Info Gov

The First-tier Tribunal has upheld the Gambling Commission’s refusal to confirm or deny whether it held correspondence with former Redcar MP Anna Turley, finding that doing so would disclose her personal data and breach data protection law.

In George Greenwood v Information Commissioner & Gambling Commission [2026] UKFTT 194 (GRC), journalist George Greenwood had sought “all email correspondence between Anna Turley… and [senior Gambling Commission officials]” between January 2020 and July 2024.

For most of that period, Ms Turley was not an MP, having lost her seat in 2019 before being re‑elected in 2024. The Tribunal noted that the request therefore concerned “possible activities of an individual who at the time was a private citizen not holding a public office”.

The Gambling Commission refused to confirm or deny whether it held any such correspondence, arguing that doing so would itself reveal personal data about Ms Turley and would be unlawful under the Data Protection Act 2018.

It told the requester that “*confirming whether we do or do not hold information… would constitute the disclosure of personal data and would not be fair and lawful*”.

The Information Commissioner upheld that position in a December 2024 decision notice, concluding that although there was a legitimate interest in transparency around lobbying, this did not outweigh Ms Turley’s privacy rights during a period when she was not a public office holder.

Greenwood appealed, arguing that former MPs should expect scrutiny and that the request related to professional activity rather than sensitive personal information.

However, the Tribunal described the appeal as “entirely speculative”, noting that the requester had provided “no evidence” of misconduct by Ms Turley. It emphasised that the existence or non‑existence of correspondence “is personal data relating to Ms Turley which is protected from disclosure”.

The panel agreed with the Commissioner that a private individual would have a reasonable expectation that any correspondence with a regulator would not be disclosed to the world at large.

While acknowledging “some public interest” in transparency around lobbying, the Tribunal held that this was “clearly outweighed” by Ms Turley’s rights, particularly given the safeguards already in place through the MPs’ Code of Conduct.

The Tribunal dismissed the appeal, concluding that the Gambling Commission was entitled to rely on section 40(5) FOIA and neither confirm nor deny whether it held the requested information.

Also in this section

May 26, 2026

Key Data Protection Issues for Automated Recruitment in the Public Sector

The need to recruit faster in a competitive market, the need to minimise costs in the recruitment process, and the need to secure the best candidate quickly, makes the use of AI an appealing option for any employer including public bodies. But there are pitfalls for the unwary write David Leach and Charlotte Smith.
May 08, 2026

Schools warned over AI blackmail threat as guidance urges rethink on pupil images

Schools across the UK are being urged to review or remove identifiable photographs of pupils from their websites and social media accounts, following warnings that criminals are using artificial intelligence tools to manipulate those images into child sexual abuse material (CSAM) and then threaten to release it unless a ransom is paid.
Apr 28, 2026

AI in Education: Why Data Protection Must Come First

Artificial Intelligence promises a lot. It can undoubtedly do amazing things. But secretly (or maybe not so secretly), it also makes us slightly nervous. Adam Halsey looks at what this means for schools, and why data protection needs to sit at the centre of any decision to use AI.
Apr 22, 2026

Preparing for the new complaints regime

From 19 June 2026, all organisations acting as data controllers are required to have in place an effective process to enable individuals to raise complaints about how their personal data is handled. Ashleigh Dibb looks at what this will mean in practice.
Apr 17, 2026

When data protection doesn’t protect you

Recently, the Information Commissioner’s Office published the outcome of a criminal prosecution. The title? Just two names: Christopher Munro and William Chipoma. No explanation. No softening. No anonymity. And that, in itself, is a powerful lesson in how data protection law really works.

InfoGov Masthead Newsletter 800