Robert Fortner v The Information Commissioner & Anor

1. This Decision relates to an Appeal brought by Robert Fortner against the Information Commissioner’s (‘ICO’) decision notice (‘DN’) of 31 March 2025. The First Respondent (the ICO) and the Second Respondent, UK Research and Innovation (‘UKRI’) oppose the appeal on the basis that the DN was correctly decided. Request

2. The Appellant submitted a request to UK Research and Innovation (UKRI) on 22 June 2024, in the following terms: ‘ I’m a journalist. I have written a number of articles for The BMJ about polio. In the most recent, I came across documents suggesting possible research integrity issues in an Imperial College study of a new polio vaccine, nOPV2. UKRI was among the study’s funders. [1] I request all Ivan Pavlov’s [Head of Preclinical Good Research Practice Policy at the Medical Research Council] email correspondence, from 01 January 2024 to 01 June 2024, regarding this matter, including but not limited to correspondence with staff at Imperial College and/or any party regarding the Imperial College nOPV2 paper and/or the research integrity policies and processes of Imperial College. [2] Partially overlapping with the preceding, I request all correspondence between anyone at UKRI and anyone at Imperial College regarding research integrity from 01 January 2021 to 01 June 2024. [3] I request any research integrity statistics provided by Imperial College to UKRI between 01 January 2014 and 01 June 2024’.

3. UKRI responded on 1 July 2024, asking Mr Fortner to narrow the scope of his request, in order to avoid it engaging the s.12 exemption (cost limit) due to the volume of material. UKRI stated that it would take almost 21 hours of staff time. UKRI suggested that this could include advising of additional search terms that would help to narrow the scope of the searches, so it was more relevant to his interests, potentially alongside a reduction in the original time frame.

4. The Appellant responded on the same day, narrowing the range of question 2 to 26 January 2024 – 26 May 2024. He stated: ‘ If you would, please process Search 1 as specified. For now, please drop Search 2 completely. For Search 3, could you please move in [sic] both the start and end dates to 26/01/24 and 26/05/24. If the 325 emails found using the initial time window are evenly distributed, this narrowing should reduce the total time for this request to - 17.5 hours. Please let me know if this fits within Section 12 allowable costs’.

5. The range of question 2 of the request was refined to 26 January 2024 – 26 May 2024.

6. On 26 July 2024, in response to correspondence from UKRI, the Appellant consented to disclosure under FOIA of his own personal data where he was the author of emails. UKRI response

7. UKRI provided a response on 27 August 2024. a. In relation to request 1 , it disclosed emails but redacted the names, contact details and job roles of individuals (except Ivan Pavlov) on the basis of s.40(2) (personal data) of FOIA. It explained ‘ In collating our response, we have excluded emails that consist solely of Ivan Pavlov forwarding an email received to the MRC Research Integrity Lead inbox, with no additional information added’. b. In relation to request 2, UKRI disclosed some emails but explained some personal data had been redacted on the basis of s.40(2). It also explained that some email correspondence had been withheld on the basis of s.41(1) (information provided in confidence) of FOIA. c. In relation to request 3, UKRI explained that it did not hold any information except that which was published in the annual statement on research integrity which given it was in the public domain was exempt from disclosure on the basis of s.21(1) (reasonably accessible to the applicant) of FOIA. Further Correspondence

8. On 28 August 2024, the Appellant explained that this portion of his request was initially projected to return 325 emails from a 6-month window. He then narrowed this to 5 months. However, only 4 pages of emails had been provided to him – which he already possessed as he was on the thread. Therefore, he believed approx. 200 results were withheld in their entirety. He explained that he did not accept that it was plausible to argue that this volume of material fell within the scope of s.41(1) FOIA.

9. On 29 August 2024, UKRI replied. It explained that although a significant number of emails were returned by its initial searches for information potentially in scope, once they reviewed them, they were either disclosed as part of their response or deemed to be exempt on the basis of s.41(1). UKRI asked the Appellant to confirm if he still wished them to conduct an internal review and the Appellant confirmed that he did.

10. UKRI responded on 23 October 2024, upholding its decision. UKRI withheld the email chain on the basis of s.41(1) and 40(2), it explained: ‘To reiterate the searches conducted, used the key words “research integrity” between the dates you specified in combination with correspondents that had an @imperial.ac.uk email address and generated a large number of results. These results were then manually reviewed to determine whether they fell within the scope of the request, which in the case of your request, which in the case of your request was “between anyone at UKRI and anyone at Imperial College regarding research integrity”. The review indicated that most of this information did not fall within the parameters of your request as it was not related to the topic of research integrity or was not otherwise in scope of your request. As explained on 29/08/24, the search results had picked up information related to grant applications where the grant scheme terms and conditions included the words “research integrity”. Once these results were discounted there were 50 emails which on further view after removing duplicated email chains resulted in only two email chains in scope of your request. We apologise that our communications with you, regarding the initial searches and where we sought your assistance in refining the searches, and our response of 28/08/24 were not as clear as they could have been round how these initial results related to the scope of your request. We hope that the additional information provided on 29/08/24 and summarised here clarifies this’. Complaint to the ICO

11. On 30 April the Appellant complained to the ICO. He submitted: a) In relation to request 1, he did not agree “ that emails that consist solely of Ivan Pavlov forwarding an email received to the MRC Research Integrity Lead inbox, with no additional information added ” should be excluded. He felt it was not clear why and on what basis this approach had been taken. b) All the emails initially located by UKRI’s search criteria for question 2 of his clarified request (205 emails) fell within the scope of this part of his request and should be disclosed. c) The decision to withhold any information falling under s.41(1) was wrong and should be disclosed. Decision Notice (dated 31 March 2025)

12. The ICO came to the following conclusions. Request 1

13. The ICO sought clarification as to why the emails forwarded from Ivan Pavlov to the MRC Research Integrity Lead Inbox with no additional information added, had been excluded.

14. UKRI explained that: a. They were not considered as providing additional relevant information. b. There were 17 emails and the Appellant had either been included in the correspondence and therefore had access to them, or they were disclosed to the Appellant in the FOIA response. c. They did not contain any further input from Ivan Pavlov and were forward for the purpose of record keeping only.

15. The ICO confirmed that it had seen a sample of emails and agreed that UKRI’s explanation was accurate. The ICO was therefore satisfied that it was appropriate for UKRI not to include the emails as part of its response. The ICO further added ‘ Moreover, the Commissioner notes that this part of the request sought emails between Dr Pavlov and parties at Imperial College about research integrity. These emails have been disclosed. The simple, administrative emails in which Dr Pavlov sent that email correspondence to the internal inbox do not fall within the scope of the request. This is on the basis that such emails are internal emails between Dr Pavlov and an internal administrative inbox rather than emails between him and parties at Imperial College’. Request 2

16. The ICO stated that in order to effectively address request 2, it should quote UKRI’s response to the complaint which explained how it had determined what information fell within scope: ‘ I wanted to provide you with some further insight into how requests of this nature are handled, as I believe there may be some misunderstanding in regard to the initial search figures and how that corresponds to information in scope of your request. When we conduct initial email searches, the results that are produced are based solely upon the search conditions and terms used. For Q2 of your request, this was using the key words “research integrity’ between the dates you specified in combination with correspondents that had an @imperial.ac.uk email address. The results returned from these searches then need to be manually reviewed to determine whether they fall within the scope of the request, which in the case of our request was “between anyone at UKRI and anyone at Imperial College regarding research integrity”. It is this manual review that takes a significant amount of time and is what engages Section 12 of the FOIA, prompting us to seek clarification from a requester and/or a narrowing of scope. Of the 325 results you mention that were returned by our search which looked at a period of six months reduced this number down to 205, which in combination with the 90 results produced for the search relevant to Q1, satisfied our estimate that the cost equivalent to 18 hours of staff resources would not be exceeded in reviewing them. On reviewing these 205 emails, it became apparent that approximately three-quarters of them were clearly not related to the topic of research integrity or were not otherwise in scope of your request. To offer an example of the type of correspondence that was captured by the search criteria, but did not fall in scope of your request, there were a large number of emails where student’s grant applications consisting of multiple attached documents were being sent from Imperial College to UKRI. These emails were not related to research integrity and contained no actual discussion; they had been picked up by the search terms and conditions that included the words “research integrity” – something that is part of all grant scheme T&Cs. Once these emails had been discounted, we were left with 50 that required further detailed review. At this point, it is important to note that each search result is a single email, many of which are repeated in other emails as they form chains and conversations. Therefore, once these emails were reviewed in more detail and duplicates of emails had been removed, it left only a small number of unique email chains. These chains were then reviewed in conjunction with the areas of the organisation from which they originated and the UKRI Research Integrity team to confirm if the topics under discussion were indeed related to research integrity, with those that were not also discounted as being not in scope. Those that remained that were not already part of the response to Q1, were either disclosed as part of our response, or deemed to be exempt under Section 41 of the FOIA. You are therefore correct, in that not every single responsive document met the requirements to be considered under Section 41, it was deemed that the release of one email chain would constitute an actionable breach of confidentiality as it was not related to the same issue being discussed between yourself and Imperial College and thus warranted consideration under a different set of circumstances’.

