Home > People's rights > Freedom of Information > Practitioners > Full exemptions guidance > Section 40 > Chapter 2

FOI full exemptions guidance

sections:
Intro | 21 | 22 | 23 | 24 | 26 | 27 | 28 | 29 | 30 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 |

Section 40 - Personal Information

Chapters: 01 | 02 | 03 | 04 | 05 | 06 | annex A | annex B

Chapter 02: Preliminary points

"Personal data"

2.1 Section 40 applies only to 'personal data' within the meaning of the DPA. Not all personal information constitutes 'personal data' within the DPA definition, but in the case of information held by a public authority, the definition is particularly wide. Annex A provides fuller guidance on the meaning of 'personal data'. In summary, personal data are information which 'relates to' a living individual. That cannot be given an artificially narrow meaning, but on the other hand it is not the case, for example, that all information generated in the course of an enquiry in response to a complaint will amount to the personal data of the original complainant - that material may 'relate to' his complaint, but it does not necessarily 'relate to' him personally.

Deceased persons

2.2 The definition of "personal data" is restricted to information relating to living individuals. Information which relates solely to a deceased person is not covered by this exemption and section 40 will only apply if the information relating to the deceased person is also the personal data of a living individual. For example, genetic information about a deceased person may also be the personal data of that person's ancestors and descendants. Other exemptions which may be applicable to personal information relating to deceased persons include:

Section 38 which exempts information whose disclosure would or would be likely to endanger the physical or mental health or the safety of any individual (for example by means of shock or distress).

Section 41 which exempts information obtained by a public authority from another person if the disclosure of this information to the public would constitute a breach of confidence actionable by that or another person.

Section 44 which exempts information where disclosure is prohibited by or under any enactment, including the Human Rights Act 1998 (the "HRA"). If disclosure of information relating to a deceased person would breach the right to a private and family life of a living person (as protected by Article 8 of the European Convention on Human Rights), it will be exempt under Section 44 because it would breach section 6 of the HRA (see further the guidance on section 44).

The identity of the applicant

2.3 Unusually for the FOI Act, the application of this exemption depends to some degree on whether the applicant is seeking their own personal data or the personal data of a third person. If responding to a request will involve the disclosure of personal data, the first question to ask is, who is seeking the disclosure of the data? Is the information:

personal data of the applicant, or
personal data of another person?

2.4 In summary, section 40 then applies as follows,

if the information is personal data of the applicant, it is exempt from the FOI Act and falls to be dealt with exclusively under the DPA "subject access" regime.
if the information is the personal data of someone else, it may be exempt from the FOI Act in the following circumstances:

If disclosing it would breach any of the "data protection principles";
If disclosure would contravene a notice received under section 10 of the DPA (the right to prevent processing likely to cause damage or distress); or
If the person who is the subject of the data would not be entitled to access to it under the DPA access regime because one of the DPA subject access exemptions would apply.

These two different parts of section 40 are hereafter referred to as Part (1) and Part (2). All aspects of the section 40 exemption are explained in detail below.

What sort of request for personal data is it?

2.5 When applying this exemption, it is necessary to bear the following points in mind:

A single request may include information falling within both Part (1) and Part (2). It will often be necessary to apply both Parts in the context of a single request and it is important to maintain the distinction between the two different categories of information, ensuring that the correct part of section 40 is applied. For example, if a person asks a public authority to disclose all the information which it holds in relation to that person's family, the information will include both the applicant's personal data, which falls to be dealt with under Part (1) and the personal data of other family members, which will be dealt with under Part (2);
One single "item" of information may constitute the personal data of both the applicant and a third person. For example, if person A has expressed an opinion about the applicant, that information may constitute the personal data of both the applicant and person A. This type of information falls within Part (1) - it always has to be considered within the terms of the DPA;
If it is unclear who is seeking the personal data, departments will want to consider whether or not to take further steps in order to confirm whether or not the applicant is the subject of the information. Regard should be had to the procedural guidance on handling requests.

The Public Interest Test

2.6 The public interest balancing test in section 2 of the FOI Act applies only to certain, very limited parts of the section 40 exemption. Where it does apply, the exemption or the exclusion of the duty to confirm or deny can only be maintained if the public interest in maintaining the exemption or exclusion outweighs the public interest in disclosure. Where the test applies it will be necessary to have regard to all the circumstances of the case in order to ascertain the interests which are to be protected by non-disclosure, the public interest in disclosure and the weight which attaches to those respective interests.

2.7 Each part of the exemption is examined in more detail below and in respect of each aspect of the exemption this guidance specifies whether or not the public interest test applies and identifies any particular public interest considerations which may apply. However, the following are some factors which may apply more generally when considering the public interest balancing test in the context of section 40:

Do the personal data relate to the person in a public capacity or a private capacity? Public authorities will hold a wide variety of personal data in respect of their employees. Generally speaking, the more private the information, the greater the weight which will attach to the public interest in maintaining the exemption from the FOI Act for the purpose of the public interest balancing test.
Would the disclosure have a detrimental effect on the data subject or another person? If disclosure would be likely to cause damage or distress to either the data subject or another person then there is likely to be quite a strong public interest in maintaining the exemption. This will apply in particular if disclosure would interfere with a person's human rights as protected by the European Convention on Human Rights. (NB. If disclosure would breach one of these rights then the information will be exempt under Part (2) of section 40 and also under section 44).
Is the information already in the public domain? If the information has already been made available to the public then the public interest in maintaining the exemption may attract less weight. (NB. Regard must be had to the means by which the information has been put in the public domain as this may also affect the public interest in disclosure. For example if the information has been 'leaked' to the press then the fact that the information is in the public domain will not necessarily strengthen the public interest in disclosure.)