Youssef v Information Commissioner [2026] UKFTT 880 (GRC) (16 June 2026)

Executive summary

The First-tier Tribunal dismissed Shiar Youssef’s appeal against the Information Commissioner’s decision upholding the Home Office’s use of FOIA section 40(5B) to give a neither-confirm-nor-deny response. The request asked whether the Home Office had considered withdrawing or revoking Asma Al-Assad’s UK citizenship; the Tribunal treated the issue as whether confirming or denying the existence of any such information would unlawfully disclose personal data under UK GDPR Article 6(1)(f).

Key points

• Appellant: Shiar Youssef; respondent: Information Commissioner; underlying public authority: Home Office.
• Request concerned whether the Home Office had considered revoking/withdrawing Asma Al-Assad’s UK citizenship after the Assad regime fell in December 2024.
• Home Office gave an NCND response under FOIA section 40(5B); the Commissioner upheld that position.
• Tribunal dismissed the appeal, agreeing that confirming or denying would disclose personal data about a living identifiable person and would contravene UK GDPR data protection principles.
• The appellant relied on public interest, Asma Al-Assad’s public profile, sanctions status, and media/political scrutiny; the Tribunal nonetheless accepted the privacy balancing under Article 6(1)(f).
• The decision links FOIA disclosure limits with sanctions-adjacent sensitive personal status, but it does not decide any sanctions or citizenship issue on the merits.

Why it matters

The case shows that even where a subject is publicly associated with sanctions, war-crimes allegations, or politically salient citizenship questions, the government may still lawfully refuse to confirm whether it holds relevant records. For sanctions and national-security audiences, it underscores that privacy/data-protection constraints can shield the existence of official decision-making from disclosure.

Implications

Compliance teams and litigators should expect NCND to remain defensible where the very fact of holding information would reveal personal data about an identifiable living individual, even in high-profile geopolitical cases. Challenge strategy will need to attack the Article 6(1)(f) balancing and the asserted public interest with concrete evidence, because generalized transparency arguments about government action were not enough here.