17. UKRI confirmed to the ICO that the searches returned a large number of ‘false positives’ (ie emails unrelated to the scope of the request where the words ‘research integrity’ appears in documents attached to emails or in standard terms and conditions for grant awards or within a grant agreement). The ICO saw some examples of emails that had been excluded.

18. The ICO was satisfied with UKRI’s interpretation and approach to determining what falls within the scope of this part of the request as correct for the following reasons: a. Simply because an email or document contains the word ‘research integrity’ does not mean that it falls within scope. The request seeks emails that contain a substantive discussion or information on the topic of research integrity, not simply emails that contain the term. The ICO has examined examples of such emails and is satisfied. b. The ICO accepts UKRI’s explanation as to why some emails have been excluded as they contained duplicates or will have been identified (and disclosed) in response to question 1 of the request. This will consequently reduce the scope of the question 2 request. c. For the reasons the ICO found that all the 205 emails should not have been disclosed. Request 3

19. UKRI withheld one email chain on the basis of section 41(1). In order for this exemption to be engaged, 2 things must happen: a. The public authority must have obtained the information from a 3 rd party AND b. Disclosure of that information has to constitute an actionable breach of confidence.

20. The ICO concluded: The information was obtained from another person a. The majority of the information falling within the scope of the request was provided to UKRI by a third party. The remainder consist of emails sent by UKRI – however the material generated by UKRI directly reflects the content of information provided by the third party. Disclosure of the emails written by UKRI would still reveal the content of the information provided by the third party. Disclosure of the emails would therefore reveal the contents of information obtained from the other person. The ICO is satisfied these latter emails still meet the requirements of s.41(1)(a). The information has the necessary quality of confidence. b. Information has the ‘necessary of quality of confidence’ if it is not otherwise accessible and it is more than trivial. This information does have the necessary quality of confidence as it is more than trivial and not otherwise accessible to the public (as it was sent in confidence to the recipients on a matter that is not in the public domain). It can be considered to be private and confidential, namely sensitive matters concerning research integrity. The information was imparted in circumstances importing an obligation of confidence c. The information was provided to UKRI with the expectation that it would be treated confidentially. It was about a confidential matter. UKRI argued that the confidence was vital to ensure the processes and systems for reporting issues to UKRI are protected and individuals are assured that any matter raised will be treated in confidence. It referred to its policy on reporting matters related to research integrity which provides that “ all those involved in the process are required to maintain confidentiality”. It argued that the third party provided the information on the understanding it would not be disclosed outside UKRI and only internally on a need-to-know basis. The ICO accepted this. Disclosure would be of detriment to the confider d. The ICO accepted that disclosure would cause detriment to the parties as the issues raised in the correspondence are highly confidential and concern matters that would negatively affect individuals by impacting the personal lives and careers of the individuals involved, including the confider.

21. The ICO found there is a public interest for the public to have confidence in how UKRI considers matters of research integrity. Disclosure would contribute to this as it would allow the public some insight and understanding as to how one particular matter concerning research integrity was handled by UKRI.

22. However, the ICO also concluded that there is a general public interest in ensuring that confidences are maintained, in this case disclosure risks having a ‘ direct and clearly negative impact on the confider, an outcome which the Commissioner considers to be firmly against the public interest’. He went on to find: ’ 52. Furthermore, more broadly, the Commissioner is conscious of the wider ramifications and impact that such a disclosure could have on UKRI’s reporting system in relation to matters of research integrity if individuals providing information to UKRI, in the expectation that it would be treated confidentiality, subsequently found that such information was disclosed under FOIA. In the Commissioner’s opinion a situation where individuals did not, or were unwilling to, share legitimate concerns about research integrity with UKRI for fear of sensitive information being disclosed, is an outcome that is clearly counter to the wider public interest’. Grounds of Appeal

