurisdiction.

36. Notwithstanding that this is a de novo determination, the Tribunal is satisfied that the Commissioner’s reasoning is cogent and accords with the evidence before it. There is no error of Law in the outcome, exercise of discretion or reasoning in the DN. The Tribunal has reached the same conclusion for its own reasons.

37. The Tribunal has taken into account the closed material, which materially strengthens the conclusion that the withheld information is, in substance, personal data capable of identifying an individual, and that disclosure would be unlawful.

38. In all the circumstances and on the evidence before us and applying appropriate judicial restraint before interfering with a reasoned and fact-sensitive regulatory decision, the Tribunal is satisfied that no basis arises to depart from the Commissioner’s conclusion. We find no error of Law in the DN and therefore find the appeal must fail. Decision:

39. The appeal is dismissed. Brian Kennedy KC 25 June 2026.