First-tier Tribunal (General Regulatory Chamber)

NCN: [2023] UKFTT 113 (GRC)

Case Reference: EA/2022/0178

 

First-tier Tribunal

General Regulatory Chamber

Information Rights

 

 

Heard: by CVP

Heard on: 17 January 2022

Decision given on: 02 February 2023

 

 

 

Before

 

TRIBUNAL JUDGE SOPHIE BUCKLEY

 

TRIBUNAL MEMBER RAZ EDWARDS

TRIBUNAL MEMBER JO MURPHY

 

 

 

Between

 

SID RYAN

Appellant

and

 

(1)   The Information commissioner

(2)   NHS ENGLAND

Respondents

 

 

 

 

Representation:

 

For the Appellant: In person

For the First Respondent: Did not appear

For the Second Respondent: Mr. Davidson (Counsel)

 

 

Decision: The appeal is dismissed. The public authority was entitled to rely on s 12 of the Freedom of Information Act 2000. The public authority complied with its s 16 duty to provide advice and assistance.

 

 

REASONS

 

Introduction

 

1.      This is an appeal against the Commissioner’s decision notice IC-146365-F6C5 of 8 June 2022 which held that NHS England (‘NHSE’) was entitled to rely on section 12(1) of the Freedom of Information Act 2000 (FOIA). The Commissioner found that NHSE had complied with its section 16 duty to provide advice and assistance.  

 

2.      The Commissioner required no steps to be taken.

 

Background

 

3.      The request arises out of agreements between NHSE and private health care providers early in the Covid 19 pandemic to secure additional hospital capacity from the private hospital sector. These agreements were negotiated through discussions between NHSE and the Independent Healthcare Providers Network (IHPN).

 

4.       Mr. Ryan works for the Centre for Health and the Public Interest (CHPI). The request is intended to provide further information to inform research that CHPI is undertaking in relation to this agreement. Mr. Ryan asserts that there are serious concerns about value for money and that it is vital to know how much the contract cost, what was delivered and how it was negotiated.

 

Request and response

 

5.        On 10 September 2021 Mr. Ryan made the following the request:

 

At the outset of the pandemic NHS England negotiated with the Independent Health Provider Network (IHPN) a contract to secure healthcare capacity from 26 private hospital companies. While the total cost has not been disclosed, there are serious concerns about the value for money of this contract, reports of significant under-utilisation of the purchased capacity and successive renegotiations meant that private healthcare capacity was not available when the NHS was under greatest strain during the second wave.

 

Given these issues, it is important to understand the genesis of this deal, what the government was offered by the providers and what it expected to receive. I am therefore requesting records between the principle negotiators during the period the deal was being finalised, prior to the initial agreement of the 12th March 2020 up to the point at which the contract was formally signed on the 15th May 2020.

 

I would like to receive records of meetings and correspondence between the authority and the Independent Health Provider Network (IHPN) during the period 1st February and 15th May 2020. I would expect this to include:

 

1. All emails to and from the @ihpn.org.uk domain during the period

 

2. Records of meetings with the IHPN to include but not be limited to:

 

a. A list of dates of any such meetings

 

b. Preparatory briefings/lines to take

 

c. Agendas,

 

d. Minutes or notes,

 

e. Any presentation materials.

 

 

6.        NHSE responded on 12 October 2021 and withheld the information under section 12. It upheld its decision on internal review on 9 December 2021.

 

7.        Mr. Ryan referred the matter to the Commissioner on 16 December 2021.

 

The decision notice

 

8.        The Commissioner noted that even if NHSE’s estimate to comply with the request were to be halved, it would still be significantly in excess of the cost limit under FOIA. The Commissioner’s overall conclusion was that NHSE had estimated reasonably that to comply with the complainant’s request would exceed the cost limit.

 

9.      The Commissioner concluded that, in its initial response to the complainant, NHSE fulfilled its obligations under section 16 of FOIA by advising Mr. Ryan to refine his request for information within more specific parameters and made suggestions as to how this could be done. The Commissioner considered that this was an appropriate response. He was therefore satisfied that NHSE met its obligation under section 16 of FOIA.

 

The appeal to the tribunal

 

10.    The grounds of appeal are, in summary, that:

10.1.               NHSE took an overly broad interpretation of the request.

10.2.               NHSE has chosen methods of searching for records that are overly onerous.  

10.3.               If NHSE had provided advice and assistance under section 16 both of these issues could have been resolved.

 

11.  In particular, Mr. Ryan raises the following points in relation to section 12:

11.1.               The reasonableness of the estimate is assumed by the Commissioner rather than tested.

11.2.               NHSE rejected digital discovery tools which would have greatly sped up the process.

11.3.               Nine ‘principle negotiators’ were arbitrarily chosen without consultation with the requestor.

11.4.               Is it necessary to insert a ‘manual review for relevancy’ check into searches for emails?

 

12.  In relation to section 16, Mr. Ryan raises the following specific points:

12.1.               The section 45 Code of Practice is of no assistance. The issue is whether the advice or assistance is ‘reasonable’.

12.2.               Advice and assistance should be a dialogue rather than just a note in a refusal notice.

 

The Commissioner’s response

 

Interpretation of grounds of appeal

 

13.    The Commissioner interprets the grounds of appeal to be, in essence:

13.1.             There is public interest in the withheld information.

13.2.             NHSE’s transparency and accountability processes have entirely broken down.

13.3.             Section 12 of the FOIA has not been breached. The Commissioner does not consider:

13.3.1.       The rejection of digital email discovery tools which would have greatly sped up the search for information.

13.3.2.       Why nine ‘principle negotiators’ were arbitrarily chosen without consultation with the requester.

13.3.3.       Whether it is necessary to insert a ‘manual review for relevancy’ check into searches for emails.

13.3.4.       Whether the authority has correctly interpreted the request and its scope.

 

13.4.               NHSE have not provided advice and assistance and have not met its obligations under section 16 of the FOIA.

