1.0 Introduction and Background Information

This article provides an overview of the United Kingdom’s (UKs) Freedom of Information Act 2000 (FOIA). It outlines relevant legislation, applying to both the UK and Scotland, as well as a definition of a public authority.

It also outlines how to make a request, vexatious requests, refusals, and exemptions. It then looks at the public interest test, levels of prejudice, informal resolutions, internal reviews, and formal complaints. Finally, we look at the various sections of the FOIA, giving practical examples/real world answers where possible.

1.1 Things to Consider

Things to consider when you wish to make a FOIA request to a public authority include:

• Who are you enquiring about?
  • About yourself? You must use the Subject Access Request route.
  • About someone else? Then you must consider Data Protection rules. Is the individual alive or dead? What was the date of their death? In a majority of cases your request will be denied, but there are exceptions (look here).
• What information do you require?
  • Old, current, or future information/data?
  • For example, what time frame for old data? Number of medals awarded in World War I versus number of all medals awarded in all wars.
• Can I get this information/data somewhere else?
  • Some else may have already requested the information/data, so looking on the public authority’s website in the first instance may help (and could be 20 days quicker!).
  • Does another website or source (e.g. magazine/trade journal/book) already have the information?

1.2 Legislation

Below is a list of legislation linked to FOIA.

• UK:
  • Freedom of Information Act 2000 (FOIA).
    • Read about FOI on the ICO website here.
    • https://www.legislation.gov.uk/ukpga/2000/36/contents.
  • Re-Use of Public Sector Information Regulations 2015 (RPSI).
    • Read about RPSI on the ICO website here.
  • Data Protection Act 2018 (DPA).
  • Environmental Information Regulations 2004 (EIR).
    • Provide public access to environmental information held by public authorities.
    • Read about EIR on the ICO website here.
  • INSPIRE Regulations.
    • Read about INSPIRE on the ICO website here.
  • Network and Information Systems Regulations 2018 (NIS).
    • Read about NIS on the ICO website here.
  • Protection of Freedoms Act 2012 PoFA).
    • Read about PoFA on the ICO website here and Gov.uk here.
    • Extended the FOI regime to cover companies wholly owned by two or more public authorities.
• Scotland:
  • Freedom of Information (Scotland) Act 2002 (FOISA).
  • Environmental Information (Scotland) Regulations 2004.
  • INSPIRE (Scotland) Regulations 2009.
• Codes:
  • Local Government Transparency Code 2015.
    • Sets out the minimum data that local authorities should be publishing, the frequency it should be published and how it should be published.

1.3 What is a Public Authority?

Under the FOIA, a public authority includes central government departments, local government, the NHS, maintained schools and other educational institutions, the police, and other public bodies and offices (too many to list).

Refer to Schedule I of the FOIA for a list of public authorities, but also refer to FOIA Section 3 (those not on Schedule I who may be designated a ‘public authority’ and publicly-owned companies as defined in FOIA Section 6).

2.0 How To Make A Request For Information

• The FOIA gives individuals the right to request information held by an authority. However, it does not require:
  • A public authority to create information; nor
  • That the information is complete, accurate, or up-to-date.
• The Requestor:
  • A FOIA requestor does not have to be a UK national or resident.
• The request must:
  • Be made in writing:
    • Can be transmitted by electronic means or letter.
    • Must be legible.
    • Capable of being used for subsequent reference.
  • State the name of the applicant.
  • State an address for response (can be an email address).
  • Describe the information requested.
• The request should:
  • Be tailored, not too broad. For example, an engineer regiment in Germany around 1960-1965 rather than a regiment in Germany.
  • Give a time frame, if applicable (again not too broad). For example, 2021-2022 rather than 1900 to 2022.
• The more tailored and specific the request, the easier it will be for the authority to answer (providing they hold the information).
• In some cases, the public authority may require more information from the requestor in order to answer the request. The public authority is not obliged to answer the request unless it has been supplied with that further information.
• The public authority has to be applicant and motive blind (see Article Section 2.1), with the exception of considering request as vexatious or if help is required (such as disability).
• Must give effect to preference for communication/format (so far as reasonably practicable). For example, a document posted rather than a PDF file attached to an email.
• Response within 20 working days.
• In response (subject to any exemptions):
  • Confirm whether or not the public authority hold the information; and
  • If held, disclose it to the requestor.
• Things to consider:
  • What has been requested? Consider the level or nature of detail.
  • Manner it has been asked? Has FOI been mentioned? A public authority should err on the side of caution and record as FOI (refer to Letter Template and Article Section 2.2).

2.1 What is Applicant/Motive Blind?

• The requester does not (under the act) need to tell the public authority the reason for their request.
• It does not (must not) matter who the requester is or where they are from.
• The public authority must treat all requesters equally!

2.2 Helping the Requestor

• FOIA Section 16.
• Duty to be helpful includes providing advice and assistance.
• Directing/transferring requestor to relevant source if not held by the public authority or if already available elsewhere (e.g. website).
• Helping requester with framing their request (consider if applicant is able to do this and if not refer to other person or agency or submitting request on their behalf (consider Equalities Act 2010)).
• Consider consulting with third parties.
• Inform requester of complaints procedure (internal review/ICO).

2.3 Extensions or Stopping the Clock

• When clarification is required, the public authority should get back to the requester as soon as possible.
• When issuing a fees notice (refer to Article Section 2.5), the public authority should be helpful and consider asking requester to refine or reframe request.

Generally, a public authority should provide a written answer within 20 working days of the request. However, where a qualified exemption (refer to Article Section 3.2.2) is applied then further time may be needed, for example:

• To consider a public interest test (refer to Article Section 3.0).
• The FOI team may be waiting for other parts of the organisation to reply/deliver information.

When a public authority can not reach a decision within the 20 working days relating to a public interest test, the public authority needs to respond within a reasonable period and issue a notice stating which exemption applies. ICO advises no longer than a further 20 days.

2.4 Refusal Notices

• FOIA Section 17.
• When the public authority can not provide information held for whatever reason, or cannot confirm if the information is held or the existence of the information then they must issue by a ‘refusal notice’.
• Generally, a public authority will issue a refusal notice:
  • When an exemption applies;
  • Where the request is vexatious;
  • Where the request is repeated; and/or
  • Where the cost exceeds the ‘appropriate limit’.
• When a public authority refuses a request they should explain:
  • The exemption(s) relied upon;
  • Why the exemption applies to this information;
  • How the public interest test has been applied (if applicable);
  • The internal complaints procedure; and
  • The right to complain to the Information Commissioner.
• There will be legitimate occasions when a public authority will refuse to ‘confirm or deny’ holding requested information.
  • This is particularly likely when dealing with FOIA Section 26 Defence, for example.
• Reasons for withholding information must always be provided and explained, and the refusal notice must also contain details of the complaints procedure.
• The public authority should understand the importance of relying on the correct exemption and that they can use more than one.
• Exemptions are covered in FOIA Sections 21-44.

2.5 Fees Notice/Limit

• Not obliged to comply with request where to do so would exceed “appropriate limit” – £450 (18 hours).
• Can only consider costs reasonably expect to incur in:
  • Determining whether we hold information – including time spent circulating request within the public authority to see where/whether information is held;
  • Locating information;
  • Retrieving information; and
  • Extracting information.
• Have to provide a reasonable (but not precise) estimate of cost.
• Duty to be helpful – should attempt to provide what they can under the limit and/or assist the requestor to refine the request before refusing request.
• Can aggregate requests in certain circumstances for costing purposes.
• Template is available to record & justify cost Form.

2.6 Vexatious Requests

• FOIA Section 14.
• Disproportionate or unjustified level of disruption, irritation or distress.
• Can only be applied to request itself not individual – context and history.
• See ICO guidance of indicators (not exhaustive) – Dransfield “no magic formula”.
• Impact versus serious purpose and value of the request.
• Some requests patently vexatious e.g. threats or abusive language.
• Round robins and campaigns.
• Consider alternatives, such as conciliation: FOIA Section 12(1) (cost limit) or FOIA Section 16 (advice and assistance).
• A public authority has no obligation to comply with a request for information if the request is deemed vexatious or repeated.

3.0 Exemptions

3.1 Absolute Exemption versus Qualified Exemption

• An absolute exemption is not subject to a public interest test, meaning there is no need to make a decision to withhold the information.
• A qualified exemption is subject to a public interest test, and this means that the information requested can only be withheld if the public interest in doing so outweighs the public interest in disclosure.
• The FOIA contains a presumption for release.

Exemption engaged > absolute exemption > refuse request

Exemption engaged > qualified exemption > public interest test > refuse request or disclose information

If informal resolution is not possible, then an internal review can be requested, then a complaint to the Information Commissioner (refer to Article Section 4.0).

3.2 Exemptions by Section

3.2.1 Absolute Exemptions

A public interest test IS NOT required.

• Section 21: Information accessible by other means.
  • Reasonably accessible to the requester (publication scheme/available through other legislation).
  • Even if fee applies – it does not necessarily mean that it is not reasonably accessible even when the charges are from a third party, e.g. The Land Registry.
  • A public authority may be in breach of the duty under the FOIA to provide ‘advice and assistance’ (FOIA Section 16) by not explaining how information is otherwise available, e.g. on authority website.
  • Test: is it “reasonably accessible”?
• Section 23: Information supplied by, or relating to, bodies dealing with security matters.
• Section 32: Court records.
• Section 34: Parliamentary privilege.
• Section 36: Prejudice to effective conduct of public affairs.
  • Only applies to the House of Commons/Lords, not Local Authorities.
• Section 37: Communications with her Majesty, etc. and honours.
• Section 40(1): Personal Information.
  • S40 (1) – requesters own information: If information is the personal data of the person making the request it will be exempt under S40(1). This is because it can be dealt with under the Data Protection Act 1998, as a subject access request.
  • S40(2) Somebody else’s information: If information is requested about a third party, this will also be exempt under S40(2) if disclosure contravenes any of the Data Protection principles (Principle one Fair and Lawful).
  • S40(2) also may require a balancing exercise, which involves balancing the rights and interests of individuals against the legitimate interests in disclosure.
    • This is not the same as carrying out the Public Interest Test associated with certain exemptions in FOIA (see Artcile Section 3.2.2 below).
    • The balancing exercise is carried out in order to decide whether the exemption in section 40(2) is engaged.
    • In particular there is no assumption of disclosure in the legitimate interests test, as there is with qualified exemptions.
    • For example, the outcome of a balancing exercise may lay in withholding third-party personal data identified (e.g. names) in any information to be released.
• Section 41: Information provided in confidence.
  • Only applies to information obtained by the public authority from another person (including another public authority), and
  • The disclosure of the information to the public (by the public authority) would constitute a breach of confidence actionable by that or any other person.
• Section 44: Prohibitions on disclosure.

3.2.2 Qualified Exemptions

A public interest test IS required.

• Section 22 (+A): Information intended for future publication & research data.
• Exact date does not need to be known.
• Reasonable in all circumstances.
• Section 24: National Security.
• Section 26: Defence.
• Section 27: International relations.
• Section 28: Relations within the UK.
• Section 29: The economy.
• Section 30: Investigations and proceedings.
  • S30(1) applies to information which ‘has at any time been held’ for the purposes of any investigations or proceedings which a public authority has a power or duty to conduct – regardless of the purposes for which it might have been obtained or for any other purposes for which it might have been held at any time.
  • S30(2) on the other hand applies to information which ‘was obtained or recorded’ for the purposes of an investigation or proceedings conducted by the authority – ‘relates’ to the obtaining of information from confidential sources and focuses on how the public authority obtained the information and the content of the information.
• Section 31: Law enforcement.
  • S31(1)(a)-(f) applies to information which would be exempt where disclosure would prejudice general law enforcement activities such as the prevention/detection of crime; and
  • S31(1)(g)-(i) applies to a range of functions that public authorities carry out for various purposes such as ascertaining whether a person has failed to comply with the law.
• Section 33: Audit Functions.
• Section 35: Formulation of government policy.
• Section 36: Prejudice to effective conduct of public affairs.
  • Only applies to Local Authorities, not the House of Commons/Lords.
  • Disclosure would or would be likely to inhibit the free and frank provision of advice, inhibit the free and frank exchange of views for the purposes of deliberation; or
  • Disclosure would otherwise prejudice (or be likely) the effective conduct of public affairs.
• Section 37: Royal Family and honours.
• Section 38: Health and safety.
  • Where disclosure would endanger the physical or mental health or safety of any individual;
  • Think about the harm that could be caused when releasing information – for example children homes, animal testing; and/or
  • The impact of the disclosure on others.
• Section 39: Environmental information.
• Section 40: Personal Information.
  • S40 (1) – requesters own information: If information is the personal data of the person making the request it will be exempt under S40(1). This is because it can be dealt with under the Data Protection Act 1998, as a subject access request.
  • S40(2) Somebody else’s information: If information is requested about a third party, this will also be exempt under S40(2) if disclosure contravenes any of the Data Protection principles (Principle one Fair and Lawful).
• Section 42: Legal professional privilege.
  • Litigation privilege: All documents and correspondence between Legal Services and the public authority – this is very wide and captures all information.
  • Advice Privilege: Solicitors, Barristers, and Qualified Legal Executives.
• Section 43: Commercial interests.
  • Is the information a trade secret? For example, Coca Cola ingredients or likely to prejudice the commercial interests of any person (including the public authority).

3.3 Class versus Prejudice Exemptions

• Class-based exemptions protect information because it is of a particular type (for example, information held for the purposes of an investigation).
• Prejudice-based exemptions protect information where its disclosure would or would be likely to harm a particular interest (for example, the prevention or detection of crime).

3.4 What is Considered in a Public Interest Test?

As noted by ICO, something in the ‘public interest’ is simply something which serves the interests of the public.

When applying the public interest test, the public authority is simply deciding whether in any particular case it serves the interests of the public better to withhold or to disclose the information.

With this in mind, a public interest test is required for qualified exemptions, and an authority must note that:

• Information must be disclosed unless the public interest in maintaining the exemption is greater than the public interest in disclosing it;
• The decision involves the balancing of factors on each side; and
• Each exemption used will require its own separate public interest test.

Factors considered in a public interest test (includes but not limited to):

• In Favour of Release:
  • A commitment to openness and transparency of an authority’s activities.
  • Making public authorities (e.g. central and local government) more accountable to the electorate.
  • Promoting accountability and transparency in the spending of public money.
  • Further the public’s understanding of a public authority’s decision-making.
  • Further the public’s understanding of how a public authority conducts negotiations with both industry and international partners.
  • Allowing individuals, organisations, and companies to understand decisions affecting their lives and to challenge them.
  • Informing the public of any danger to public health or safety.
  • Contributing to public understanding and participation in a debate of importance.
• Against Release:
  • Class- or prejudice-based exemptions (refer to Article Section 3.3).
  • Consider all relevant exemptions.
  • Prejudice or detrimental effect of disclosure.
  • Specific circumstance of the case.
  • Human rights, such as a right to a fair trial/privacy.
  • Effect of disclosure on wider world/public, such as public data.
  • Is the information commercially sensitive? Example: The Fault History provides details of the time taken by MOD contractors to rectify fault reports on 25KK87 (a vehicle). This data, along with previously published information, could be used to make reasonable assumptions about hourly labour rates. As market sensitive information, this could then be exploited by commercial competitors to undercut the contractor when bidding for similar work.
  • Is the information militarily sensitive? I.e. could the information, if released into the public domain, be used by enemies to gain an advantage over our military.
  • Prejudice to the commercial interests of, and relationship between, the authority and the developer, which would be caused by the public authority releasing details of the developer’s commercial activities before the developer discloses them itself. This would, in turn, harm the authority’s ability to achieve best value for money for the taxpayer.
  • The release of advice to a Minister from lawyers would be likely to impact a Minister’s ability to speak freely and frankly with their legal adviser in order to obtain appropriate legal advice.

In order to satisfy certain exemptions, information may be redacted in documents in order to make them eligible for release.

Factors that are considered irrelevant in a public interest test include:

• Identity of the requestor.
  • Refer to Article Section 2.1 (Applicant/Motive Blind).
• Private interests of the requestor.
• Information may be misunderstood.
  • If information is considered complex or technical, an explanation of the information could be published.
  • Further, the FOIA gives a right to information held, not information which is accurate, up-to-date, or incomplete (Home Office v Information Commissioner EA/2008/0027).
• Other means of scrutiny.
  • The fact that other means of scrutiny are available, that a public authority could use, does not weaken the public interest in disclosure.
  • ICO considers this argument to be irrelevant in the public interest test.
• Interests of people in other countries.
  • Where information is about events in another country or the actions of a foreign government, it may be argued that the public interest test should consider the interests of the people of that country.
  • ICO states the purpose of FOIA is to promote transparency about the UK government and the public authorities defined in FOIA Section 3(1).
  • Therefore, ICO suggests any interest that people of another country have in greater transparency about their government and their public authorities is not relevant to the public interest test under FOIA.

Finally, when reviewing the for’s and against’s in the public interest test, if all things being equal then disclose.

“The exercise of considering the competing public interests depends not upon the length of the list of the different sorts of public interests on one side or the other but upon how important each of the factors is”. Hogan v Oxford County Council (17/10/2006).

3.5 Weight Attached to Public Interest Test Arguments

Factors to consider when applying an exemption or for disclosure include:

• Likelihood of prejudice;
• Severity;
• Age of the information;
• The specific information and the public interest in disclosure; and
• Information already in the public domain.

3.5.1 What are the Levels of Prejudice?

• Briefly, in engaging a prejudice-based exemption, a public authority has to decide whether disclosure would or would be likely to cause the prejudice described in the exemption.
• “Would” means more probable than not (a more than 50% chance).
• “Would be likely” means that there must be a real and significant chance of the prejudice occurring, even though the probability may be less than 50%.

4.0 Informal Resolutions, Internal Reviews, and ICO Complaints

A general outline of the complaints process:

• Step 01: You ask the public authority a question(s).
  • Make sure you ask quality questions. Consider: the time period required, scope of the question (narrow rather than broad), etc.
  • The FOIA requires a response to be provided to your request under the Act within twenty (20) working days from date of receipt. The public authority should notify you if there is going to be a delay.
  • However, when a qualified exemption applies to the information and a public interest test has to be conducted, the Act allows the time for the response to be longer than 20 working days. A full response must be provided within such a time as is reasonable in all circumstances of the case, and in relation to your request the public authority should inform you of the new response date. If it appears that it will take longer than this to reach a conclusion, the authority should let you know.
  • Remember, if you want information on your own data (think a soldier who wants access to their own course/confidential reports) then you need to make a Subject Access Request.
• Step 02: The public authority gives a reply.
  • The authority should clarify whether or not the information you requested is held, or specify which exemption of the duty to confirm or deny they are applying.
  • The public authority gives you the information you seek: case closed.
  • The public authority does not give you the information you seek: they will state the reason(s). Reasons for refusal can be varied, and can include:
    • Absolute exemption.
    • Qualified exemption: disapproved after public interest test.
    • Question too broad, and consequently exceeds the cost limit of £600 (the public authority should ask you to refine the question).
    • Information not held.
    • Information can be found through other reasonable means (e.g. already published is the typical reply and the authority will provide a link, usually URL).
    • Information you give is too scant, e.g. “I am looking for information on a unit that was posted to Germany.”
• Step 03: Informal Resolution:
  • If you have any queries regarding the content of the reply (typically presented in a letter), are not satisfied with the response, or you wish to complain about any aspect of the handling of your request, then contact the office that replied in the first instance (This is termed informal resolution).
  • You and the public authority may ‘rotate’ through Steps 01 to 03 one or more times depending on the question(s) posed and the answer(s) given.
• Step 04: Internal Review:
  • If informal resolution is not possible and you are still dissatisfied then you may apply for an independent internal review (if there is a specific team within the public authority to conduct such internal reviews, the authority should outline their contact details).
  • Requests for an internal review must be made with forty (40) working days of the date on which the attempt to reach informal resolution has come to an end.
  • The purpose of an internal review is to consider whether the requirements of the Act have been fulfilled.
  • The scope of a review is defined by Part VI of the Code of Practice under Section 45 of the Act (http://www.justice.gov.uk/downloads/information-access-rights/foi/foi-section45-code-of-practice.pdf).
• Step 05: ICO Complaint:
  • It is important to note that the Information Commissioner will not normally investigate your case until the public authority’s internal review process has been completed.
  • If you remain dissatisfied following an internal review, you may take your complaint to the Information Commissioner under the provisions of Section 50 of the Act.

Public authorities are also reminded it is ICO who recommends internal reviews are requested when public authorities fail to comply with the FOIA. ICO states it is the public authority’s chance to report on what went wrong and ICO sees it as the public authority’s opportunity to set things right.

Public authorities are under no legal obligation to complete an internal review, but it is considered ‘good practice’ to do so as it will help them to avoid further breaches. Should a public authority inform a requestor that they are not completing one, or claim there “is nothing to review”, there is no further legal requirement for the requestor to wait any longer. Be advised that a requestor can then pass the matter directly to ICO.

5.0 The FOIA Sections

Below is an outline of the FOIA Sections with practical examples of confirm or deny (where available).

