The right to access other people's data in a governmental record context comes from FoI as you say but the TNA have clearly cited the "breach of confidence" exception as their concern. This is broader than (but includes) medical records and data that would otherwise have been in the the scope of GDPR were the data subject still alive. The obligation of confidence could still remain because it could relate to another party.
I'm not sure how familiar you are with the legal concept of confidence and in no way do I wish to sound patronising, but I do think it is worth exploring, if only because someone at TNA has decided that the phrase breach of confidence sounds appropriate.
The three traditional requirements of the cause of action for breach of confidence were identified by Mr Justice Megarry in Coco v A N Clark (Engineers) Ltd (1968) in the following terms:
"In my judgment, three elements are normally required if, apart from contract, a case of breach of confidence is to succeed. First, the information itself, in the words of Lord Greene, Master of the Rolls in the Saltman case, must "have the necessary quality of confidence about it." Secondly, that information must have been imparted in circumstances importing an obligation of confidence. Thirdly, there must be an unauthorised use of that information to the detriment of the party communicating it".
Let's just consider what is likely to be found in a (deceased) serviceman's records: his date and place of birth; probably his next of kin details, his personal number, details of his marriage and any children, his physical measurements, his branch of the service, his ranks and dates he attained them, his trade qualifications, the courses he attended, his postings, his disciplinary record, his pay and allowances, his leave record, awards of medals and decorations, his work performance assessments (AFB 106 and AFB 2047 or 2048 in the case of the Army), his date of discharge or death in service, and any pension details. This list is not exhaustive but covers many of the typical types of information involved. Very few of those pieces of data will have been given by the data subject to the authority concerned, fewer still will have been provided 'in confidence' meaning that the person receiving the information falls into a special category of people bound by confidence. That is not deny that most, if not all, of those items would constitute personal data for the purpose of GDPR and would thus need to be protected to conform with the old
7th Data Protection Principle; however as we know that protection falls away once the person has died.
The remainder of the data (promotion dates, courses, postings etc) are data generated by the authority and in these cases no duty of confidence is owed to the subject, outside of the GDPR rules. In other words since the MOD owns the item of data, it can determine whether there is any quality of confidence which attaches to it. If anything, the duty is often reversed and the serviceman owes a duty of confidence (under
section 2 of the Official Secrets Act 1911*) to his employer not to divulge anything he learns in the course of his service. This is a largely an academic point and wouldn't in fact have covered such things as promotions or trade qualifications, but it might include some postings and specific employments, especially in wartime.
Since the average genealogist will probably already know the serviceman's date and place of birth (or can at least get it from elsewhere) along with details of the next of kin, marriages and children, that leaves almost nothing in a serviceman's record for which it can reasonably be said that the government department owes a duty of confidence to the individual serviceman.
And in any case, even if a plausible case for breach of confidence could be found, the only person who could pursue a civil claim would be the person who suffered the detriment; however since by definition he is dead, that is a nonexistent issue.
* Section OSA 1911 was repealed by the Official Secrets Act 1989.
