Latest updates
4 December 2008 (from Law Now)
New guidance on requests for personal information
The Information Commissioner’s Office (ICO) states that although the exemption under the FOIA is absolute (i.e. does not require the application by the public interest test under the FOIA) except in limited circumstances, information will not be automatically exempt from disclosure simply because it is personal data. There is a balance between the public being able to access official information and the need to protect personal information. The ICO confirms that freedom of information requires the release of publicly held non-exempt information and wrongly withholding such information will breach the Freedom of Information Act 2000 (FOIA). However, wrongly releasing an individual’s personal data will breach the Data Protection Act 1998 (DPA). In order to ensure compliance with both of these regimes the exemption must be applied with care. Any public authority that relies on the exemption will need to be clear about how the exemption applies to the request in any refusal notice. The ICO provides practical step-by-step advice to assist public authorities in applying the exemption.
The first step detailed is to see if the requested information is (or contains) personal data. The guidance refers to the definition of personal data contained in the DPA and includes any recorded information in any form ‘relating to’ an ‘identifiable’ living individual. The guidance also explains how to deal with an individual’s FOIA request for information about himself or herself (even if its includes information about other people). Generally in such circumstances the request must be dealt with as a subject access request under the DPA.
If the requested information is (or contains) third party personal data the next step is for the public authority to consider if the exemption from disclosure of such information applies. Much of the guidance focuses on applying the exemption if disclosure would breach one of the data protection principles. The practical explanations use examples taken from the freedom of information ruling that resulted in the disclosure of details of MPs’ expenses. The ICO recognises that generally and even though the FOIA exemption is absolute, this will mean considering whether it is unfair to release the information when balancing the necessary public interest in disclosure against the interests of the individual under the first principle.
The guidance also refers to two alternative ‘qualified’ exemptions for third party data if formal objections have been made or if subject access exemptions apply, but confirms that such exemptions are rarely used, as it is highly likely that the main third party data exemption (referred to above) or other FOIA exemptions will be easier to apply.
Although the guidance deals separately with requests for environmental information under the Environmental Information Regulations 2004 (EIR), such requests and the application of equivalent exemptions follow the same structure as a FOIA request.
The latest guidance replaces Awareness Guidance 1 previously issued by the ICO. It provides a clearer, more detailed structure on how to apply the FIOA personal information exemption, as well as links for further advice and a very practical flow diagram for easy reference.
This report comes from Law-Now
http://www.law-now.com
Law-Now@cms-cmck.com
Tel: +44 (0)20 7367 2106
Fax: +44 (0)20 7367 2000
CMS Cameron McKenna LLP
Mitre House
160 Aldersgate Street
London EC1A 4DD