 

There is public interest in the withheld information

 

14.    This is outside the scope of this appeal.

 

NHSE transparency and accountability processes have entirely broken down

 

15.    These are public interest considerations irrelevant to section 12 and outside the scope of this appeal.

 

Section 12 has not been breached

 

16.    The Commissioner submits that the methods used by a public authority to arrive at its estimate will be based on its own procedures and how the information is held.

 

17.    Having considered NHSE’s explanation of the methods employed to produce its estimate, taking into account how NHSE keeps its records, the process required to locate the information and the sampling exercises carried out, the Commissioner maintains that NHSE has sufficiently described reasons why complying with Mr Ryan’s request exceeds the cost limits set out in section 12. The Commissioner found NHSE’s estimate to be reasonable and noted that even if NHSE’s estimate to comply with the request were to be halved, it would still be significantly in excess of the cost limit under FOIA.

 

18.    The Commissioner submits that NHSE cogently explained in the internal review their reasoning for selecting the nine negotiators and how they had interpreted the request for information.

 

19.    The Commissioner remains satisfied with NHSE’s explanation as to the method required to gather the information requested and he considers that NHSE correctly dealt with the request in line with the scope of the request as it was submitted.

 

NHSE have not provided advice and assistance and have not met their obligations under section 16 FOIA

 

20.    The Commissioner remains satisfied that NHSE provided appropriate advice and assistance in its initial response and internal review and had explained why it was not possible to speak to an individual member of the FOI team. NHSE complied with its obligations under section 16.

 

NHSE’s response

 

Summary

 

21.    In summary, Mr Ryan has asked for ‘all information’ held about a series of negotiations/contracts that were entered into in the early stages of the covid pandemic for additional bed-capacity to support the NHS from private hospitals.

 

22.    NHSE’s position is that it is not possible to respond to this request within the cost/time limit of £450/18 hours required under FOIA because:

 

22.1.             it does not hold an easily accessible, centralised record relating to all of the negotiation process;

22.2.             identifying all of the staff involved in the negotiations (who were drawn from various parts of the organisation) is difficult;

22.3.             the IT facilities available to NHS England do not permit it to undertake rapid searches of servers as Mr Ryan would like; and

22.4.             accordingly, the only way in which the search could be undertaken would be a human-led trace through key people’s inboxes and calendars, to locate, retrieve and extract what information might be held. That process would take more than the section 12 FOIA limit.

 

Submissions

 

23.    The public interest in disclosure is not relevant to this appeal.

 

24.    NHSE has not taken an overly broad interpretation of the request. The request, asking for ‘everything’ on a topic over a 14 week period, is broad in scope.

 

25.    NHSE has not chosen overly onerous methods of searching for information. The request is onerous because of its scope.

 

26.    The forensic recovery tools offered by NHS Digital do not permit searches of emails to be undertaken in the way Mr. Ryan would like. In any event the request is not limited to emails.

 

27.    NHSE cannot undertake an organisation-wide search across 9000 email accounts for messages sent to @IHPN email accounts over a 14 week period. Limiting the search to the known ‘core’ of people involved in discussions with IHPN in the first instance is a sensible approach to seeking to comply with the request.

 

28.    A manual search is necessary to ensure that material out of scope of the request is excluded.

 

29.    As a matter of law, if NHSE has complied with the Code of Practice, it must be regarded as having discharged its duties under section 16(1) FOIA.

 

30.    NHSE has repeatedly and in detail set out the facts and assumptions upon which its estimate is based. The ability to neatly use technology to respond to the request, which Mr Ryan assumes exists, in fact does not. It is no part of this Tribunal’s jurisdiction to make any assessment about NHSE’s practices, procedures and record management techniques more generally. It is clear that the scope of Mr Ryan’s request is such, that to attempt to comply with it would result in the appropriate limit being vastly exceeded.

 

Reply by Mr. Ryan

 

31.    Not all of the reply is relevant to the issues to be determined by the tribunal. The tribunal has taken account of all relevant matters therein. The following is a summary of the relevant parts of the reply.

 

Introduction

 

32.    It cannot be correct that it is proper and lawful to offer advice and assistance without ever speaking to the requester, nor that it is possible to provide advice and assistance while taking active measures to block all contact with the requester.

 

33.    NHSE has fundamentally misunderstood the scope of the request. NHSE does not seem to know what Mr. Ryan wants and has not cared to ask.

 

34.    The ability to dialogue productively has to be at the heart of any fair and equitable legal system. As the requestor, Mr. Ryan does not feel advised and assisted whatsoever.

 

Public interest

 

35.    The public interest points are provided to show that the request has a serious purpose. They are not provided in an attempt to overturn section 12 or 16.

 

The scope of the request for emails

 

36.    This part of the request is perfectly clear. It asks for all emails between NHSE and the @ihpn.org.uk domain between 1 February and 15 May 2020. It is not limited to emails on a certain topic. NHSE has reframed the request as a request for emails about this contract.

 

Digital discovery of emails

 

37.    Digital discovery of emails is possible and simple. Mr Ryan knows this from his experience as an information governance officer at 3C Shared Services. NHS Digital provides a Forensic Discovery Request service which can be used to conduct the searches outlined in the request. If NHSE wishes to do any further processing of the ‘bulk data’ this is not covered by section 12. Mr. Ryan has not asked for keyword searches, only the email domain @ihpn.org.uk and a timeframe.

 

Request of records of meetings

 

38.    The request asks for records of meetings between NHSE and IHPN during the period 1 February and 15 May 2020. If there was any uncertainty NHSE did not seek to clarify any element with Mr. Ryan. Mr. Ryan deliberately left the request broad, expecting an opportunity to hash out the details. The request does not specify discrete items that have to be searched for, it simply suggests items of information Mr. Ryan might expect the records to include.