23. The Appellant appealed against the decision on the following grounds: Request 1

24. The ICO upheld UKRI’s refusal to disclose the emails containing the search term ‘research integrity’ on the basis that ‘ the emails forwarded by Ivan Pavlov to the MRC Research Integrity Lead inbox do not contain additional input from Dr Pavlov’. The Appellant maintains that the messages matched his request, they did not need to both match his request and ‘contain additional input’. He maintains that ‘ This unknown codicil is made up and arbitrary’. Request 2

25. UKRI stated that approximately three quarters of the 205 emails “ were clearly not related to the topic of research integrity or were not otherwise in scope”. The Appellant asserts that he did not request records ‘on the topic’ of research integrity. He states that if the records match the search criteria, they are in scope. Request 3

26. The arguments made in relation to s.41(1) could be applied to other documents UKRI has made public. The Appellant submits ‘ Currently, the UK, Spain, Germany and other nations are seeing intermittent positive tests for polio in sewage. It is possible this email UKRI won’t turn over relates to this serious public health issue. UKRI is an interested or biased party in the matter and ICO not competent to judge a possible relation. If the chain has no possible relation to polio, it can be redacted so that it is not detrimental to parties mentioned in the email or to the confider while satisfying my investigation’. UKRI’s Response

27. In its response, UKRI states: (a) Further to Request 1: a. Question 1 specifically referred to ‘correspondence’. The nature of ‘correspondence’ is such that it is between people. b. Emails which were deemed to be out of scope were where Dr Pavlov had forwarded them to a shared mailbox for storage. There were 17 email chains of this type. c. UKRI maintain that it properly withheld them but has elected to disclose the email chains with the written submissions. The Appellant has seen the body of every one of the emails already as he is either part of the chain or they have otherwise been disclosed to him as part of FOIA. d. Ground 1 falls away. There is no information which UKRI continues to hold. (b) Further to Request 2: a. Every email has been reviewed. Only 2 email chains remain in scope. b. The inclusion of the word ‘ research integrity’ in an email does not mean that it falls within scope of the request, because it may have no substantive discussion or information on the topic. (c) Further to Request 3: a. This concerns one email chain. UKRI maintain that the entire chain engages 41(1) and the public interest favours the information being withheld. Much of the chain also falls to be withheld under 40(1). b. In open submissions, UKRI are unable to go into detail as to why it is withheld. The Appellant knows it is correspondence between 1 or more people at UKRI and one or more people at Imperial concerning research integrity. Information Commissioner’s Response

28. In its response, the ICO relies on the DN and states: a. With regards to Ground 1 (originally Request 2: the request for 205 emails to be disclosed), the ICO remains content with his investigation and his decision. b. With regards to Ground 2 (originally Request 3: applicability of 41(1)), the ICO reiterates that UKRI was entitled to rely on s.41(1) for the reasons in the DN. The ICO also adds: i. The names of the individuals can also be considered confidential. ii. If information is in the public domain, it won’t possess the necessary quality of confidence. The ICO has not seen any evidence that the withheld information was in the public domain at the time of the request. It therefore possesses the necessary quality of confidence at the time of the request. Appellant’s Response

29. In it’s response, the Appellant states: (a) Further to (original) Ground 1: a. The Appellant asks the Tribunal to find the information was withheld improperly and to order the release of the group of messages. (b) Further to (original) Ground 2: a. The second part of the original request matched 325 emails. UKRI released one and withheld another under s.41(2) and 40(2). b. The other 323 were withheld because the inclusion of the word ‘research integrity’ does not meant that it falls within scope. c. Emails with the word ‘research integrity’ were exactly what the appellant’s request sought. UKRI refused to disclose 99% of the messages because it may have no substantive discussion or information on the topic. There is no reason why this should take precedence over the unambiguous direct match on search terms. d. UKRI ask the tribunal to read the messages. There is no purpose to doing so as the documents are not withheld under s.41(1) and 40(2). There is nothing preventing their release. The Appellant requests disclosure of the 323 messages. (c) Further to Ground 3: a. ‘ There are undoubtedly instances where s.41(1) and 40(2) justify withholding a document. In making this determination, the Tribunal might benefit from a brief description of my investigation at the hearing’. Legal Framework Information provided in Confidence

