The ICO reviewed DHSC's handling of a Freedom of Information request for details about the decision to appoint NHS England to lead the North East Ambulance Service review. DHSC had withheld certain information claiming legal professional privilege under section 42(1) FOIA, later adding the personal data exemption under section 40(1). The Commissioner determined that DHSC has provided all non-exempt information in its possession and that while the legal privilege exemption under section 42(1) was not engaged, the personal data exemption under section 40(1) is properly applied to protect the withheld information.

No compliance action is required from DHSC as the Commissioner does not require further steps. For public authorities handling similar FOIA requests, this decision reinforces that personal data exemptions under section 40(1) must be properly considered when withholding information, and that mere claims of legal privilege without substantive privilege grounds will not suffice. Government bodies should ensure their exemption claims are properly documented and that all non-exempt information is released.