261019 – ICO Complaint re MPS ‘learning’ FoIA

The background to this complaint can be found here, the request being made via the WhatDoTheyKnow website here.

19/10/2026 submission to the ICO:
Complaint to the Information Commissioner

MPS refusal to confirm or deny organisational-learning records — FOIA section 40(5A)/(5B)

Prepared 19 October 2026
Authority:                   The Metropolitan Police Service (MPS)
MPS reference:            01/FOI/26/053728/G

Contents

Request and outcome sought


I ask the Information Commissioner to determine whether the Metropolitan Police Service (MPS) correctly relied upon section 40(5A) and section 40(5B) FOIA to neither confirm nor deny whether it holds seven categories of information arising from complaint PC/5233/26. In particular, I ask that the Commissioner examine the distinction between information constituting my own personal data, third-party personal data, and non-personal organisational information about complaint handling and the communication of learning.

The remedy sought is a finding on whether the blanket neither-confirm-nor-deny response was lawful and, if not, an order requiring a fresh response appropriately distinguishing categories, considering confirmation/denial, and dealing with disclosure or any further exemptions according to law.

I do not ask the Commissioner in this FOIA complaint to decide whether the NPCC implemented learning or whether officers committed misconduct.

Reference information

Public authorityMetropolitan Police Service
Underlying complaintPC/5233/26; NPCC CRU communication dated 25 June 2024
FOIA request01/FOI/26/053728/G — 7 July 2026
Original refusal11 August 2026 — s40(5A)/(5B) NCND
Internal review sought22 August 2026 (acknowledged 24 August)
Internal review reference01/FOI/26/054747/J
Review outcome19 September 2026 — NCND upheld, signed Ruth Binfor
Public WDTK requesthttps://www.whatdotheyknow.com/request/mps_complaint_reference_pc523326
Published complaint outcomehttps://carcrime.uk/260619-npcc-complaint-outcome-report/

Chronology

  • 25 June 2024 — NPCC CRU communication referring to me, later subject of the complaint.
  • 19 June 2026 — MPS outcome in PC/5233/26, recording “service not acceptable” for three of four heads and organisational learning.
  • 7 July 2026 — I requested MPS–NPCC correspondence, explanations, learning notifications, recipients, responses, written-account rationale and policy/guidance. I expressly excluded my own personal data and unnecessary identifiers.
  • 11 August 2026 — MPS issued blanket neither-confirm-nor-deny refusal under s40(5A)/(5B).
  • 22 August 2026 — I requested internal review with a category-by-category challenge (MPS acknowledgement dated 24 August).
  • 19 September 2026 — MPS internal review upheld blanket NCND.
  • Subsequent events — I sought answers from NPCC after the complaint outcome, but report that substantive matters remain unanswered. This raises questions about whether learning was communicated or acted upon, but does not itself prove either possibility.
  • By October 2026 — I placed the complaint outcome online, making the underlying complaint and its recorded findings accessible.

Information originally requested

  1. MPS–NPCC communications concerning PC/5233/26.
  2. Written NPCC explanations, comments, responses or representations to the MPS.
  3. Any learning, recommendation, reflection, guidance, advice or outcome communication sent by MPS to NPCC.
  4. Records identifying the NPCC recipients of any learning or outcome communication.
  5. Records showing NPCC acknowledgement, rejection, response or action in respect of learning.
  6. Reasons why formal written accounts were not necessary/proportionate.
  7. Policy, procedure or guidance relied upon for proportionate complaint handling otherwise than by investigation.

The request explicitly excluded private contact details, home addresses, personal telephone numbers, signatures and unrelated personal data; it also asked that material comprising my own personal data be excluded and identified for possible subject access.

Grounds of concern about the response

5.1 Confusion between existence and contents

The existence of correspondence or a learning communication is not necessarily equivalent to disclosure of every name or personal detail that a document might contain.

The review relies heavily on the potential presence of names, but gives limited category-specific explanation why the fact of holding each type of record must itself be protected.

5.2 Requester’s own information expressly excluded


I excluded my own personal data. The review said that a case-specific request cannot be disassociated from my complaint. I ask the Commissioner to test whether that position lawfully answers the distinct requests for institutional actions, records of learning delivery and relevant policy.

5.3 Third-party data not analysed by function


The review refers generally to officers and NPCC staff, without examining whether disclosure of a bare existence confirmation would identify anyone not already known, whether work-related identity has different reasonable expectations, or whether a less sweeping response was possible.

5.4 Publicly acknowledged complaint and findings


The MPS has already issued the complaint outcome, recording three heads of unacceptable service and learning. I have since published that outcome. Publication does not waive third-party protections, but matters already formally acknowledged bear upon what new personal data a confirmation would reveal.

5.5 Absence of category-by-category reasoning


The refusal applies to all seven categories, including general policy/guidance. The review says “some” information would meet the definition of personal data, and later invites a fresh generic policy request. It does not explain whether the original policy element could be separated or confirmed.

5.6 Incomplete consideration of redaction and alternatives


The request offered redaction, segregation and pursuit of own personal data under SAR. The review gives insufficient explanation why partial confirmation, anonymised disclosure, information already public or separate treatment of organisational records is unavailable.

5.7 Public interest and proportionality in third-party analysis


The case raises national policing governance and whether documented learning was communicated following findings of unacceptable service. While s40(5A) is absolute for own personal data, any third-party confirmation/denial analysis must address the applicable data protection test.

The review acknowledges legitimate transparency interests but does not identify concrete incremental harm from category-specific confirmation.

The unanswered learning question: contextual significance

After the outcome I approached the NPCC again seeking responses to matters central to my upheld complaint heads. No satisfactory substantive response has been received, as I understand matters. There are at least three possible explanations: MPS did not separately transmit learning; MPS transmitted it but NPCC did not act; or learning was transmitted without meaningful action or follow-up requirements.

I have not established which, and the MPS NCND prevents an informed understanding. I emphasise this as context showing the importance of the requested information, not as proof of improper intent or as a separate issue on which the ICO must determine police complaint merits.

Questions invited for the Commissioner

  • Whether s40(5A), s40(5B), or both lawfully apply to each of seven categories; and what personal data the act of confirmation/denial would itself reveal.
  • What is materially new or private about confirming whether a learning notice was sent, considering the published MPS complaint outcome.
  • Whether the MPS considered information that could be confirmed, denied or disclosed separately without identifying individuals or exposing protected personal data.
  • Whether the category covering policy/procedure/guidance can properly attract blanket NCND; whether generic materials used for the specific complaint can be distinguished.
  • Whether the original exclusion of my own personal data received legally adequate consideration.
  • Whether reliance on possible names in documents substitutes for an analysis of the effect of confirmation/denial.

Scope boundaries and other proceedings

This is a FOIA complaint about MPS information-rights handling, separate from:

(a) the ongoing IOPC review of complaint PC/5233/26;

(b) any subsequent MPS complaint concerning post-outcome handling;

(c) concerns raised directly to the NPCC; and

(d) a separate MPS FOIA request of 19 September 2026 (01/FOI/26/055234/X) seeking the source of one learning standard, currently subject to a section 31 public-interest extension.

These proceedings are mentioned solely to prevent confusion and demonstrate context.

Enclosures and submission checklist

at which the following correspondence can be located: