A requester who used FOIA to seek a copy of the response to her own complaint has lost her appeal, after the First-tier Tribunal confirmed that section 40(5A) entitled the Insolvency Service to neither confirm nor deny holding the information, not least because the appellant herself had repeatedly insisted the material related to her personally.
In J S Hughes v Information Commissioner [2026] UKFTT 845 (GRC), a panel chaired by Judge Scherbel-Ball, sitting with Tribunal Members Mann and Wolf, dismissed the appeal on the papers and refused both an eleventh-hour disclosure application and a £3,200 costs claim, the latter described as "totally without merit".
The dispute had its origins in a landlord-tenant matter. The appellant, who owned a property in Wales, had obtained court judgments against a former tenant for unpaid sums. In March 2023 the Insolvency Service issued Debt Relief Orders in respect of the tenant under the Insolvency Act 1986, and the appellant was informed the following month that the judgment debts could no longer be recovered.
The appellant pursued the agency's three-tier complaints process. Dissatisfied with the handling of her Tier 1 and Tier 2 complaints, she lodged a Tier 3 complaint on 11 July 2023, which she said the Insolvency Service acknowledged but never substantively answered. On 15 October 2024 she made a FOIA request for a copy of the agency's response to that Tier 3 complaint.
The Insolvency Service initially refused to confirm or deny holding the information in reliance on section 40(5B) FOIA - the provision concerned with third-party personal data - and maintained that position on internal review. During the Commissioner's investigation it accepted this was the wrong limb, switching in September 2025 to section 40(5A), on the basis that confirming or denying would reveal whether an identifiable requester had previously corresponded with the agency. The Commissioner's Decision Notice of 2 October 2025 (IC-373977-CB65) upheld the revised position, finding that any information held would constitute the complainant's own personal data and therefore be exempt under section 40(1).
The Tribunal noted the slightly unusual posture of the appeal: the appellant was seeking disclosure of a response she maintained had never been sent to her and, by implication, may never have been issued at all. It acknowledged that establishing whether information is held is itself one of the two distinct rights conferred by section 1 FOIA.
Nonetheless, the panel found section 40(5A) engaged, and in doing so relied heavily on the appellant's own submissions. Across her correspondence with the Insolvency Service, her complaint to the Commissioner, and her grounds of appeal, she had repeatedly asserted that the requested information related specifically and personally to her, arguments originally deployed to rebut the agency's mistaken reliance on section 40(5B). The logical consequence, the Tribunal held, was that any response, if held, would be her personal data within the meaning of section 3(2) of the Data Protection Act 2018.
The panel cited Durant v Financial Services Authority [2003] EWCA Civ 1746 as authority that a response generated in a complaints process is not automatically the complainant's personal data, but applied the formulation in Ashley v HMRC [2025] EWHC 134 (KB) that information relates to a data subject where it is linked to a particular person by its content, purpose or effect. Given the intensely personal nature of the request, concerning the appellant's own complaint about monies owed to her, any response would necessarily meet that test. Even the agency's automated acknowledgment of the Tier 3 complaint, which technically fell within scope, was the appellant's personal data, the panel found.
Because section 40(1) is an absolute exemption under section 2(3) FOIA, section 40(5A) follows suit, and the appellant's public interest arguments - including allegations of "collusion" between the Commissioner and the Insolvency Service - were irrelevant to its engagement. The proper route of access for a person seeking their own personal data, the Tribunal emphasised, is data protection legislation such as Article 15(3) UK GDPR, not FOIA, under which disclosure is to the world at large.
The panel also rejected the argument that the agency's late switch of exemption barred reliance on section 40(5A), applying Birkett v Defra [2011] EWCA Civ 1606: a public authority may change the exemptions it relies on before the Commissioner or even before the Tribunal. Nor did the fact that the Insolvency Service had answered the earlier Tier 1 and Tier 2 complaints outside FOIA oblige it to disclose under the Act, a point the Tribunal said, if anything, reinforced the personal character of the information.
Shortly before determination, the appellant applied for disclosure of correspondence connected to her ninth and tenth complaints to the ICO. Judge Scherbel-Ball refused the application under rule 5(3)(d) of the GRC Rules 2009, characterising the letters as a paradigmatic "meta-dispute" and finding that disclosure would generate unnecessary expense and delay contrary to the overriding objective.
The £3,200 costs application was also rejected. Applying Ridehalgh v Horsefield and Yerrakalva v Barnsley MBC, the panel found nothing approaching unreasonable conduct by the Commissioner - whose Decision Notice it had upheld - and observed that the claim, framed as compensation for "grief, anguish" and maladministration by way of ex gratia payment, sought a remedy the Tribunal has no jurisdiction to grant. No schedule of costs had been file.
The Tribunal also declined to entertain the appellant's wider requested remedies, which included written apologies on ICO letterhead and rulings on the Insolvency Service's complaints handling, holding these fell outside its jurisdiction under section 58 FOIA