 

39.    Mr. Ryan could perhaps have limited the search to particular people, but NHSE has never provided a proper description of who was involved and in what capacity, so he would have to either guess who was involved or try his luck with the nebulous definition of ‘senior people’.

 

40.    NHSE limited the request to an arbitrary number of people without seeking to clarify this with Mr. Ryan.

 

41.    A flexible request means less work for the authority. NHSE adopted a maximalist approach and did not listen to Mr. Ryan’s protests.

 

Advice and assistance

 

42.    In their initial response NHSE suggested refining the request with more specific parameters as follows:

 

-          Even the “core negotiating team” is a very wide definition. As such, you could limit your request to a set number of people, for example, the 2 or 3 most senior people.

-          Reducing the requested timescale, for example to a single month or 6 weeks.

-          Reducing the scope of the information you are requesting. At present you are requesting 5 or 6 unique portions of information, each of which is a different consideration and requires a different assessment.

 

43.    Mr. Ryan submits that this was not at all helpful and suggests that NHSE had misunderstood the request. He therefore posed a series of questions, suggestions and comments in his request for an internal review and requested a direct conversation with the FOI officer to facilitate the advice and assistance stage of the request.

 

44.    NHSE did not follow up any of the queries via email or contact Mr. Ryan by telephone. Mr. Ryan’s request for a call-back from a FOI officer was ignored. The question for the tribunal is whether it is reasonable to ignore Mr. Ryan’s requests for advice and assistance and whether the response given by NHSE in the internal review letter satisfies them:

 

… NHS England does consider that we have provided you with advice and assistance in respect of how your request could be refined. However, because you have indicated that you did not consider our suggested refinements were helpful we have provided a further level of explanation and suggested refinements below and hope that these will be helpful to you.

 

i. Within the time period you have identified, negotiations were in two distinct phases.

 

ii. The first, 1 February - 23 March 2020, involved the development and agreement of “the deal”, as you describe it, ultimately documented in the Heads of Terms signed by each of the various providers over 20 - 23 March 2020. During that phase, negotiations were conducted from NHS England’s side by individuals at director level and above, with some administrative and legal support provided by others within the organisation.

 

iii. The second, 23 March - 15 May 2020, involved the development and agreement of the form of contract to be entered into by each of the providers, reflecting “the deal” documented in the Heads of Terms, confirmation of provider-specific details of in-scope facilities, and the administrative exercise of preparation and signing of individual contracts. During that phase, negotiations involved fleshing out detail, and agreement of contract drafting. This involved some individuals at director level, but also a larger number of individuals in supporting legal, operational and financial roles at levels below director.

 

iv. As the first phase resulted in “the deal” being agreed and documented in the Heads of Terms, and negotiations during the second were largely limited to technical and drafting issues, we would suggest that a sensible refinement might be to limit the time period covered by your request to the first phase.

 

v. We would also suggest that a sensible refinement would be to limit the scope of your request to those NHS England individuals at director level and above, as those at lower levels were not decision-makers but administrators, facilitators and advisers.

 

45.    Mr. Ryan submits that this is the same advice and assistance previously offered but in longer sentences and he fails to see how it is helpful. In effect, NHSE’s only advice was to reduce the scope of the request and left Mr. Ryan in no better a position to resubmit a request than he was before the response.

 

46.    NHSE did not respond to correspondence sent to them by Mr. Ryan after the decision notice asking why it is not possible to use a service provided by NHS mail to run search queries directly on the mail servers.

 

47.    Mr. Ryan sets out in his reply how NHSE could have dealt with the request in a more helpful way.

 

Following NHSE’s advice

 

48.    Mr. Ryan sets out the subsequent requests that he has made:

48.1.                      On 10 June 2022 Mr. Ryan submitted two separate requests for (i) emails and (ii) records of meetings. The NHSE has aggregated the two requests and not yet responded.

48.2.                      On 12 September 2022 Mr. Ryan submitted two requests in relation to (i) emails and (ii) records of meeting between the @IHPN domain and NHSE operational director of finance and performance. At the time of the reply NHSE has not responded.

 

49.    Mr Ryan submits that it is not sensible for a requestor to have to fire scattergun into the dark rather than have a reasonable back and forth with someone with knowledge of record-keeping within the organisation.

 

‘Core negotiating team’

 

50.    The reference to ‘principal negotiators’ within the preamble was a reference to the people negotiating on behalf of the IHPN members, not a reference to NHSE staff. NHSE never sought to clarify this with Mr. Ryan.

 

Advice and assistance via telephone

 

51.    NHSE does not maintain clear channels of communication with its requestors. Mr. Ryan provides a number of examples of NHSE failing to respond to his communications in relation to FOI requests either adequately or at all.

 

The Commissioner

 

52.    The Commissioner’s guidance says the following about section 16:

 

The Commissioner interprets this duty broadly. For example, if you receive a request which you believe is not valid for FOIA purposes, you should consider what advice and assistance you can provide the applicant to help them bring the request within technical compliance of FOIA.

 

Section 16 aims to ensure that you communicate with an applicant or prospective applicant to find out what information they want and how they can obtain it.

 

The duty to provide advice and assistance extends as far as it would be reasonable for you to do so.

 

As best practice, you should facilitate access to the information you hold as far as possible,

 

You should be flexible and treat each application or potential application on a case by case basis. Often, it will be clear what advice and assistance you need to offer. Sometimes, you will need to liaise with the applicant to establish what reasonable advice and assistance might be appropriate.

