Page 1 of 1
Policy Delivery knowledgebase
ICON > Policy Delivery knowledgebase > CWAN014
FOI POLICY INTERNAL KNOWLEDGE BASE
FoI or EIR
Applicant’s personal data
• If a request is only for the applicant’s personal data it should be considered under the DPA, not FOIA.
• If it is a hybrid request or it’s not clear whether all the information is the applicant’s personal data, then:
◦ We can issue a s12/s14 notice without establishing which information is the applicant’s personal data. Whether we
uphold the procedural exemption or not, the public authority must still deal with the applicant’s personal data
appropriately under the DPA and FOIA.
◦ In a held/ not held case, if we find that further information is held we should tell the public authority to deal with the
applicant’s personal data appropriately under the DPA and FOIA.
This Advice Note is relevant to cases involving the applicant’s own personal data and procedural exemptions (s1, s12, s14).
• Request is only for applicant’s personal data
Where a request is only for an applicant’s own personal data we should consider the complaint under the DPA and not under FOIA. If
the complainant insists upon a DN, and we are satisfied that all the requested information is the applicant’s personal data, then we
should issue a s40(5) DN, rather than a s1, s12 or s14 DN.
• Hybrid request or not clear
Where the request is a hybrid request (ie it involves the applicant’s personal data and other data), or where it isn’t clear whether all
the information covered by the request will be the applicant’s personal data, then the position is as follows:
◦ Section 12/section 14
A s12 or 14 DN may be issued without first establishing which information is the applicant’s own personal data and which
If such a notice upholds the application of s12 or s14 then the Other Matters section should advise the public authority that
regardless of the Commissioner’s findings under FOIA it will still have an obligation to consider whether the applicant’s own personal
data should be provided under the subject access provisions of the DPA.
If such a notice finds that s12 or s14 is not engaged then the steps should be to issue a fresh response without relying on
s12/s14. We should however put the public authority on notice that we will expect it to apply s40(5) in relation to any information
that constitutes the personal data of the applicant (or would constitute it if it were held) and to deal with this information under the
subject access provisions of the DPA.
◦ Held/ not held
In relation to held not held cases, the issue should only arise where we find that more information is held but don’t go on to consider
whether it should be released or not. In these cases we should again issue a DN that orders a fresh response and puts the public
authority on notice that we will expect it to NCND whether any of the information is the applicant’s personal data under s40(5) and
deal with this information under the subject access provisions of the DPA.
For an explanation of the approach to DNs in scenarios where we find that further information is held, see LTT193.
Source of Casework Advice Note
Based on decision taken at signatories meeting
Briefing for signatories - Policy trends in decision notices
Related Casework Advice Notes
Neither confirm nor deny in relation to personal data
Reference number: CWAN 014
• Information Commissioner's Office intranet