Enter case reference FT/EA/2024/0243/GDPR - [2025] UKFTT 01217 (GRC)

These proceedings concern an application (the “Application”) under section 166(2) of the Data Protection Act 2018 (“DPA 2018”) for an order to progress the Applicant’s complaints against Liverpool Women’s NHS Foundation Trust (“the Trust”) regarding the alleged partial response to a subject access request (*SAR”) made in 2023. The complaint was submitted to the Information Commissioner (“IC”) on 17 January 2024 who, on 15 April 2024, assigned a case officer and allocated the reference IC-282633-Q2G4.

On the same day the assigned case officer wrote to the Applicant to issue an outcome on the complaint. Having reviewed the complaint the case officer noted that the Applicant had raised her concerns previously and that this had been dealt with under a separate case reference IC-245849-N2L7, to which the IC had already provided an outcome accountability letter on 31 July 2023. The case officer concluded that as the IC had previously addressed the complaint, there was no further action for the IC to take.

On 15 May 2024, the Applicant emailed the case officer outlining her concerns that her complaint was being misunderstood. The Applicant highlighted the unresolved issue in relation to the disclosure of ‘sensitive PENs information’ and provided an email thread as confirmation.

On 22 May 2024, the case officer acknowledged receipt of the Applicant’s email and noted that there was no indication that the Applicant had raised her concern with the Trust regarding the ‘sensitive PENs information’. The case officer provided guidance and advice on how to make a SAR. The case officer further advised that the case would be closed and included a link to the Commissioner’s service standards, through which the Applicant could request a service complaint and/or request for a case review. On the same day the Applicant expressed her concerns about the way the case officer had handled the complaint and attached a request for a service/case review of her complaint.

On 5 June 2024, a reviewing officer reviewed the Applicant’s concerns alongside the relevant case material. While acknowledging that the original case officers had clearly articulated their reasoning, the reviewing officer concluded that further examination was justified, particularly with regard to the ‘sensitive PENs note’ which the Applicant believed was being withheld. After this, the case officer emailed the Trust on 19 June 2024, advising that the Applicant had requested a copy of the ‘sensitive PENs note’ and not received a response. The case officer requested that they address any outstanding issues with the Applicant and that they should provide a response within 14 days and inform the IC when this had been completed. On the same day the case officer wrote to the Applicant to confirm these actions. On 20 June 2024, the Applicant expressed her dissatisfaction with the case officer’s decision to close the case. The Applicant contended that the Trust should either provide justification for withholding the information or release it for review by the IC.

The Applicant submitted a further complaint advising that on 24 January 2023, she submitted a FOI request to the Trust for personal data from July 2021 onwards. Among the disclosed records was an alleged internal email instructing the transfer of sensitive PENs data to counselling notes and deletion of two progress entries dated 20 July 2022. The Applicant said that she raised a formal complaint about the deletion, which she alleges was unauthorised and potentially criminal. The notes have not been disclosed, despite her SAR and complaint. The Applicant said that the Trust’s response dated 17 January 2024, cited the HFEA Code of Practice to justify the deletion, stating the data was moved to a secure counselling system. The Applicant alleges the notes were written by a nurse – not a counsellor – and should have remained in her clinical record and that the Trust had also failed to explain why non-PENs content from the deleted notes were not released.

The Trust replied to the IC on 4 July 2024, stating that the information in question had previously been addressed in the Applicant’s third formal complaint to the Trust. The complaint in question was independently investigated and the outcome communicated via the Trust’s standard complaints procedure. The outcome was that the complaint was not upheld. The Trust explained to the IC how the Applicant alleges that information was removed from the Trust’s PENs system and withheld. The Trust told the IC that the Applicant has been informed that the data was securely transferred to a restricted-access system to enhance confidentiality and comply with the HFEA Code of Practice. That transfer involved removing it from the original system. Although the Applicant was informed of the above in response to her third complaint to the Trust, the Trust have confirmed that the data was not withheld intentionally. The independent investigator found the complaint unsubstantiated and concluded that clinical staff acted appropriately to safeguard confidentiality

On 5 July 2025, the IC’s case officer acknowledged the Applicant’s further complaint dated 24 June 2024 and explained that the IC cannot accept repeated submissions under one complaint, as it affects fair assessment of the organisation. The case officer explained that under UK GDPR, organisations decide what personal data is relevant for disclosure. The Trust appropriately redacted third party data, applied valid exemptions, and confirmed in its letter to the Applicant dated 19 September 2023 that all personal data held about the Applicant had been provided. The Trust explained that data was moved from PENs to a more secure system to comply with the HFEA Code of Practice and that this transfer involved removing it from the original system. The case officer confirmed that the IC accepted the Trust’s assurances and would take no further action and that the matter was closed. The Applicant was reminded of her right to pursue independent legal action against the Trust, and of her right to complain to the Parliamentary and Health Service Ombudsman (PHSO) if she was dissatisfied with the service that she had received.

On 26 July 2024, the Applicant submitted a further complaint advising that her case was closed on 19 June, with the IC stating that the Trust had more work to do and that the Trust had not responded or provided the requested data and remained in breach of GDPR.

On 3 October 2024, the Applicant resubmitted the complaint originally submitted on 26 July 2024.

On 11 August 2025, the IC wrote again to the Applicant following a case review. Having reviewed the complaint and the outcome issued by the case officer, the case reviewing officer was satisfied that the case officer had dealt with the complaint appropriately and in line with the ICO’s case handing procedures. The case reviewing officer sincerely apologised for the service received during her case review request and that the Applicant’s request on 3 October 2024, was not referred due to human error. The Applicant’s service complaint was upheld and apologies were sent to the Applicant for the inconvenience caused. In relation to the Applicant’s concern about the Trust, the reviewing officer having reviewed the relevant information was satisfied that the case officer had handled the complaint in accordance with the IC’s guidelines. The Trust confirmed that all personal data that the Applicant was entitled to had been provided, and no further information was being withheld. The Applicant was reminded of her right to pursue independent legal action against the Trust, and of her right to complain to the Parliamentary and Health Service Ombudsman (PHSO) if she was dissatisfied with the service that she had received.

The Appellant applied to the Tribunal by way of form GRC1 on 19 June 2024. She stated that the outcome she was seeking was as follows: