Alexander Kelly v The Information Commissioner

1. The appeal is dismissed.

2. Decision notice IC-429851-W3D4 is upheld. REASONS Background

3. The appellant made a request to the General Dental Council (the GDC) on 30 December 2024 for information comprising complaints data relating to a specific dental practice. A key part of the appellant’s request was for information about ‘complaints lodged with the Dental Complaints Service (DCS) about Bute Dental Care Limited or any registered dental professionals working there.’ The appellant requested the information for the past ten years, i.e. between 30 December 2014 and 30 December 2024. The full request is set out in decision notice IC-429851-W3D4 dated 2 October 2025 and is not repeated here.

4. On 25 March 2025, the GDC refused the request on the basis that it did not hold some of the information requested and would neither confirm nor deny whether other information was held. This was because information relating to complaints about individual registrants was the personal information of those registrants. The GDC relied on section 40(2), (3A)(a) and (5B)(a)(i) of FOIA.

5. The appellant requested an internal review of the response on 25 March 2025. On 17 April 2025 the GDC completed its review. It confirmed its original response.

6. The appellant complained to the respondent, the Information Commissioner (the Commissioner) on 21 April 2025. This resulted in the Commissioner issuing decision notice IC-380782-N0C4 on 3 July 20205. The Commissioner determined that the GDC was not entitled to rely on section 40(5B) of FOIA. The Commissioner was satisfied that the GDC did not hold some of the requested information. The Commissioner found that the GDC had breached section 10 of FOIA because it failed to provide its response within 20 working days and found that the GDC did not breach section 16 of FOIA.

7. The Commissioner required the GDC within 30 calendar days to: Confirm or deny whether it holds any complaints about the staff of the practice specified in the request. If any information is held, the public authority must either disclose it or issue an appropriate refusal notice.

8. The GDC issued a fresh response to the appellant on 1 August 2025. The GDC explained that historically, the practice name was not a compulsory field required from complainants. The GDC stated that to comply with the appellant’s request would require a manual review of all complaints within the scope of the request between 30 December 2014 and 30 December 2024. It advised that between 2022 and 2024 the DCS dealt with an average of 750 cases a year. The GDC stated that the cost of compliance would exceed the appropriate limit of £450 or 18 hours work and relied on section 12 of the Freedom of Information Act 2000 (FOIA). The GDC also stated that while the data held in relation to the practice name was not complete, they had carried out a search to identify any complaints relating to Bute Dental Care and did not identity any where this was the registrant’s place of work.

9. The appellant requested an internal review on 1 August 2025. He argued that he had made a complaint to the DCS referencing the name of the dental practice and so some information must be held. He also argued that the GDC’s search was too narrow and did not include other relevant data fields. His request was acknowledged on 6 August 2025 and the GDC confirmed that it would respond within 20 working days.

10. On 7 August 2025 the appellant made a complaint to the Commissioner regarding enforcement of the original decision notice. The Commissioner clarified that the GDC had complied with the decision notice and that any new complaint would have to be made under section 50 of FOIA.

11. On 20 August 2025 the GDC completed its internal review. It explained that it had searched for ‘cases’ where the practice was recorded in the ‘organisation’ field of the complaint form. It explained why the appellant’s enquiry had not generated a case and therefore why the search did not identify the concern the appellant had raised. The GDC explained that to assist the appellant, it had carried out a further search and had identified four entries where a DCS form had been completed identifying Bute Dental Care. It was noted that these were webforms that did not result in DCS cases and so were outside the scope of the appellant’s initial request. The GDC advised that it did not hold any information which would allow it to identify information within the scope of the appellant’s request.

12. In relation to its obligation under section 16, the GDC stated that it had conducted searches and provided information outside of the scope of the initial request; that the only way of reducing the time it would take to undertake a manual review would be to limit the timeframe of the request; and that reducing the timescale would be likely to engage the personal data exemption because it would relate to a much smaller number of dental professionals.

13. The GDC provided more information about the number of cases opened between 2015 and 2024 and therefore the time it would take to review those records. In that period 6,655 cases were opened, which at 5 to 10 minutes per record, it would take over 554 hours to review them.

14. On 10 September 2025 the appellant complained to the Commissioner. The Commissioner responded to the complaint in decision notice IC-429851-W3D4 on 2 October 2025. The respondent’s decision

15. The Commissioner’s reasons for his decision made on 2 October 2025 can be summarised as follows: (i) A public authority can rely on section 12(1) of FOIA where the cost of even confirming or denying it holds the requested information would exceed the appropriate limit. (ii) The Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (the Regulations) provide that the appropriate limit for the public authority is 18 hours of work or £450. The Regulations also provide that in applying section 12 , the public authority can only take into account certain specified costs. (iii) A public authority must provide a sensible and reasonable estimate to demonstrate why the cost of compliance would exceed the appropriate limit and it is usually expected that this will be based on a sampling exercise. (iv) Based on the GDC’s explanation of how it deals with enquiries received, the scope of the request extends to all the information the GDC holds about the dental practice and not solely information held on its Customer Relationship Management (CRM) system. (v) The GDC’s regulatory role means that it holds information about individual dental professionals and not dental practices. However, the GDC does hold information about dental practices because ‘practice name’ is a field in the online form. It is not information routinely requested and it is not a mandatory field in the online form. The result is that the GDC sometimes holds additional information about the practice which employs an individual dentist about who a complaint has been made. (vi) Section 12(2) cannot apply because information within the scope of the request has been identified and disclosed at the review stage. (vii) A manual review would be required to determine whether any further information within the scope of the request is held. The time estimate only includes a manual review of the CRM and not other records held as identified by the appellant and so if all those records were included, the estimate would be significantly increased. (viii) Even if the GDC’s lower estimate of 5 minutes per case were halved, it would still substantially exceed the appropriate limit based on the narrow search of CRM only. (ix) Section 12(1) was correctly applied. Although the appellant has raised genuine public interest concerns, the application of section 12 is not subject to a public interest test. (x) The GDC has complied with its obligation under section 16. Its advice being that the only way of reducing the time taken to comply with the request would be to reduce the timeframe the request covered. (xi) The GDC failed to comply with its obligation to confirm or deny that it held information within scope of the request and breached sections 1 and 10 of FOIA. No further steps are required. The appellant’s case

16. The appellant’s case is set out in his detailed skeleton argument, which he relied on at the hearing. The essence of his case is that the Commissioner’s reliance on the GDC’s estimate without the GDC having undertaken a sampling exercise and without having provided evidence that the estimate was based on the quickest possible method is unsustainable. The Commissioner’s response

17. The Commissioner provided a detailed response. He contends that the appellant was provided with an adequate explanation about the limitations on the GDC’s ability to make the required searches, in particular why a manual search would be necessary.

18. In respect of the appellant’s argument that section 12 cannot be relied on to excuse any inefficiency, the Commissioner submitted that section 12 applies regardless of whether a public authority employs good practice in its records management or not, relying on Cruelty Free International v IC [2017] UKUT 318 (AAC) .

19. The Commissioner notes that section 40 of FOIA is outside the scope of the appeal because it was not considered in the decision notice.

20. The Commissioner submitted that the appellant had made no challenge to the estimated time of the manual searches that would be required and the Commissioner therefore maintains that the estimate is sensible and supported by cogent evidence. The hearing

21. The Commissioner did not appear and was not represented. We were satisfied that the respondent was notified of the time and date of the hearing and chose not to attend. We considered that it was possible to determine the issues in the appeal in the absence of the Commissioner. We had the benefit of the Commissioner’s detailed response.

22. The appellant relied on his skeleton argument and answered questions from the panel about the scope of his request. He explained that while he had initially argued that the GDC’s search was too narrow, following the Commissioner’s decision that the scope of his request was wider than had been interpreted by the GDC, he was willing to narrow the scope of his request and that he did not expect paper records to be searched, only information which is readily available. i.e. electronic records. The law

23. Section 1 of FOIA provides that a person requesting information has the right to be informed whether the public authority holds the information (section 1(1)(a)), and if so, to have that information communicated to them (section 1(1)(b)).

