The request was for the Tavistock and Portman NHS Trust (henceforth referred to as ‘The Trust’) to confirm that it held this information, and for this information to be provided to the requestor.

The Trust confirmed that it held the information.

The Trust stated that it was withholding the audit report in its entirety due to the nature and level of personal details contained within it and had engaged exemption 40(2) of FOIA – information which constitutes the personal data of others, where it would not be permitted under the Data Protection Act 2018.

The Trust cited the fact that the sample group of patients within scope of the audit was small, thus increasing the likelihood of some or all personal characteristics and circumstances of individuals being recognizable by the patients themselves and/or others. The Trust were of the view that redacting or masking of these characteristics and details would not ensure the patients right to confidentiality. Evidence was provided in terms of the number of patients reviewed in the audit.

The Trust were of the opinion that these small numbers rendered the identification of patients highly likely by others who would have heard/read about them, and that such a disclosure was likely to cause significant distress and anguish to this group of patients, should they recognize themselves during, what would have been, a stressful and vulnerable period in their lives.

The Trust also stated that anecdotal evidence indicated that cases of patients who detransitioned, being relatively few in number, tend to attract attention and that these details are often spread by word of mouth and some media outlets.

The Trust conducted a Public Interest test, to weigh up the prejudice (legal definition) of the harm that would be caused by releasing the report, against the public interest.

Arguments identified In favour of disclosing the audit were:

a.         The recent publication of the Cass Review had attracted worldwide attention, and a public release of an audit to which it refers, on para 15.55 on p.189 would increase the public’s awareness of gender de-transition issues experienced by patients.

b.         There is always some legitimate public interest in the disclosure of any information held by public authorities, and this helps to promote transparency and accountability.

c.         The release of factual experiences of detransitioners’ reviewed by two experienced gender Specialists and Consultant Psychiatrists, would provide the public with new or additional information and a new dimension to the data already publicly available.

The arguments in favour of withholding the audit were that the Trust considered all of the data disclosed in the audit to be personal data belonging to third parties, and therefore exempt from disclosure. The Trust were of the view that the report had been written in such a way that, even if redacted, for low numbers, and/or personal experiences/circumstances the facts mentioned could lead to the identification of patients whose records had been referenced, particularly when combined with other gender information that is already in the public domain. It stated that redaction of these details would thereby render the remaining text as meaningless.

The Trust then went on to state:

a)         In recent years, a lot of information about GIDS and the adult GIC service had been released into the public domain, via a high number of FOI requests some of which has led to headlines and publication via the media. Given that the Cass Review has received intense world-wide publicity, the Trust therefore considered it reasonable to anticipate that if released, this audit would receive a similar level media coverage, but would be misunderstood by the public at large, as an authoritative and representative audit, something which it has failed to achieve. The risk of misleading the public by its release was therefore very high.

b)         All Tavistock and Portman NHS Foundation Trust patients had been assured that their records would be treated in the ‘strictest of confidence’ and have any reasonable expectations that their details would not be placed into the public domain, albeit anonymised and that they would be used, only with their permission, for very limited purposes.

c)         Whilst the audit had been conducted by Trust staff, it was neither commissioned nor approved for any purposes by the Trust, mainly due to the small cohort group sizes. Whilst this alone did not exempt the audit from release, it was highly likely that any release would be misleading and misinterpreted by the public at large as a Trust endorsed audit, whereas the reality was that it was not commissioned, nor approved nor endorsed by the Trust.

d)         In addition, when reviewed against the mental illness/autism prevalence cited in the small sample group, there was a significant risk that it would be person identifiable, should it be released into the public domain. As stated above, this would, (most particularly in view of the world-wide reactions to the Cass Review), trigger unwanted publicity and cause distress and/or harm to this sample group of service users, leading to the identification of those whose records had been referenced, and rendering them recognizable by friends, family, or other interested or well informed parties.

e)         The audit quoted low percentages of regret from small sample groups meaning that individuals who regretted their transition could be recognized by others from their quoted characteristics, experiences, and dates of audit.

f)          a determined individual with other knowledge of gender transition matters may be able to triangulate the specific details within the audit with other data already in the public domain, or data already known to them to identify the individuals involved, via the given personal data.

g)         Guidance provided by the Information Commissioner’s Offices noted that any consideration of data release needs to take into account that disclosure under FOIA involves disclosure to the world at large, ie into the public domain.