30. Where information is provided in confidence, the exception in regulation 41 (1) FOIA may be engaged. This states: ‘41(1) Information is exempt information if – a. it was obtained by the public authority from any other person (including another public authority), and b. the disclosure of the information to the public (otherwise than under this Act) by the public authority holding it would constitute a breach of confidence actionable by that or any other person. (2) The duty to confirm or deny does not arise if, or to the extent that, the confirmation or denial that would have to be given to comply with section 1(1)(a) would (apart from this Act) constitute an actionable breach of confidence. Personal Information

31. Personal Information may also be exempt under s.40 FOIA which states: ‘40(1) Any information to which a request for information relates is exempt information if it constitutes personal date of which the applicant is the data subject. (2) Any information to which a request for information relates is also exempt information if – (a) it constitutes personal data which does not fall within subsection (1), and (b) either the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles, or (b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. (3B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the UK GDPR (right to object to processing). (4A) The third condition is that (a) on a request under Article 15(1) of the UK GDPR (general processing: right of access by the data subject_) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16, or 26 of, or Schedule 2, 3, or 4 to, the Data Protection Act 2018 , or (b) on a request under section 45(1) (b) of that Act (law enforcement processing: right of access by the data subject) the information would be withheld in reliance on subsection (4) of that section’. The Tribunal's Role

32. By s.58 FOIA, the Tribunal’s role is to consider whether the DN is in accordance with the law or where the ICO’s decision involved exercising discretion, whether it should have exercised it differently. It is a full merits jurisdiction. The tribunal may receive evidence that was not before the ICO and may make different findings of fact from the ICO. If the Tribunal determines the DN was not in accordance with the law or that a discretion should have been exercised differently it can allow the appeal and/or substitute a different Notice that could have been served by the ICO. Unless these apply the Tribunal shall dismiss the Appeal.

33. For the purposes of determining this appeal, we have considered those documents contained within the open bundle consisting of 599 (electronic) pages, the closed bundle of 861 (electronic) pages which contained the information requested, the skeleton argument submitted on behalf of UKRI (7 (electronic) pages) and the oral submissions made by the Appellant and UKRI’s legal representatives during the course of the hearing – we do not set these out again here. We note that the ICO did not send a representative to the hearing but instead relied on their written submissions.

34. Following the Closed Hearing, a Gist was provided to the Appellant in the following terms: ‘1. The Panel was taken to Mr. Viggers’ closed witness statement. Submissions were made about the express assurances of confidentiality concerning third parties’ reporting to UKRI, including as found on UKRI’s website: https://www.ukri.org/who-we-are/contact-us/make-a-complaint/ .

2. It was confirmed that the policy/guidance documents about integrity of research (from pg. 113 Open Bundle) was before the Commissioner.

3. The Panel were taken to the withheld material in relation to Ground 3. UKRI confirmed that the withheld material related to general issues, rather than the Imperial College study of the nOPV2 vaccine.

4. The Panel explored with UKRI whether redactions may address the confidentiality/personal data concerns. UKRI submitted that it would not, due to the nature of the material.

5. The Panel asked whether UKRI’s limited enforcement/investigation role meant that a third-party report was not confidential. UKRI submitted that it was the content of the communication, the expectation of confidentiality and adverse consequences of disclosure that were relevant, not UKRI’s powers.

6. The Panel asked if the third party was contacted for their views on disclosure. UKRI indicated that they had not, but that it was unnecessary to do so in a s. 41 (1) FOIA case where the nature of the material is apparent from the withheld material itself’.

35. The Appellant made brief submissions in response. Discussion and Conclusions Scope and Question 1

36. UKRI served the documents relating to Request 1 (which were initially withheld), with its reply dated 4 June 2025.

37. In the Appellant’s reply, he asks the Tribunal to find the information was withheld improperly and to order the release of the group of messages.

38. He again reiterated in his response to Tribunal directions (dated 2 October 2025) that he would ask the Tribunal to: a. Find invalid the initial withholding and continued claim that the respondents had and still have a basis for not releasing the documents. b. Determine how many documents were initially withheld and how many were actually delivered to me. c. ‘ Respondents went to great lengths to withhold these emails and then released only messages I had already seen. Respondents made strange, quasi-philosophical claims such a that emails must by definition be between individuals. Also, at no point prior to my appeal to the Tribunal did respondents say I had already seen all of them. Why would respondents go to such efforts to hold on to emails I (ostensibly) already have? Have they actually released all the withheld messages”.

39. We noted the Open witness statement of Mr Viggers which confirms that “ there is no information which UKRI continues to withhold in relation to Search 1 and it is understood therefore that this resolves Ground 1 of the appeal”.

40. UKRI explained in their initial response on 27 August 2024 that they had not disclosed emails in which Dr Ivan Pavlov had forwarded emails (without adding more) to a shared mailbox for filing and that in so far as possible they had removed duplicate information. The very fact that Dr Pavlov is ‘forwarding’ emails, means that the email is being duplicated. There was no need to explicitly tell the Appellant that he already had the emails (he was provided with all the other emails, the fact that these were ‘forwarded’ means by logical extension he had been provided with them). As such, we accept that all the initially withheld emails have now been disclosed. We attach weight to the Witness Statement of Mr Viggers. It would be a very serious allegation to suggest that he – as the UK Research and Innovation Director of Risk and Assurance Counter Fraud Investigations, would lie about such an issue. We do not find that he has. We find all relevant documents have now been disclosed.

41. As such the appeal on Ground 1 has now become academic.

42. The Appellant invites the Tribunal to find that the initial withholding and continued claim that the respondents had and still have a basis for not releasing the documents is invalid. We refuse to consider this ground of appeal any further. The Appellant has in his possession the documents that he sought. It is a waste of the Tribunal’s time and resources to hear appeals in relation to material which is already in the possession of the Appellant. This runs counter to the overriding objective under which dealing with a care fairly and justly includes dealing with the case in ways which are proportionate to the importance of the case and anticipated costs. The overriding objective means, as Lord Phillips MR said in different context Jameel (Yousef) v Dow Jones & Co Inc [2005] QB 946 that: ‘ it is no longer the role of the court simply to provide a level playing field and to referee whatever game the parties chose to play upon it. The court is concerned to ensure that judicial and court is concerned to ensure that judicial and court resources are appropriately and proportionately used in accordance with the requirements of justice’. Question 2

43. The Appellant’s request stated: “I am a journalist. I have written a number of articles for The BMJ concerning polio. In the most recent of these, I came across documents suggesting possible research-integrity issues in an Imperial College study of a new polio vaccine, nOPV2. UKRI was among the study’s funders. I request all Ivan Pavlov’s email correspondence, from 01 January 2024 to 01 June 2024, regarding this matter, including but not limited to correspondence with staff at Imperial College and/or any party regarding the Imperial College nOPV2 paper and/or the research integrity policies and processes of Imperial College. Partially overlapping with the preceding, I request all correspondence between anyone at UKRI and anyone at Imperial College regarding research integrity from 01 January 2021 to 01 June 2024.”

44. We accept at the outset the Second Respondent’s submission that the subject matter and context of the request are material considerations when determining whether particular information falls within the scope of the request.

45. We have considered the Appellant’s submission that emails containing the words “ research integrity ” ought, by virtue of that phrasing, to be treated as within scope. However, when the request is read cumulatively and in context, its ambit is more precisely defined. The Appellant identified potential research-integrity issues arising from an Imperial College study of the nOPV2 vaccine, which UKRI had part-funded. He then sought, “ partially overlapping with the preceding ” correspondence between UKRI and Imperial College “ regarding research integrity ” within the stated period.

46. In our judgment, the Respondent was not required to treat every email in which the term “ research integrity ” appeared—irrespective of subject matter—as falling within the request. The request was expressly for correspondence regarding research integrity. It was reasonable to interpret “ regarding ” as meaning concerning research-integrity issues. The scope of the request therefore extended to correspondence substantively concerned with matters of research integrity and did not encompass communications in which the term appeared incidentally, tangentially, or in unrelated contexts.

47. We also agree with the Second Respondent’s submission that to construe the request as encompassing all documents in which the phrase appears would improperly conflate the duty under s.1 FOIA to provide recorded information with a right to the disclosure of whole documents. FOIA confers a right to information, not a general entitlement to all documents containing particular terminology.

48. As set out in the Second Respondent’s responses, some of the results identified by the search terms were in relation to studentship and grant applications because the word “research integrity” appeared without anything more. We examined a sample of the emails that had been withheld in the closed hearing and agree that this was an accurate description. We agree that these do not fall within scope for the reasons set out above. It was also explained by the second Respondent that of the remaining 50 emails, a number were duplicates. Once they were removed, two email chains fell within scope. Of what remained one email chain was provided to the Appellant, and one was withheld – to which ground 3 relates.

