CWAN014
Page 1 of 1
Steven Dickinson
Policy Delivery knowledgebase
About
Contact team
ICON > Policy Delivery knowledgebase > CWAN014
FOI POLICY INTERNAL KNOWLEDGE BASE
FoI or EIR
Section/Regulation
Issue
FOI
S40(1)
Applicant’s personal data
Summary:
• If a request is only for the applicant’s personal data it should be considered under the DPA, not FOIA.
• If it is a hybrid request or it’s not clear whether all the information is the applicant’s personal data, then:
◦ We can issue a s12/s14 notice without establishing which information is the applicant’s personal data. Whether we
uphold the procedural exemption or not, the public authority must still deal with the applicant’s personal data
appropriately under the DPA and FOIA.
◦ In a held/ not held case, if we find that further information is held we should tell the public authority to deal with the
applicant’s personal data appropriately under the DPA and FOIA.
Further Information:
This Advice Note is relevant to cases involving the applicant’s own personal data and procedural exemptions (s1, s12, s14).
• Request is only for applicant’s personal data
Where a request is only for an applicant’s own personal data we should consider the complaint under the DPA and not under FOIA. If
the complainant insists upon a DN, and we are satisfied that all the requested information is the applicant’s personal data, then we
should issue a s40(5) DN, rather than a s1, s12 or s14 DN.
• Hybrid request or not clear
Where the request is a hybrid request (ie it involves the applicant’s personal data and other data), or where it isn’t clear whether all
the information covered by the request will be the applicant’s personal data, then the position is as follows:
◦ Section 12/section 14
A s12 or 14 DN may be issued without first establishing which information is the applicant’s own personal data and which
information isn’t.
If such a notice upholds the application of s12 or s14 then the Other Matters section should advise the public authority that
regardless of the Commissioner’s findings under FOIA it will still have an obligation to consider whether the applicant’s own personal
data should be provided under the subject access provisions of the DPA.
If such a notice finds that s12 or s14 is not engaged then the steps should be to issue a fresh response without relying on
s12/s14. We should however put the public authority on notice that we will expect it to apply s40(5) in relation to any information
that constitutes the personal data of the applicant (or would constitute it if it were held) and to deal with this information under the
subject access provisions of the DPA.
◦ Held/ not held
In relation to held not held cases, the issue should only arise where we find that more information is held but don’t go on to consider
whether it should be released or not. In these cases we should again issue a DN that orders a fresh response and puts the public
authority on notice that we will expect it to NCND whether any of the information is the applicant’s personal data under s40(5) and
deal with this information under the subject access provisions of the DPA.
For an explanation of the approach to DNs in scenarios where we find that further information is held, see LTT193.
Source of Casework Advice Note
Policy Delivery
Details
Based on decision taken at signatories meeting
21/06/2011; see
Briefing for signatories - Policy trends in decision notices
(April-May) 20110628
Related Casework Advice Notes
CWAN013
LTT193
Related Documents
ICO guidance:
Personal information
Neither confirm nor deny in relation to personal data
Contact: CW
Date: 05/07/2013
Reference number: CWAN 014
• Information Commissioner's Office intranet
http://intranet.child.indigo.local/FOIKB/Pages/CWAN014.aspx
21/04/2015