Better in their words…

The judgement has now been made in the case we brought against the Information Commissioner’s Office, after it failed to require the UKHSA to release data on people who died in the period following vaccination against Covid 19.

First, I want to thank everyone who so generously contributed to the crowdfunder. You made it possible to take this case forward. Our legal team did a faultless job, and I am grateful to them too.

I am disappointed by the judgement and the reasoning behind it and I want to explain why.

This began with a simple request for a simple dataset. The UKHSA holds the vaccination register, including dates of death, because people are removed from the database when they die. I asked for the bare minimum, just three anonymised fields:

1. Age at first dose (not death)
2. Date of each vaccine dose – anonymised
3. Date of death – anonymised

I asked only for data for those aged over 20 years because younger age groups have fewer deaths per week so it might be easier to identify someone.

There would be no identifiers – With no names, no locations, no medical records, no cause of death, and no link to any identifiable information.

I was a bit vague on what I meant by age but thankfully the ICO helped clarify early on that I meant the 10 year age groups the UKHSA used in their vaccine data publications.

To protect privacy, I proposed adding or subtracting one to three days at random from each date. This is a standard anonymisation technique used for data on the living. Remember that this data was shared with the pharmaceutical companies from the outset for their safety reporting.

The UKHSA did release a small, low-resolution dataset. It did not allow meaningful analysis.

However, this was about much more than the data itself. It was a point of principle. UKHSA seem to be saying that they think the public would not be capable of analysing and understanding the information and therefore need protecting from it. This seems inconsistent with the spirit of FOI legislation.

The UKHSA first rejected my request on the grounds that anonymising the death and vaccination dates would amount to “creating new data”. The ICO initially disagreed and cited case law that supported my position. So I hoped that would resolve the matter. I was naively optimistic that this would be the end of the matter. Then, after receiving a submission from the UKHSA, the ICO did a 180 turn and said the data could not be released saying that release would be likely to “endanger the mental health of bereaved families” and could “fuel misinformation.”

At that point, we had no choice but to take the matter to the Tribunal.

The UKHSA argued that “there is a real and present risk that… data will be presented out of context… by anti-vaccine proponents…which would be likely to undermine public adherence in current and future COVID-19 vaccination programs.”

They also involved three additional bodies: the MHRA, NHS England, and the ONS. NHS England helped to provide data on vaccinations and the death data to UKHSA but the ONS and the MHRA could not claim to be responsible for this data. ONS confidentiality law was cited, even though the UKHSA acknowledged that it did not receive any deaths data from the ONS, and that the ONS confidentiality law anyway does not apply to UKHSA in an FOI context. This law makes it a criminal offence for ONS (or its staff) to disclose information that could identify a person from official statistics, including death data.

What happened next felt odd.

As often happens in FOI cases, some of the hearing was behind closed doors. In this case the tribunal heard submissions about the risk that deceased people could be reidentified in private which was pivotal to their decision. This is allowed under the FOIA closed material rule – so that the judge can see data and understand why there might be issues with disclosure. Our lawyers were not allowed to hear what was said in that hearing, let alone put another view. This raises a difficult question: how can evidence be tested if one side is not permitted to hear it?

The second odd thing was the person who was explaining this to the judge was Vahe Nafilyan from the ONS. This was a case where we were accusing the ICO of failing to force UKHSA to release the data they held. Yet, here was someone I had come across before.

I attended some of the judicial review proceedings around the decision to recommend vaccinating primary school children. As part of that case evidence was presented of the deaths of teenage boys. The ONS admitted to the court that there had been a statistically significant rise in deaths in 2021. In that case the court refused to order the release of anonymised data on the time from vaccination to death in teenage boys in 2021.

Similarly, in this more recent case the Information Tribunal has now refused to order the release of anonymised data about vaccination dates and death dates in older age groups again – because of pushback from Nafilyan and his colleagues. As I said, Nafilyan works for the ONS yet here he was in a Tribunal case regarding UKHSA data.

Nafilyan persuaded the judge that the anonymisation we were suggesting would be inadequate. They had gone through local newspaper reports and found cases of people who had died who, they said, could have been triangulated in the anonymised data set that I had requested. Apparently his evidence showed the judge how one such case could be matched to an entry in the database. I do not know how he did this unless he was using single year of age groups instead of ten year groupings. Because the discussion was secret we cannot know what was said.

If you know someone died but did not know if they were vaccinated then you would not be able to find them because there were around 50-60 deaths each week of people in their 20s and more in older age groups.

For the sake of argument, if you could identify someone in the data because you knew their date of death and knew they were vaccinated then you would learn nothing from it that you did not already know.

It is also worth noting that the ONS published data each week on the age group and region of covid deaths down to individuals.

Ultimately, the judge based his conclusion on evidence that we were not permitted to see, including a ‘successful identification’ on the basis of a reidentification methodology that we were not allowed to see or challenge.

And although it was not discussed in court, I note that countries such as the Czech Republic have released more granular anonymised data without causing harm or misuse. I mention this only to show that anonymised release is technically achievable, not to imply that UK law must follow those jurisdictions.

The Tribunal ultimately rejected the argument about misinformation as a legal ground. The judgement stated that, and I quote, “to have been able to reach a conclusion” on misinformation “we would have needed specific evidence,” and that evidence “was not available.”

However, the Tribunal upheld the refusal on two other grounds.

First, that disclosure would be likely to endanger the mental health of even a small number of people. The judge wrote — and I quote

“we accept the suggestion that there is a real risk that some people would be contacted about a deceased relative once the data set was published. We conclude that for some (but not for others) being approached about this data or finding out about it, would be distressing…”. To reach the relevant legal threshold, the Tribunal had to be satisfied that this kind of distress would be likely to manifest in a serious psychological condition such as PTSD. On the basis of an unevidenced assertion by Nafilyan that it would, the Tribunal accepted that this risk had been established.

The Tribunal emphasised that Section 38 concerns “any person” – i.e. a single person’s potential adverse psychological reaction to an anonymised spreadsheet was used to block release.

Second, the Tribunal accepted an argument that producing the data set would involve too much time and cost. The UKHSA argued that responding to my request would require creating a new dataset that would incur significant cost. Yet they had already generated the same underlying dataset in order to share it with pharmaceutical companies, and again to demonstrate identification to the judge in the closed session. So I am left with a question: if the dataset already existed for those purposes, why was it said that it could not be provided under FOI?

In addition, the UKHSA claimed it would take 76 years to go through each line of the database doing a 10 minute check to ensure that no individuals could be identified by triangulating with press reports or social media posts. The judge agreed that the time and cost of producing the dataset would be too much and so allowed that argument to gold-plate the mental health argument. .

So that is the outcome. My legal advice is that there is no realistic cost-efficient prospect of obtaining this data through further appeals.

I want to thank you again for your support. We brought the case in good faith, we followed the process, and we reached the end of this particular legal road. I will leave the facts with you, and each of us can reflect on what they mean for transparency, evidence, and public trust.