CWAN018
Page 1 of 2
Steven Dickinson
Policy Delivery knowledgebase
About
Contact team
ICON > Policy Delivery knowledgebase > CWAN018
FOI POLICY INTERNAL KNOWLEDGE BASE
FoI or EIR
Section/Regulation
Issue
Both
S40(4)
Information exempt from the subject access right
R13(3)
Summary:
It is only necessary to consider the exemption in section 40(4) FOIA/ regulation 13(3) EIR (for information exempt from the subject
access right) if it has been raised by the public authority.
If the public authority does apply s40(4)/r13(3), case officers should point out that it may be simpler to consider other exemptions
first.
If the public authority continues to rely on s40(4)/r13(3) then case officers should establish which DPA exemption is being relied on
and whether it is engaged and, if so, the balance of the public interest under FOIA/EIR.
If it is found that s40(4)/r13(3) does not apply, it may be necessary for case officers to proactively consider whether disclosure would
contravene DPA principles under s40(3)/r13(2).
Further Information:
When is it necessary to consider s 40(4)/ r13(3) in FOI case work?
Section 40(4)/ regulation 13(3) should only be considered in cases where it has been claimed by a public authority. There is no
expectation that case officers should pro-actively consider this exemption/ exception (and by implication pro-actively consider
whether any of the numerous DPA exemptions would apply if the data subject were to request the information) if it has not been
claimed.
Where section 40(4)/ regulation 13(3) has been claimed by a public authority it is appropriate to refer the authority to our guidance
on Information exempt from the subject access right. This points out (at paragraph 35) that it may be simpler to consider first the
exemptions in section 40(3)/ regulation 13(2), for disclosure that would contravene DP Principles. It may also be appropriate to
consider other FOIA/EIR exemptions/ exceptions, since some of the exemptions from the subject access right in DPA relate to
interests that are also protected by these exemptions/ exceptions.
This may lead to the public authority withdrawing its reliance on section 40(4)/ regulation 13(3). If it continues to claim it however,
then this exemption will need to be considered (unless of course another exemption has already been upheld).
If it is appropriate to consider s40(4)/ r13(3), then how detailed does the analysis of the DPA exemption need to be?
If a PA cannot be persuaded to withdraw its reliance upon section 40(4)/ regulation 13(3) in favour of applying another exemption/
exception, then case officers will need to consider it.
Our Subject Access Code of Practice (chapter 9) gives guidance on the main exemptions from the subject access right.
It will be necessary to establish not just that an exemption under the DPA exists, but also that the exemption would actually apply to
the information in question.
In essence the depth of analysis required will be similar to that applied to FOI exemptions and will entail :
• if the DPA exemption is class-based – establishing information falls within the class;
• if the DPA exemption is prejudice-based - establishing that the prejudice would be likely to occur;
and then:
• carrying out the public interest test as set out in section 2/ regulation 13(3).
Proactive application of section 40(3)/ regulation 13(2)
If it is appropriate to consider a public authority’s s40(4) claim, but it is found that s40(4) does not apply, then, in light of the
Commissioner role as regulator of the DPA, it may still be necessary to pro-actively consider whether disclosure would contravene
DPA principles under section 40(3)/ regulation 13(2).
In this situation the argument may be made that releasing personal into the public domain under FOIA, when a data subject cannot
gain access to the same information under the DPA, is unfair processing and thus contravenes the first data protection principle.
The Commissioner accepts that this will often be the case, but considers that it is also possible for the processing to be fair in the
particular circumstances of the case. In the Lord Ashcroft case FS50197952 he found the processing to be fair, and to meet schedule
2 condition 6 of the DPA even though the information in question was not available to the data subject under the DPA.
Source of Casework Advice Note
Policy Delivery
Details
Related Casework Advice Notes
Related Documents
ICO guidance:
Information exempt from the subject access right
Subject access code of practice
Contact: CW
Date: 10/07/2013
Reference number: CWAN 018
http://intranet.child.indigo.local/FOIKB/Pages/CWAN018.aspx
21/04/2015
CWAN018
Page 2 of 2
• Information Commissioner's Office intranet
http://intranet.child.indigo.local/FOIKB/Pages/CWAN018.aspx
21/04/2015