The First-tier Tribunal (General Regulatory Chamber) has dismissed an appeal against an Information Commissioner's decision notice that upheld a public authority's refusal to disclose the precise number of Carmarthenshire residents attending a respite care service, ruling that the small size of the cohort meant disclosure would unlawfully identify a living individual
The tribunal found that the withheld figure constituted personal data under section 3(2) of the Data Protection Act 2018 and that its disclosure would contravene Article 5(1)(a) UK GDPR.
The case arose from a freedom of information request made on 14 November 2024 by appellant Diane Tracey White, seeking the number of persons residing in Carmarthenshire who attended Bryn Siriol Respite Service in Aberystwyth. The public authority responded on 2 January 2025 with an anonymised figure of "five or less," explaining that the data had been aggregated because of the risk of identification arising from low numbers.
White sought the precise number, prompting a complaint to the Commissioner, who concluded in a decision notice dated 18 December 2025 that the exact figure was properly withheld under section 40(2) FOIA, while also finding the public authority had breached section 17 by failing to issue a timely refusal notice. White appealed only the substantive section 40(2) conclusion.
Section 40(2) FOIA exempts third-party personal data from disclosure where release would contravene a data protection principle. The Tribunal applied Article 5(1)(a) UK GDPR, which requires processing to be lawful, fair and transparent, with lawfulness assessed under Article 6(1)(f) by reference to legitimate interest, necessity and a balancing exercise against the data subject's rights.
Considering both open and closed evidence, the Tribunal found the relevant cohort was, in fact, very small and that disclosure of the precise number could confirm an individual's identity by elimination within a locally understood community. Applying the "motivated intruder" approach, the panel concluded identification was reasonably likely given the specialised care setting and the existing knowledge held by service users, families and staff in the area.
The Tribunal accepted that a general public interest in transparency over publicly funded care allocation existed, but found White's underlying interest was a personal one, and that the figure already disclosed provided meaningful transparency such that the incremental value of the exact number was limited and not necessary to meet any legitimate interest.
The balancing exercise, the Tribunal said, was "not a finely poised one." The panel held that disclosure would cause direct and foreseeable intrusion into the private life of vulnerable individuals in a sensitive, capacity-constrained care context, including the real risk of unwanted attention, stigma or targeting, against only a modest residual public interest in disclosure.
Conducting its review afresh, the Tribunal found the Commissioner's reasoning cogent and identified no error of law in the decision notice, exercising what it described as appropriate judicial restraint before interfering with a reasoned, fact-sensitive regulatory decision. The appeal was dismissed.
The judgment can be read here: https://caselaw.nationalarchives.gov.uk/ukftt/grc/2026/957