49. The Tribunal records that the Second Respondent does not seek to rely upon any statutory exemption in relation to the emails identified by keyword searches. Rather, it contends that, although those emails were captured by search terms apparently linked to the subject matter of the request, they are not, on closer inspection, relevant to it. The Tribunal is satisfied, on the evidence provided, that the Second Respondent conducted a reasonable and proportionate search and applied the correct relevance test to the documents retrieved. We accept that keyword searches often return ‘false positives’ and that this outcome, while perhaps counter-intuitive to a lay observer, is not unusual . The Tribunal therefore agrees that the emails in question fall outside scope and need not be disclosed on the basis of irrelevance , without recourse to any statutory exemption. Nothing in this decision turns on, or requires, the engagement of an exemption.

50. Finally, we note for completeness, the Appellant’s reference to the disclosure of 325 emails. This was the initial number of emails, but once the search was narrowed, the keyword search for “research integrity” conducted over the agreed revised period of 26/01/2024 to 26/05/2024, and limited to emails containing an @imperial.ac.uk address, yielded a total of 205 items.

51. For the reasons set out above, Ground 2 is dismissed. Question 3

52. The last ground relates to one email chain. The Tribunal examined this during the closed hearing and asked questions of the Second Respondent’s counsel.

53. We agree that the email chain engages both s.41(1) and also s.40(1). We also agree that the public interest favours the information being withheld. We explain our reasons below.

54. The information is exempt under s41(1) because: a. It was obtained by the public authority from any other person, and b. Disclosure to the public would constitute a breach of confidence actionable by that that or any other person.

55. In determining whether any disclosure would constitute an actionable breach of confidence, we have applied the three-stage test articulated in Coco v A N Clark (Engineering) Ltd . [1968] FSR 415 That authority establishes that a claimant must demonstrate: (i) that the information in question has the necessary quality of confidence; (ii) that the information was imparted in circumstances importing an obligation of confidence; and (iii) that unauthorised use or disclosure of the information has caused, or would be likely to cause, detriment to the confider.

56. We are satisfied that: a. Disclosure of the email would reveal the content of the information UKRI obtained from a third party; b. The information is more than trivial; c. We are satisfied that the email was plainly sent in confidence. The information it contains is not otherwise accessible and was not in the public domain at the time of the decision, which is the relevant point for present purposes. We agree with the ICO’s conclusion that the material can properly be regarded as private and confidential. For completeness, we note that the information could actually be treated as falling outside the scope of the request. We find that characterising the content as relating to “research integrity” may be generous, but it is not in our view incorrect. d. We are satisfied that the information was communicated in circumstances giving rise to an obligation of confidence. The email clearly concerned a confidential matter and was provided by a third party on the basis that it should not be disseminated beyond UKRI, save on an internal, need-to-know basis. UKRI relied upon its research integrity reporting policy, which states that “ all those involved in the process are required to maintain confidentiality ”. It submitted that such confidentiality is essential to safeguard the effectiveness of its reporting mechanisms and to ensure that individuals have confidence that any concerns raised will be treated in confidence. The ICO concurred with that position, as do we. e. It was submitted by UKRI that ‘ the issues raised in the correspondence are highly confidential and concern matters that would negatively affect individuals by impacting the personal lives and careers of the individuals involved, including the confider, if the information was to be disclosed’ (taken from the DN). Again, having examined the content of the email, we agree that disclosure of the withheld information would cause detriment to the confider. Public Interest

57. Section 41 of FOIA 2000 establishes an absolute exemption. However, the common law duty of confidence is qualified by an inherent public interest test. The Tribunal must therefore determine whether disclosure would be justified by an overriding public interest sufficient to displace that duty.

58. The established position is that information subject to a duty of confidence must be withheld unless the public interest in disclosure outweighs the strong public interest in maintaining confidentiality. As the ICO noted, considerable weight is traditionally afforded to duties of confidence, and only particularly compelling considerations will suffice to outweigh them. Nevertheless, the common law recognises that disclosure may be defensible where an overriding public interest exists, thereby providing a complete defence to a claim for breach of confidence. It was therefore necessary for the ICO to assess whether UKRI could realistically rely on such a defence if disclosure were made. The ICO undertook that assessment.

