Navigation * Home / Consultancy / The interface between the FOI Act and the DPAct

The interface between the Freedom

Of Information Act 2000 and the

Data Protection Act 1998

Introduction

Many people are confused about the interface between these two Acts. Both are concerned with access to information, though the Data Protection Act extends to all processing of personal data, not simply access. In practice the interface is very simple, though the legislative provisions are complex due to the technical nature of the two Acts. The first part of this note sets out the practical effects of the legislation; the second part explains the legislative provisions. Further notes will be produced concerning the interface between these two Acts and the Environmental Information Regulations, when the Regulations are published.

Practical effects

Access to personal information (information about a living person) is governed by different rules depending on whether you are seeking access to information about yourself or another person ( a third party).

If you are seeking information about yourself, it is exempt from the provisions of the Freedom of Information Act and access is granted under the provisions of the Data Protection Act. Until 1 January 2005 access is available only to information held in computerised systems, or in structured manual files. The definition of a structured manual file has yet to be clarified, but the intention is that it should apply to manual files from which specific information can be easily extracted.

From January 1 2005, Data Protection Subject Access rights are due to be extended to all manual files in relation to organisations which are public authorities under the Freedom of Information Act. This extension will not apply to organisations which are not covered by the Freedom of Information Act.

Subject access requests under the Data Protection Act are subject to a flat fee (currently £10) and information held in manual files not structured by reference to the subject or criteria relating to the subject, will not have to be disclosed (when the right comes into force) if the cost of doing so exceeds the Freedom of Information Act disproportionate cost limits.

The Data Protection Act does not give a right of access to information about third parties. However, the Freedom of Information Act will provide this right from 1 January 2005, subject to certain conditions. These conditions are:

• that the information would be disclosed to the subject of the information if s/he were to apply under the Data Protection Act provisions;
• that disclosure would not contravene the Data Protection principles set out in Schedule 1 to that Act; and
• that the subject of the data has not exercised his/her rights to prevent processing likely to cause damage or distress.

In practice it is fairly simple to establish whether the first and third conditions apply. The second condition is more difficult and requires assessment on a case by case basis.

It is unlikely that sensitive personal data would be disclosable to a third party (information such as that pertaining to health, ethnic status, sexual behaviour, for example). Private personal data, such as home address, telephone number, marital status or information about your personal life is unlikely to be disclosable. However, information about public servants in their capacity as public servants, for example, responsibilities, grade, work contact details, are likely to be disclosable. Also potentially disclosable would be information exchanged with a public authority in some circumstances, for example in response to a consultation exercise, or expressing views as a matter of public debate, which might include personal information.

Legal provisions

Section 40(1) of the Freedom of Information Act 2000 exempts from its provisions information which is personal data of which the applicant is the subject. Access to such information is therefore available only through section 7 of the Data Protection Act 1998.

Section 68(2) of the Freedom of Information Act 2000 inserts an additional category of data into the personal data in Section 1 of the Data Protection Act 1998; recorded information held by a public authority which does not fall within any other definition.

Section 69(2) of the Freedom of Information Act 2000 inserts a new section 9A into the Data Protection Act 1998 which applies to the Freedom of Information Act 2000 disproportionate cost provisions to unstructured manual data not structured by reference to individuals or criteria relating to individuals.

Section 40(2) of the Freedom of Information Act 2000 exempts personal information which is not about the applicant (that is, third party personal information) if the conditions set out in section 40 (3) (a) or (b) apply. These are that disclosure would contravene the Data Protection Principles (section 40(3) (a) (i), or section 10 of the Data Protection Act (section 40(3) (b). Information is also exempt if the subject of the data could not gain access to it (section 40 (4)).

If the information is exempt only by virtue of the application of section 10 of the Data Protection Act, the public interest assessment in section 2(2) (b) of the Freedom of Information Act 2000 must be made before a final decision not to disclose is made.

Please contact BII Compliance to discuss any queeries you may have regarding these acts. We deal with enquiries on a day to day basis and can assure the very best assistance.