 

 

53.    The respondents cannot point to any communication which fulfils these criteria to any degree.

 

Section 45 Code of Practice

 

54.    It is absurd to suggest that public authorities ‘get a free pass’ on section 16 because they comply with the Code of Practice.

 

55.    Section 2 of the Code of Practice says nothing about what authorities should be required to do beyond that it be reasonable.

 

56.    Legislators cannot have intended section 16 to be entirely fulfilled by the Code of Practice. 

 

NHSE’s response to Mr. Ryan’s reply

 

57.    Broadly, NHSE’s response reiterates the points in NHSE’s original response and refutes or denies parts of Mr. Ryan’s reply.

 

The relevant law

 

58.    Under section 12(1) a public authority is not obliged to comply with a request for information where:

 

…the authority estimates that the costs of complying with the request would exceed the appropriate limit.

 

59.    The relevant appropriate limit, prescribed by the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (‘the Regulations’) is £450.

 

60.    In making its estimate, a public authority may only take account the costs it reasonably expects to incur in relation to the request in–

(a) determining whether it holds the information,

(b) locating it, or a document which may contain the information,

(c) retrieving it, or a document which may contain the information, and

(d) extracting it from a document containing it. (See regulation 3).

 

61.    The Regulations specify that where costs are attributable to the time which persons are expected to spend on the above activities the costs are to be estimated at a rate of £25 per person per hour.

 

62.    The estimate must be sensible, realistic and supported by cogent evidence (McInnery v IC and Department for Education [2015] UKUT 47 (AAT) para 39-41).

 

63.    The test is not a purely objective one of what costs it would be reasonable to incur or reasonable to expect to incur. It is a test that is subjective to the authority but qualified by an objective element. It allows the Commissioner and the tribunal to remove from the estimate any amount that the authority could not reasonably expect to incur either on account of the nature of the activity to which the cost relates or its amount. (Reuben Kirkham v Information Commissioner [2018] UKUT 126 (AAC)).

 

64.    Under section 16(1) FOIA a public authority has a duty to provide advice and assistance, so far as it would be reasonable to expect the authority to do so. Under section 16(2) public authority which, in relation to the provision of advice or assistance in any case, conforms with the Code of Practice under section 45 is to be taken to comply with the duty imposed by section 16(1) in relation to that case.

 

65.    The section 45 Code of Practice provides as follows at para 2.10:

 

Reducing the cost of a request

2.10 Where it is estimated the cost of answering a request would exceed the “cost limit” beyond which the public authority is not required to answer a request (and the authority is not prepared to answer it), public authorities should provide applicants with advice and assistance to help them reframe or refocus their request with a view to bringing it within the costs limit….

 

 

The Task of the Tribunal

 

66.    The tribunal’s remit is governed by section 58 FOIA. This requires the tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved exercising discretion, whether he should have exercised it differently. The tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.

 

Issues

 

67.    The issues we have to determine are:

67.1.                    What was the scope of the request?

67.2.                    Was NHSE’s estimate sensible, realistic and supported by cogent evidence?

67.3.                    Did NHSE comply with its duty under section 16 to provide advice and assistance?

 

68.  Mr. Ryan raised section 77 FOIA. We have no jurisdiction to consider a complaint under section 77.

 

Evidence

 

69.    We read and took account of an open bundle. We heard evidence from Mr. Ryan and, on behalf of NHSE, from Mr. Middleton (Service Lead, NHS Digital) and Mr. Shiraz (IT Infrastructure Manager, NHSE).

 

Submissions

 

Mr. Ryan’s witness statement, skeleton argument and oral submissions

 

70.    Mr. Ryan’s witness statement, to the extent that it is relevant to the matters that we need to determine, primarily contains submissions rather than evidence, so it is convenient to include it here.

 

71.    Mr. Ryan also submitted a document entitled ‘Appellant’s update’. We have read that document and taken it into account where relevant.

 

72.    The following is a summary of the main thrust of Mr. Ryan’s oral and written submissions, in so far as they are relevant to the issues we have to determine.

 

Scope of the request

 

73.    In the part of the request relating to emails, NHSE has misinterpreted his request. He has asked for ‘all emails to and from the @ihpm.org.uk domain during the period’. NHSE have interpreted it as a request approximating ‘all emails containing certain keywords between the principal negotiators we have defined’.

 

74.    In the second part of the request relating to records of meetings, NHSE chose to interpret a flexible request for ‘records of meetings’ that Mr. Ryan would ‘expect to include’ a series of items, as its most onerous interpretation for ‘5 or 6 unique portions of information, each of which is a different consideration and requires a different assessment’.

 

75.    NHSE’s line of argument leads to FOIA being unable to accommodate a flexible request for information. This is not a reasonable approach.

 

76.    Mr. Ryan submitted in oral submissions that the request was clearly subjective. It contains subjective terms and suggestions of what NHSE might try to find. It is not clear why NHSE should have the sole authority to determine the objective reality of the request, at least not without checking with Mr. Ryan. NHSE did not take any steps to clarify the request.

 

Methods for searching

 

77.    Mr Ryan accepted, on the basis of the evidence of Mr. Shiraz and Mr. Middleton that the NHS did not have Mimecast at its disposal. He submitted that it was only in the last two weeks before the hearing, when the evidence of Mr. Shiraz and Mr. Middleton was produced, that NHSE has clearly explained that it would not be possible to run the query that Mr. Ryan had done when working for the local Council. Prior to the two witness statements being produced, Mr. Ryan had no idea why his request was being refused or what systems prevented it from being carried out.

 

78.    Even if this query could not be run, Mr. Ryan submitted that NHSE still had options for retrieving and searching for the information. NHSE could have requested from NHS Digital the mailboxes of the nine principal negotiators and filtered them by date and recipient using Microsoft Excel.

 

79.    It would have been reasonable for NHSE to contact Mr. Ryan, describe who it considered the ‘nine principal negotiators’ to be and then agree on a common definition.

 

Advice and assistance

 

80.    NHSE has not provided advice and assistance, it provided a refusal notice. Section 16 requires more than simply providing a refusal notice. It requires communication back and forth. NHSE should have contacted Mr. Ryan to find out what information he wanted, and how they could obtain it. NHSE should have explained who was relevant to the request and could have identified the key meetings. They have not provided sufficient information for him to refine his request.

 

81.    Mr Ryan posed a series of questions, suggestions and comments in his internal review. This was what NHSE needed to provide in order to provide advice and assistance. It did not engage seriously with them and provided no meaningful responses. If he had been able to speak to someone, it is likely that the advice and assistance would have been no more than 5 minutes. By refusing to engage with the request and the requester, NHSE’s responses led inexorably to an ICO appeal and then the Tribunal.

 

82.    We have not set out Mr. Ryan’s submissions on section 77 because this is not within our remit.

 

NHSE’s skeleton argument and submissions

 

Overarching submissions

 

83.  Mr. Ryan’s submissions are based on an error, namely his understanding of FOIA as a ‘freeform’ process where the requestor is entitled to wander around a public authority’s records and files negotiating to get the information he wants. This is not how FOIA requests are structured. There is a request, and the public authority complies with the request. In complying with the request the authority is entitled to rely on certain exemptions. If it is going to refuse the request it has certain obligations along the way including the obligation to give advice and assistance under section 16 and, to the extent that information is being withheld, to provide a refusal notice under section 17. Mr. Ryan submits that in every aspect of these duties under FOIA, NHSE have complied in full.

 

84.  Mr. Ryan’s error is apparent in and infects three main issues:

 

84.1.        In relation to the scope of the request, a request cannot be framed in a subjective way. It is not a question of a requestor dangling a fishing net to see what he or she can catch. A request has to be fully formed and capable of being objectively understood by the authority, who are required to comply with it in full. FOIA builds in a process for clarification and refinement but the authority has no power to ‘read down’ the request in a way that is advantageous to the requestor.

84.2.        Unless the scope of a request is formally refined/amended or a new request submitted, the authority must comply with it in full. It cannot provide part of the information requested to bring it below the section 12 limit. This is so even if Mr. Ryan has stated that some of the requested data would be enough for his purposes. It is not within his gift to not press for certain parts of information requested. The scope of the request is very broad and would include all the things he would ‘expect it to include’ and more.

84.3.        Section 16 provides a duty to provide reasonable advice and assistance. Under section 16(2) a public authority will be taken to have complied with that duty where it has complied with the Code of Practice. The requestor is not entitled to some kind of free-flowing dialectic process where he can have a meeting with a FOI officer and thrash out how he can get certain information. There is a proportionate process in place which does not entitle the requestor to that level of engagement. The information provided by NHSE went above and beyond what it was obliged to provide.

 

85.  The public interest and Mr. Ryan’s concerns about what is happening internally at NHSE are not relevant to section 12.

 

Section 12

 

86.  NHSE interpreted the request in accordance with the contextual introduction to his request. This enables it to significantly narrow the scope of the searches. By reference to the phrase ‘between the principle negotiators’ NHSE identified nine individuals. The request was not interpreted overly broadly. It was a broad request. If anything, NHSE interpreted it narrowly. If it had interpreted it more broadly, the estimate would have been higher. Mr. Ryan was given opportunities to refine his request and guidance for doing so but did not.

 

87.    NHSE did not have a centralised repository of information within the scope of the request, nor any metadata by reference to which it could have retrieved it. As such, it was necessary to search its records in order to locate and retrieve information within the scope of the request and in order to produce an estimate of complying with the request.

 

88.    The estimate was based on a great deal of internal discussion and sampling as to the appropriate way to obtain the requested information.

 

89.    In relation to the “meetings” aspect of the request, NHSE estimated that the relevant period would have involved at least 490 meetings. A sample of one individual’s diary resulted in an estimate of between 2 and 2.5 hours just for identifying which meetings were in scope - not taking into account the time it would take to then locate and retrieve records relating to those meetings. That preliminary exercise alone was accordingly estimated to be approximately 20 hours.

 

90.  In relation to the “emails” aspect of the request, NHSE noted that it would need to search each mailbox individually, and to check emails manually for relevance given the many workstreams relating to IHPN. NHSE conducted a sample search in respect of just one relevant individual, which took 4.5 hours without being comprehensive. Extrapolating to 9 individuals, NHSE estimated it would necessarily take in excess of 40.5 hours to comply with this aspect of the request.

 

91.  NHSE assumed a reasonable method when preparing its estimate. It has explained why, in light of the IT architecture in place, there is not a technological short-cut which would avoid the searches which the estimate is based on.

 

92.  This was not only reasonable, but the only possible effective and efficient way of doing this. But it shows that the way it was approached was favourable to Mr. Ryan and if it had been approached in the way that Mr. Ryan suggests it would have been ‘impossible’, using the words of Mr. Middleton, to retrieve that level of data because it would have taken many months. The dispute as to the scope of a request is a red herring - the alternative interpretation would simply render the time involved even more in excess of the appropriate limit.

 

93.  Even if there was a way to isolate all NHSE emails to a given domain, that would require vast amounts of data to be trawled not only for relevance (caught by section 12) but also for exemptions and necessary redactions (caught by section 14).

 

94.  NHSE was required to produce an estimate of complying with its duty to produce all information within scope of the request, not some or most of the information.

 

95.  Section 12 does not have regard to criticisms of internal record keeping. It may be that other authorities have better processes. The tribunal has heard direct evidence from two experts, who were credible and knowledgeable witnesses with an insight into NHSE and NHS Digital processes that few IT professionals have. There are few organisations in the world which operate data on that scale.

 

96.  The application of section 12 does not depend on section 16. The appropriate limit applies to the scope of the request as it actually was.

 

Section 16

 

97.  NHSE provided advice and assistance in its initial and internal review response. The steps taken by NHSE were reasonable and accord with the Code of Practice. Section 16 does not require oral engagement.

 

98.  It was reasonable for the NHSE to have declined to engage in a protracted back-and-forth regarding how the request could be refined. Neither section 16 nor the Code of Practice imposes any such requirement and, given that the purpose of section 12 is to protect public authorities from burdensome requests, it would be surprising if the duty were that onerous.

 

Discussion and Conclusions 

 

Findings of fact based on Mr. Shiraz and Mr. Middleton’s evidence

 

99.         We accept the evidence of Mr. Shiraz and Mr. Middleton as to NHSE’s IT processes and systems and the role and limitations of NHS Digital and NHS Digital searches.

 

100.     On the basis of that evidence we find that NHSE do not have a standard e-discovery tool pre-loaded on to their systems which could be used ‘off the shelf’ to find the information sought by Mr. Ryan. The email archiving and search system called ‘Mimecast’ is not used by NHSE.

 

101.     The majority of day-to-day emails are handled through ‘nhs.net’ which is a centralised email service managed by NHS Digital, which is at present a separate statutory body to NHSE. NHSE do not have the ability to undertake digital discovery or any ‘behind the scenes’ searches themselves.

 

102.     NHS Digital cannot undertake free text searches across the entire NHS mail systems. Some staff use accounts on the system ‘england.nhs.uk’ for Microsoft Teams and email archives. ‘england.nhs.uk’ was, historically, the NHSE’s own email servers. There are also a variety of other storage systems in use.

 

103.     It would not be possible simply to scan NHSE servers or systems to look for a key word such as ‘IHPN’ (whether in emails or other files) across all accounts. Mr. Shiraz best guess estimate is that the gathering of the data would take up to 4 weeks, because of the scale of data involved.

 

104.     NHS Digital provides an email service to NHSE, among other organisations. NHS England has 24, 645 usable mailboxes with approximately 265TB of mailbox data. NHS Digital can approve a request from an organisation to search a limited number of mailboxes. The search is undertaken by the supplier, Accenture. The tool used to search is eDiscovery. There are Microsoft-imposed constraints when using eDiscovery which, for example, limit the amount of data, which can be exported per day.

 

105.     Because of the amount of data involved, when asked if it would be possible to search all the NHSE emails for all emails to and from ‘the @ihpn.org.uk domain’, Mr. Middleton replied, ‘to do a search on that number of emails is unacceptable, it couldn’t be done, and if it was even contemplated it would take a huge number of weeks and more than likely months’. On the basis of this evidence we find that such a search was, in practice, not available to NHSE. 

 

Scope of the request

 

106.     This is not, in our view, a request that is insufficiently clear such that the public authority should, in accordance with the section 45 Code of Practice, have asked for more detail from the requestor.

 

107.     The scope of a request is determined on an objective reading of the request, in the light of any relevant background facts. Mr. Ryan’s subjective intention does not determine the scope of the request. Nor, at this stage in the proceedings, does NHSE’s interpretation of the request. It is for the tribunal to objectively determine the scope of the request, in the light of the background facts.

 

108.     Mr. Ryan submits that the request for emails was interpreted wrongly by NHSE. He states that this part of the request asks clearly for ‘all emails to and from the @ihpn.org.uk domain during the period’ without limits in relation to the individuals at NHSE or in relation to the subject matter. He submits that NHSE were wrong to limit the scope of the request to emails to and from nine key individuals at NHSE and were wrong to limit the request to emails relating to the subject matter of the contracts drawn up as a result of the negotiations with IHPN.

 

109.     In our view the context provided by Mr. Ryan in the introductory paragraphs  limits the scope of this part of the request. It is appropriate to construe the paragraph headed ‘the Request’ in the light of the preceding paragraphs.

 

110.     In the first paragraph Mr. Ryan outlines the concerns relating to value for money etc. in relation to the contract negotiated between NHSE and IHPN. In the second paragraph he states that he is ‘therefore requesting records between the principal negotiators during the period the deal was finalised’.

 

111.     In the light of this, we find that it would be appropriate to construe the request which follows as being limited to emails relating to the proposed national contracts with independent sector providers.

 

112.     Mr. Ryan submits that ‘principal negotiators’ does not relate to NHSE staff at all but to the people negotiating on behalf of the IHPN’s members, presumably IHPN itself. This may have been Mr. Ryan’s subjective intention. However this is not a natural reading of the phrase ‘I am requesting records between the principal negotiators’. Objectively the use of the word ‘between’, when it is not followed by another individual(s), suggests that the phrase refers to the principal negotiators on both sides of the negotiation, rather than simply on one side.

 

113.     In conclusion we find that, objectively construed, the email part of the request was limited to emails on the relevant subject matter between the principal negotiators at NHSE and IHPN.  

 

114.     In any event, NHSE did not ultimately restrict its interpretation of the scope of the request to nine individuals. In its response NHSE stated ‘even if we were to restrict our searches to the ‘core negotiating team’’ (my emphasis). Having concluded that it would exceed the appropriate limit simply searching for emails in relation to those nine individuals, it was not required to go further.

 

115.     In his application for an internal review Mr. Ryan states that he is seeking ‘all emails to and from the @ihpn.org.uk domain during the period’. It is arguable that NHSE ought, at this point, to have treated this as a formal clarification or a formal amendment to the email part of the request.