59. UKRI accept that research integrity is a matter of public interest and that transparency contributes to the trustworthiness of the research environment. They also acknowledge that disclosure of the emails would have enhanced transparency and supported UKRI’s accountability. However, they submit that the stronger countervailing public interest lies in maintaining confidentiality. They emphasise the importance of protecting the trust placed in them by those who provide information in confidence, and they argue that confidentiality is central to the operation of mechanisms through which research integrity concerns are raised and addressed. Disclosure, they contend, would undermine those mechanisms and could have adverse consequences for individuals involved. They further submit that confidentiality is essential to the discharge of their organisational responsibilities relating to research integrity—responsibilities reflected in the standard terms of grant funding—and that the wider research and innovation funding system depends upon that trust. On this basis, UKRI maintain that no overriding public interest has been demonstrated that could justify disclosure, and that they would lack any viable public interest defence in the event of a breach of confidence claim.

60. The ICO concluded that disclosure “ risks having a direct and clearly negative impact on the confider, an outcome which the Commissioner considers to be firmly against the public interest… a situation where individuals did not, or were unwilling to, share legitimate concerns about research integrity with UKRI for fear of sensitive information being disclosed, is an outcome that is clearly counter to the public interest”.

61. In weighing the competing public interests, we recognise that transparency and accountability carry genuine weight, particularly in matters concerning research integrity. However, the force of that interest is significantly reduced where the information was provided in confidence by a third party and where disclosure would foreseeably undermine established confidential reporting channels. Those mechanisms serve an important public purpose by enabling individuals to raise concerns without fear of external exposure. Undermining that trust would have adverse consequences not only for those individuals but for the effectiveness of UKRI’s processes more generally. On the evidence before us, we are satisfied that the public interest in maintaining the duty of confidence clearly outweighs the public interest in disclosure. Disclosure would amount to an actionable breach of confidence.

62. The consequences of eroding trust in a confidential reporting system extend beyond the particular case. Individuals may be deterred from raising concerns; internal scrutiny mechanisms may be weakened; and matters that ought to be addressed promptly and discreetly risk going unreported or being escalated externally. Such outcomes diminish organisational accountability and frustrate the public purposes those mechanisms are intended to serve. The erosion of trust therefore represents a significant detriment to the public interest.

63. Trust is itself integral to public accountability. Where individuals are assured that their information will be treated fairly and kept confidential, they are more willing to engage with reporting processes. If that trust is diminished, the flow of information necessary for effective oversight is impaired, investigations become more difficult, and the organisation’s ability to perform its public functions is correspondingly reduced. The preservation of trust is therefore an important public interest in its own right.

64. In his grounds of appeal, the Appellant submitted that “ UKRI invoked section 41(1) of FOIA to block access to one email chain. The correspondence is with a third party – like many turned over by UKRI. The same argument of detriment to confider could be applied to documents UKRI has made public. Currently, the UK, Spain, Germany and other nations are seeing intermittent positive tests for polio in sewage . It is possible this email UKRI won’t turn over relates to this serious public health issue . UKRI is an interested or biased party in the matter and ICO not competent to judge a possible relation. If the chain has no possible relation to polio, it can be redacted so that it is not detrimental to parties mentioned in the email or to the confider while satisfying my investigation ” (emphasis added).

65. In his reply, the Appellant added that “ there are undoubtedly instances where s.41(1) and 40(2) justify withholding a document. In making this determination, the Tribunal might benefit from a brief description of my investigation at the hearing .” The Appellant subsequently gave evidence and made submissions at the oral hearing. The Tribunal is grateful for the clarity and courtesy with which he advanced his case. However, having reviewed the withheld material, we conclude that the information cannot be disclosed.

66. We hope it provides reassurance to the Appellant to know that “ the withheld material [is] related to general issues, rather than the Imperial College study of the nOPV2 vaccine” (as set out in the gist).

67. We have also concluded that the material cannot be redacted in a manner that would protect the identities and interests of those involved while also serving the Appellant’s investigative purpose, as the risk of identification is too high in the specific circumstances and again due to the wider public interest relating to confidentiality protections in this particular situation – which we cannot detail here.

68. As a final comment, we add that it could be said that the material is arguably out of scope. However, the Second Respondent did not pursue that argument, and their counsel expressly confirmed that he did not intend to do so. In fairness to the Appellant, we do not rely on out-of-scope arguments. Nevertheless, in the circumstances, the public interest in disclosure is very limited.

69. In the circumstances, we conclude that the email chain should be withheld under s.41.

70. We also find s.40 is applicable, but in light of our findings above, do not address this in detail here. Signed Date: Judge Kiai 20 February 2026