Having weighed up the balance of public interest in releasing or withholding the requested audit report, the Trust concluded that, on balance, the public interest in withholding the audit outweighs the public interest of its release.

The Trust therefore withheld the audit based on its engagement of exemption set out in section 40(2) of FOIA – information which constitutes the personal data of others, where it would not be permitted under the Data Protection Act 2018 and the outcome of the public interest test.

Anonymisation

The requestor believed that the Trusts statements on anonymisation had been inconsistent, as the Trust had stated that redaction of details would render the remaining text meaningless but had also stated that redaction would permit individuals to be identified. The requester argued that the Trust had already disclosed meaningful information about the audit in its response, and therefore it was possible to disclose meaningful data without compromising patient identity. Furthermore, the requestor claimed that under FOI it was not for the Trust to judge the meaning of information it releases. The requestor challenged the Trust’s view that the data was personal data, claiming that once anonymised it ceased to be personal data under GDPR, and therefore could be processed lawfully.

Public Interest test

The requestor questioned the use of a public interest test, stating that s.40(2) is not subject to a public interest test if disclosure would not be permitted under the 2018 Data Protection Act.

The requestor went on to state that regardless of the necessity of the test, The Trust did not describe the public interest in disclosure adequately. The requestor claimed that the key point was that disclosure would tend towards the safe care of the Trust’s patients, which was legitimately a matter of public interest, as evidenced by the frequent references to detransitioned patients in the Cass Review.

Relevance of lack of Trust authorisation of the audit

The requestor questioned the relevance of the statements by the Trust that the audit “was not commissioned, nor approved nor endorsed by the Trust” and “would be used, only with their [ie patients’] permission, for very limited purposes”. The requestor was of the view that as the audit was completed by Trust employees during the course of the working day, and using tools and data provided by the Trust, it was the Trust’s product.

Misinterpretation

The requestor challenged the relevance of the Trust’s argument that the data was open to misinterpretation by members of the public, stating that this was ‘not a consideration that FOIA is concerned with’.

The requestor contested the Trust’s view that the audit, if disclosed, would be subject to the same “intense world-wide publicity” as the final Cass report, describing it as ‘obviously …an overstatement’.

The audit consists of a report of the personal characteristics, conditions and experiences, of a small group of patients who have detransitioned. Disclosing these details could lead to the identification of patients, either directly or indirectly, though deduction by those who know (of) them, and a piecing together of random facts that are freely available within the public domain by determined individuals.  As such it is not possible to anonymise this data, and exemption 40(2) does apply.

If these details were redacted, then this would remove the substance of the report. The Trust has shared in its response summary data of the number of patients included in the audit in different cohorts. The Trust is not able to disclose any further data from the report for the reasons above.

Use of Public Interest Test

As the requester has stated, a Public Interest Test was not necessary as Exemption 40(2) applies.   The Trust actually conducted a Balancing Test, mistakenly referred to, in its response, as a Public Interest Test.  The Balancing Test weighed up whether the legitimate interests served by disclosure outweigh the interests or fundamental rights and freedoms of the data subject/s which require the protection of personal data. Part three: The first condition – would disclosure contravene the data protection principles? | ICO

Based on telephone advice received from the ICO by the reviewer, a Balancing Test was not necessary in this case.

Relevance of lack of Trust authorisation of the audit and the potential for Misinterpretation

The audit report was not written with full compliance with established norms for anonymisation of data subjects, and revealed patients’ characteristics, conditions, and experiences.

As soon as the audit was brought to the Trust’s attention it was immediately identified to contain too much patient identifiable information, and that the cohort size was too small to mask individuals and draw generic conclusions.

The lack of authorisation on these grounds and potential for misinterpretation were referred to in arguments against disclosure in the Balancing Test (misnamed as Public Interest test). Whilst this test was actually not necessary, the fact that the audit was not authorised on these grounds highlights that it contains patient identifiable data, and therefore exempt from disclosure under Section 40(2) of the Freedom of Information Act.   The potential for misinterpretation is not the core reason for withholding the audit in this case. However, it does indicate the Trust’s broader concerns regarding the risk of sharing the data, beyond the already stated concerns regarding breaching confidentiality and the distress it will cause patients.