 

116.     However, this would not have assisted Mr. Ryan. Contrary to what Mr. Ryan initially assumed, this would not have reduced the amount of work involved. Due to the vast amount of data involved, it is not practicable to simply carry out a central search of all NHS emails for emails to and from @ihpn.org.uk. If no central search is available, the argument that it might take less time to carry out a search of all NHS emails rather than of the emails of, for example, the nine principal negotiators is unsustainable. 

 

117.     The part of the request which asks for ‘records of meetings’ states as follows:

 

I would like to receive records of meetings … between the authority and the Independent Health Provider Network (IHPN) during the period 1st February and 15th May 2020. I would expect this to include:

 

1. …

 

2. Records of meetings with the IHPN to include but not be limited to:

 

a. A list of dates of any such meetings

b. Preparatory briefings/lines to take

c. Agendas,

d. Minutes or notes,

e. Any presentation materials

 

118.     Mr. Ryan submits, at paragraph 10 of his skeleton argument, that NHSE chose the most onerous interpretation for a flexible request for ‘records of meetings’ that Mr. Ryan would ‘expect to include’ a series of items. NHSE interpreted it as a request for ‘5 or 6 unique portions of information, each of which is a different consideration and requires a different assessment’.

 

119.     As we stated above, in our view, the request is sufficiently clear not to require the authority to have sought clarification. The request is for records of meetings between the authority and IHPN during the relevant period. It states that Mr. Ryan would expect this to include, but not be limited to: a list of dates of any such meetings; preparatory briefings/lines to take; agendas; minutes or notes; any presentation materials.

 

120.     In the light of such a list provided by the requestor, it would be surprising if NHSE had not interpreted the request for ‘records of meetings’ as including at least a request for those specific items. Objectively construed Mr. Ryan has asked for all records of meetings which is extremely broad. This would include all those items and is likely to include more. An authority has to provide all the information requested. It cannot provide some of the information in order to keep it under the section 12 limit.

 

Was NHSE’s estimate sensible, realistic and supported by cogent evidence?

 

121.     NHSE is a unique organisation. Given the size of NHSE, the amount of data it holds and the particular processes it has in place, we accept that Mr. Shiraz, Mr. Middleton and other individuals working within NHSE are likely to have a better idea than the members of the tribunal or Mr. Ryan of the most efficient way to search for information held by NHSE.

 

122.     NHSE has provided clear evidence that a simple, centralised search is not, in practice, possible and we accept that. The supplementary open bundle contains email exchanges which demonstrate that detailed consideration was given to the most appropriate methods of searching for the requested information.

 

123.     The section 12 limit is exceeded if the public authority cannot provide all the information requested within the appropriate limit. This request is extremely broad. It includes all records of meetings between NHSE and IHPN over a three month period. ‘Records of meetings’ is a broad phrase and Mr. Ryan explicitly sets out in the request that he would not expect this to be limited to minutes of meetings, or even to be limited to all the matters set out in his list.

 

124.     NHSE does not have a central record of the meetings which took place during the relevant period. We accept therefore that individual diaries and emails would have to be checked for meetings that had taken place. NHSE estimated that during that period there would have been at least 490 meetings. A sampling exercise was carried out in relation to one individual’s diary which resulted in an estimate of between 2 and 2.5 hours just for identifying which meetings were in scope. This did not account for the time it would take to find and retrieve records relating to those meetings. That preliminary exercise was estimated to take approximately 20 hours in relation to the minimum of nine individuals. 

 

125.     We accept that this is a reasonable estimate. It is supported by a sampling exercise. This in itself takes the estimate over the appropriate limit.

 

126.     In relation to the emails, we accept that the inbox relating to each individual has to be searched separately. A sampling exercise was carried out in relation to one individual. We accept that this search took in excess of 4.5 hours because of different naming conventions and still did not, to the searcher’s knowledge, locate all the relevant information. This was before information relating to the negotiations had been extracted. In the light of this, we do not accept Mr. Ryan’s assertion that NHSE could simply have taken the individual’s mailbox and ‘filtered them by date and recipient using Microsoft Excel’ in order to locate all the relevant information in scope. We accept that NHSE adopted what they thought was the most efficient method, in the light of the knowledge of their own systems. This was a reasonable approach.

 

127.     Based on this, we accept that it was reasonable to estimate that it would take in excess of 40.5 hours to locate possibly relevant information just in relation to the nine individuals. This also takes the estimate well over the appropriate limit.

 

128.     For all those reasons we accept that the estimates provided were sensible, realistic and supported by cogent evidence and that it would exceed the appropriate limit to answer the request.

 

Section 16

 

129.     In its initial response to the request dated 12 October 2021 NHSE stated, ‘to respond to your request as it is currently framed would exceed the cost limit’ (our emphasis). The letter continues, ‘If you were to refine your request for information within specific parameter, then we may be able to continue processing the request.’ NHSE go on to make a number of specific suggestions as to how the request might be refined.

 

130.     The first suggestion is to limit the request to, for example, the 2 or 3 most senior people. The second is to reduce the timescale. The third is to reduce the scope of information requested. In our view these are all reasonable suggestions.

 

131.     The letter concluded with the statement ‘We hope this information is helpful. However, if you are dissatisfied, you have the right to ask for an internal review. This should be requested in writing within two months of the date of this letter.’

 

132.     Mr. Ryan wrote to NHSE on 13 October requesting an internal review and asking to be provided with further information under section 16 FOIA. He states that he has not been provided with the information necessary to submit a revised request. He makes the following suggestions:

 

I would suggest that in the first instance, the authority compile an initial and non-exhaustive list of the meetings between its staff and the IHPN, and that can form the basis from which to decide whether to pursue this request as it is currently worded and how many items of information from each meeting I am requesting.

 

Without an indication of how many staff, how many emails how many meetings and how many records each of these generates, it is not possible for either the authority or I to understand how long this request could be expected to take.

 

Alternatively, I would be happy to limit my request to ‘records of meetings attended by NHSE staff who have emailed the IHPN domain’. I.e. The authority can quickly generate a list of staff who have emailed the IHPN as part of the email-gathering exercise, and then use this list to inform a further search for records of any meetings. This would avoid the authority having to ask every member of staff in the organisation whether or not they have attended a meeting with the IHPN, as seemed to be suggested in the response.

 

As I have noted consistently, I believe that the easiest way to resolve these questions is via a direct conversation with the FOI officer, and I would appreciate both a direct phone number and email address for the FOI team (as stipulated in the ICO guidance) to facilitate this advice and assistance stage of the request.

 

133.     Specifically in response to NHSE’s suggestions to refine the scope of the request he states:

 

…I’m not sure where the language ‘core negotiating team’ has come from, and would not wish to limit the scope of my request to 2-3 unknown people without further information about exactly what their role in this process was, and how many officers performing what roles would be excluded from such a reformulated request.

 

On reducing the timescale, the 14 week span covered by this request is not an outrageous length of time, even given the pressing circumstances at the outset of the pandemic. I have already gone to some lengths to limit the time-scale of this request as much as I am able, and am not generally inclined to reduce it further, especially not without an understanding of the number of records we are discussing here.

 

And on my requesting ‘5 or 6 unique portions of information’, I have not. Specifically, my request asks for ‘Records of meetings with the IHPN’, and goes on to specify what kinds of records that might include. I am not expecting each officer to conduct five separate searches for each and every meeting, all I am trying to express is that I want more than just the minutes of each meeting.

 

Overall, I’d hope that we can take a common sense approach to identifying and retrieving the records relevant to this request. The issue here is that we are not able to take a common sense approach, because this would require some degree of discussion between the authority and the requester under the auspices of Section 16. Unfortunately, this is made impossible by the authority’s request handling process.

 

… if the authority wishes for me to narrow the scope of my request I will need further information. I need to know a ball-park figure for how many meetings, staff and records we are discussing here. I would have expected these kinds of numbers to have been generated in the course of a sampling exercise carried out by the authority, but it is not clear that one has occurred.

 

134.     Mr. Ryan suggests that the authority compiles an initial and non-exhaustive list of the meetings between its staff and the IHPN, which could form the basis from which he can decide whether to pursue the request as it was currently worded and how many items of information from each meeting he was requesting. Mr. Ryan may be right that this would have been useful for him. It is certainly not required by section 16.

 

135.     Mr. Ryan states that, alternatively, he would be happy to limit his request to ‘records of meetings attended by NHSE staff who have emailed the IHPN domain’. This is expressed as an alternative option that he would be happy to take. It is does not amount to an amendment or a refinement of the request.

 

136.     Other than this potential refinement, Mr. Ryan did not want to limit the scope in the ways suggested by NHSE. Mr. Ryan did not want to reduce the timescale. He did not want to limit the scope of the request to 2-3 unknown people without further information about exactly what their role in the process was, and how many officers would be excluded from such a request. He did not want to limit his request until he had been given a ‘ball park’ figure of the number of meetings, staff and records that were being discussed.

 

137.     We do not accept that NHSE failed to engage properly with Mr. Ryan’s  ‘questions, suggestions and comments’. The internal review response was detailed and engages reasonably with the matters raised by Mr. Ryan.

 

138.     For example, NHSE provided a ‘ball-park’ figure of the number of staff. NHSE stated that there were at least nine colleagues who they would consider to be the principle negotiators, but that this could also include others. NHSE stated that it did not hold a list of all individuals involved, but gave an indication of the teams in which those individuals worked and the level of staff involved. NHSE also provided a ‘ball park’ figure for number of meetings involved: approximately 490.

 

139.     In addition, NHSE gave further suggestions as to how the request could be refined, with information to support that. It gave Mr. Ryan information on the dates of the different phases of negotiations and therefore suggested that he limit the request to the time period covered by the first phase. It indicated that the individuals involved in the negotiations were those at director level and above, and therefore suggested that the request be limited to individuals at that level.

 

140.     What NHSE did not do was adopt Mr. Ryan’s suggestion to pick up the phone and discuss the matter with him, or to engage in a similar back and forth discussion by email. It is not the tribunal’s role to decide whether that would have been the most efficient or a better way of dealing with this matter, nor indeed whether or not that was in accordance with the spirit of the Commissioner’s guidance on this issue. We have to decide whether NHSE was in breach of the obligation to provide reasonable advice and assistance under section 16.

 

141.     Under paragraph 2.10 of the Code of Practice, where it is estimated the cost of answering a request would exceed the appropriate limit, public authorities should provide applicants with advice and assistance to help them reframe or refocus their request with a view to bringing it within the costs limit. Paragraph 6 provides that this may include suggesting that the subject or timespan of the request is narrowed and that any refined request should be treated as a new request for the purposes of the Act.

 

142.     NHSE in our view, provided reasonable advice and assistance to help Mr. Ryan reframe or refocus his request. This is clear from reading the initial response and the response to the internal review. We accept that, subjectively, he did not feel advised or assisted, but that is not the test. It is not in our view unreasonable for a public authority not to engage in separate discussions outside the framework of response and internal review in order to provide that reasonable advice and assistance. It is not, in our view, necessary for a conversation to take place either orally or by email. It is reasonable to provide suggestions for refinement in the initial response and the internal review response.

 

143.     Overall, although Mr. Ryan would have liked the matter to be handled differently, we accept that NHSE provided reasonable advice and assistance and discharged their duty under section 16.

 

Conclusion

 

144.     For the reasons set out above, NHSE were entitled to rely on section 12 FOIA and were not in breach of section 16 FOIA.

 

 

 

 

 

Signed Sophie Buckley                                                        Date: 2 February 2023

Judge of the First-tier Tribunal