The First-tier Tribunal (General Regulatory Chamber) has largely dismissed an appeal against an Information Commissioner decision that the Nursing and Midwifery Council was entitled to neither confirm nor deny (NCND) holding information about whether a named nurse was struck off by its predecessor regulators, allowing the appeal only on a narrow procedural failing in the NMC's refusal notice.
In Hawking v Information Commissioner and Nursing and Midwifery Council [2026] UKFTT 00980 (GRC), the Tribunal considered a February 2024 request by Dr Catherine Lucy Hawking asking whether a named individual had been removed from the register for misconduct under the English National Board or the United Kingdom Central Council, the regulatory bodies that preceded the NMC's creation in 2002.
The NMC responded that it "may hold" the information but that it was exempt as third party personal data under section 40(2) of the Freedom of Information Act 2000. On complaint, the Commissioner substituted a different analysis, finding that the NMC should instead have given a neither confirm nor deny response under section 40(5B), because confirming or denying whether the information was held would itself disclose the named individual's personal data.
Before the tribunal, the appellant argued that the NMC's "may hold" wording amounted to an admission that it held the information, precluding any later reliance on NCND, and that the NMC and the Commissioner were estopped from switching exemptions.
The tribunal rejected both arguments. The "may hold" response was clumsy but acknowledged only a possibility, and an accusation that the NMC had lied was unfounded. On estoppel, the panel applied the Upper Tribunal's decisions in Ingle and the recently issued UKRI v Information Commissioner and Kirkham [2026] UKUT 146 (AAC) - circulated to the parties during the hearing - holding that the common law doctrine gives way to the statutory scheme and that a public authority may rely on additional or alternative exemptions at a later stage. A submission that both authorities had been decided per incuriam was dismissed.
The panel found that confirmation or denial would contravene the data protection principles in the UK GDPR. It was purely speculative to suggest that a nurse registering decades ago had consented under Article 6(1)(a) to disclosure in response to an FOI request years later, and while the appellant had a legitimate research interest under Article 6(1)(f), that interest was overridden by the data subject's rights and freedoms. The tribunal noted that under current NMC policy even strike-off sanctions are published on the register for only five years, and that the events in question predated both data protection regulation of such information and the publication provisions of the Nursing and Midwifery Order 2001.
Applying the public interest test to the qualified exclusion, the panel acknowledged that there may be public interest in the matter given the individual's "connection to a person of global fame" and evidence of past press attention, but concluded that any such interest had likely diminished and was outweighed by the risk of serious prejudice to the individual from disclosure to the world at large.
The appeal succeeded on a single point. The NMC's refusal notice had failed to give particulars of the requester's right under section 50 to complain to the Commissioner, breaching section 17(7) of the Act, and the Commissioner's decision notice had not recorded that failing. The tribunal issued a substituted decision notice adding the finding of breach, requiring no further steps. It also rejected an argument under Article 6 of the European Convention on Human Rights that the Commissioner had acted unfairly by deciding the complaint on a ground raised by neither party, holding that section 50 imposes no duty to invite submissions on alternative exemptions and that the appellant had full opportunity to contest the point on appeal.