24. Section 12 of FOIA provides: Exemption where cost of compliance exceeds appropriate limit. (1) Section 1(1) does not oblige a public authority to comply with a request for information if the authority estimates that the cost of complying with the request would exceed the appropriate limit. (2) Subsection (1) does not exempt the public authority from its obligation to comply with paragraph (a) of section 1(1) unless the estimated cost of complying with that paragraph alone would exceed the appropriate limit. (3) In subsections (1) and (2) ’ the appropriate limit’ means such amount as may be prescribed, and different amounts may be prescribed in relation to different cases. (4) The Minister for the Cabinet Office may by regulations provide that, in such circumstances as may be prescribed, where two or more requests for information are made to a public authority— (a) by one person, or (b) by different persons who appear to the public authority to be acting in concert or in pursuance of a campaign, the estimated cost of complying with any of the requests is to be taken to be the estimated total cost of complying with all of them. (5) The Minister for the Cabinet Office may by regulations make provision for the purposes of this section as to the costs to be estimated and as to the manner in which they are to be estimated.

25. Regulation 3 of the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (the Regulations) provides that the appropriate limit for any public authority not listed in Part 1 of Schedule 1 to FOIA is £450. At an hourly rate of £25 (regulation 4(4)) this equates to 18 hours work.

26. Regulation 4(3) sets out the costs which can be taken into account when complying with section 1(1) of FOIA for the purposes of the appropriate limit. They are: (a) determining whether it holds the information, (b) locating the information, or a document which may contain the information, (c) retrieving the information, or a document which may contain the information, and (d) extracting the information from a document containing it. Findings and reasons

27. The issue for determination in this appeal is whether the Commissioner’s decision to uphold the GDC’s application of section 12(1) of FOIA was correct. Section 40 of FOIA was not relied on by the GDC and consideration of section 40 did not form part of the Commissioner’s decision notice challenged in this appeal. Section 40 is therefore not within the scope of this appeal.

28. Section 12(1) , if it applies, it is not subject to a public interest balance. We recognise that there is significant and legitimate public interest underlying the reasons for the appellant’s request; however, it is simply not material to the issue we must determine in this appeal.

29. The appellant complains that the GDC failed to carry out a sampling exercise to support its estimate that reviewing records to comply with his request would take over 554 hours. We recognise that the Commissioner’s guidance says that such an exercise would normally be expected. It is not however a requirement. In our view the GDC has considered this request in some depth, particularly following the Commissioner’s first decision. We find that it is more likely than not that because of the GDC’s consideration, it was able to reach a realistic estimate of the time it would take to review the information. We find that we can place weight on that estimate. The appellant has not pointed us to anything which would suggest that the GDC’s estimate is unreasonable or otherwise wrong. Although he has now said that the request should be limited to just the CRM, we accept the reasons given which demonstrate why this would not be effective and would not identify all information within scope of the request.

30. Given the nature of the review required, we find that the GDC’s estimate that it would take 5 to 10 minutes per case is not unreasonable. The Commissioner considered that even taking the lower estimate and assuming that the review was in fact twice as efficient, i.e. taking only 2.5 minutes per case, the time would still far exceed the appropriate limit. Limiting the request to two years from December 2022 to December 2024 would significantly reduce the time required. Even so, the DSC opened an average of 750 cases per year during that period. Using the lower GDC estimate of 5 minutes per case, that would amount to 125 hours. Assuming that it would only take 2.5 minutes per case, that still amounts to over 62 hours. This is still nearly three and a half times the appropriate limit. We do not accept that a time of less than 2.5 minutes per record is likely to be realistic or reasonable.

31. For these reasons, we find that section 12(1) is engaged and that the Commissioner was correct to confirm the GDC’s reliance on section 12(1) of FOIA.

32. In respect of section 16, we find that the GDC provided a detailed explanation of the difficulties in complying with the appellant’s request. The GDC carried out additional searches and disclosed some information that was not within the scope of the appellant’s original request. In addition, the GDC identified how the appellant could narrow the scope of his request and identified potential issues that might arise if he did so. We find that the Commissioner was correct to find that the GDC had complied with its obligations under section 16 of FOIA.

33. It follows therefore that the Commissioner’s decision is upheld and the appellant’s appeal is dismissed. Signed J K Swaney Date 6 March 2026 Judge J K Swaney Judge of the First-tier Tribunal