Chapter 03: Summary guidance - the basic ideas of section 40
3.1 As explained above, section 40 is complex. But as
also indicated, its underlying policy propositions are relatively simple.
For non-statutory government departments, the effect of section 40 can usually
be summarised in terms of 5 basic guidelines. These basic guidelines are
set out below, as a way in to section 40, and to give a general steer to
central Whitehall departments on the handling of personal information in
the context of the FOI Act. Their application will generally give the right
result. But that result may need to be tested against the detail of section
40 in cases where a disclosure decision looks difficult or marginal, including
with the help of legal advice where necessary. That is because getting a
decision wrong - whether by withholding or disclosing information - can
expose a department to legal challenge.
3.2 In summary, therefore, for non-statutory government
departments, the basic guidelines to the application of section 40 are as
follows.
If a request involves the personal data of the applicant, those
personal data are exempt and must be considered as a subject access
request under the DPA.
Aside from this, if another FOI Act exemption would apply to the
personal information which has been requested, departments should usually
cite that exemption rather than section 40.
If personal information is not otherwise exempt under the FOI Act,
the application of section 40 should be considered.
In respect of most requests for personal data which are received
by non-statutory government departments, exemption under section 40
will stand or fall on whether disclosure of the information to a member
of the public' would be 'unfair', taking into account all the circumstances
involved, in particular:
how the information was obtained;
the likely expectations of the data subject regarding the disclosure
of the information;
the effect which disclosure would have on the data subject; and
the public interest in disclosure of the information.
If disclosure of personal data to a member of the public would be 'unfair' then
the request is likely to need to be refused under the FOI Act insofar
as it relates to that personal data.
As far as non-statutory government departments are concerned, whilst
it is necessary to be aware of the other provisions of section 40, the
remainder of section 40 will rarely have to be engaged with.
3.3 The remainder of this guidance discusses the specific
provisions of section 40 in detail. Although the key principles above provide
a measure of general guidance for central government when dealing with requests
for personal information, it is necessary to be aware of the precise terms
of section 40.