• 01: General right of access to information held by public authorities.
  • This gives you the right to access recorded information held by authority at the time the request is made and does not require the public authority to answer questions, provide explanations or give opinions, unless this is recorded information.
  • The public authority will confirm that it holds no recorded information that would provide an answer to your question.
• 02: Effect of the exemptions in Part II.
• 03: Public authorities.
• 04: Amendment of Schedule 1.
• 05: Further power to designate public authorities.
• 06: Publicly-owned companies.
• 07: Public authorities to which the Act has limited application.
• 08: Request for information.
  • For a request to be valid the requester must include their name and an address for correspondence, it must be in writing, and it must also describe the information requested.
  • If you do not provide your real name then the request is technically invalid under section 8(1)(b).
  • If an invalid request is processed by a public authority, the requester would have no recourse to the ICO as their powers only extend to valid requests under section 8 of the Act.
• 09: Fees.
• 10: Time for compliance with request.
  • Section 10 of the Act sets out the time frames within which a public authority must respond to an FOIA request.
  • It applies whenever the public authority has:
    • A duty under section 1(1)(a) to confirm or deny whether the information is held;
    • A duty under section 1(1)(b) to provide information that is held to the requester;
    • A duty under section 17 to issue a refusal notice explaining why a request has been refused.
  • Public authorities must respond to requests promptly, and by the twentieth (20th) working day following the date of receipt of the request.
  • A working day is any day other than a Saturday, Sunday, Christmas Day, Good Friday or a day which is a bank holiday under the Banking and Financial Dealings Act 1971 in any part of the UK.
  • Where required, an authority may claim a reasonable extension of time to consider the public interest test. An extension beyond an additional 20 working days should be exceptional.
• 11: Means by which communication to be made.
  • 11A: Release of datasets for re-use.
  • 11B: Power to charge fees in relation to release of datasets for re-use.
• 12: Exemption where cost of compliance exceeds appropriate limit.
  • Cost limit of £600: This represents the estimated cost of one person spending three and a half working days (at a flat rate of £25 per hour) in determining whether the public authority holds the information, locating, retrieving, and extracting it.
  • Under the Appropriate Limit and Fees Regulations public authorities are able to aggregate two or more requests where they relate to any extent, to the same or similar information, provided certain conditions are met.
  • These are where the FOI requests:
    • Are made by one person, or by different persons who appear to the public authority to be acting in concert or in pursuance of a campaign; and
    • Are received within any period of 60 consecutive working days.
  • Under 12(4), provided these conditions are met, the public authority is permitted to regard the estimated cost of complying with any of the requests to be the estimated total cost of complying with all of them for the purpose of considering whether complying with the request would exceed the appropriate limit.
  • 12(2): Relates to historical documents that would be held in general files in MOD archive and would be impossible to find, or one would expect to have been destroyed under policies in place at the time. It would, therefore, be an unfair burden and a disproportionate effort on the public authority to find them.
• 13: Fees for disclosure where cost of compliance exceeds appropriate limit.
• 14: Vexatious or repeated requests.
  • This is designed to protect public authorities by allowing them to refuse any requests which have the potential to cause a disproportionate or unjustified level of disruption, irritation or distress.
  • Although there is no requirement to provide or suggest a refinement under Section 14, it is considered it good practice to do so.
• 15: Special provisions relating to public records transferred to Public Record Office, etc.
• 16: Advice and Assistance.
  • Under Section 16 of the Act it is the duty of a public authority to provide advice and assistance, so far as it would be reasonable to expect the authority to do so.
    • Requests for historical information – that which exists as a hard copy file/report only (think pre-digitisation), for example – can make it difficult for a public authority to process that request.
  • Under Section 16 (Advice and Assistance) I should explain that although consent has been given in this case, and the requested information provided, the MOD is not required to release the names or qualifications of its employees, where doing so would contravene other legislation such as the Data Protection Act. The General Medical Council (GMC) has confirmed that where an individual makes a direct approach to a Doctor for their qualifications, the Doctor must provide the requested information, for example where a patient makes a verbal request to their General Practitioner (GP). However, as DBS customers are unable to approach the Veterans UK Medical Advisers (MA’s) directly, the release of a MA’s personal information is dependent upon other rules and regulations such as the UK Data Protection Act 2018 (UK DPA 18). GDPR Article 23(1) and the UK DPA 2018, Schedule 2, Part 3, covers the Protection of Rights of Others, specifically in relation to Health, Social and Education workers. In accordance with paragraph 17(1)(a) it is to be considered reasonable for a controller to disclose information to a data subject without the consent of the other individual where:
    • (a) the health data test is met. 17(2) explains, the health data test is met if – (a) the information in question is contained in a health record, and
    • (b) the other individual is a health professional who has complied or contributed to the health record or who, in his or her capacity as a health professional, has been involved in the diagnosis, care or treatment of the data subject.
    • The War Pension or Armed Forces Compensation Scheme file does not constitute a health record, and MAs are not involved in the diagnosis, care, or treatment of claimants. The MA’s role is to provide advice and guidance based upon pre-existing medical evidence which is used to determine the level of disablement in accordance with the relevant scheme rules. I can confirm that Veterans UK is unable to release the titles, GMC numbers or full names of MAs, if consent has not been given.
  • Under Section 16 of the FOIA (Advice and Assistance) it may be helpful to advise following a discussion with the General Medical Council (GMC), Defence Business Services (DBS) have confirmed that they are not required to release the names or qualifications of their employees i.e. Veterans UK Medical Advisors, where doing so would contravene other legislation such as the Data Protection Act.
  • The legislation which governs the War Pensions Scheme makes no mention of signatures [by Veterans UK MA’s]. A Directive has now been put in place for Veterans UK staff to follow where an MA does not wish to provide a signature on the file and this recorded information is in scope of your request and is provided below.
• 17: Refusal of Request.
• 18: The Information Commissioner.
• 19: Publication Schemes.
• 20: Model Publications Schemes.
• 21: Information Reasonably Accessible By Other Means.
  • Absolute exemption and there is, therefore, no requirement to consider the public interest in making a decision to withhold the information.
  • 21(1): Applied, as the information is already in the public domain.
• 22: Information Intended for Future Publication.
  • Qualified exemption and subject to a public interest test.
  • Not obliged to provide information that is intended for future publication.
  • 22A: Research is also a qualified exemption.
  • · Read about Section 22 and 22A on the ICO website here.
• 23: Security Bodies.
  • Absolute exemption.
  • 23(1):
  • 23(2):
  • 23(3):
• 24: National Security.
  • Qualified exemption and subject to a public interest test.
  • 24(1): Information which must be withheld in order to safeguard National Security.
    • Absolute exemption and there is, therefore, no requirement to consider the public interest in making a decision to withhold the information.
  • 24(2) “is engaged because by confirming or denying whether there had been any security breaches would render security measures less effective.”
• 25: Certificates under ss. 23 and 24: Supplementary Provisions.
• 26: Defence.
  • Qualified exemption and subject to a public interest test.
  • 26(1) (a) and (b): Information which, if disclosed would prejudice defence or the capability, effectiveness or security of relevant forces.
    • Absolute exemption and there is, therefore, no requirement to consider the public interest in making a decision to withhold the information.
• 27: International Relations.
  • Qualified exemption and subject to a public interest test.
• 28: Relations within the UK.
  • Qualified exemption and subject to a public interest test.
• 29: The Economy.
  • Qualified exemption and subject to a public interest test.
• 30: Investigations and Proceedings Conducted by Public Authorities.
  • Qualified exemption and subject to a public interest test.
• 31: Law Enforcement.
  • Qualified exemption and subject to a public interest test.
  • 31(1) (a): Information which, if disclosed would prejudice law enforcement.
  • Absolute exemption and there is, therefore, no requirement to consider the public interest in making a decision to withhold the information.
  • 31(1)(c): Prejudice ongoing legal proceedings.
  • 31 (3) “is engaged because by confirming or denying. This would prejudice any counter-intelligence efforts or criminal investigations, if there were such breaches.”
• 32: Courts Records, etc.
  • Absolute exemption.
• 33: Audit Functions.
  • Qualified exemption and subject to a public interest test.
• 34: Parliamentary Privilege.
  • Absolute exemption.
• 35: Formulation of Government Policy, etc.
  • Qualified exemption and subject to a public interest test.
• 36: Prejudice to Effective Conduct of Public Affairs.
  • Absolute exemption, though only relates to House of Commons or House of Lords.
  • All other is a qualified exemption and subject to a public interest test.
• 37: Communications with His Majesty, etc. and Honours.
  • Absolute exemption.
  • Royal Family and honours is a qualified exemption and subject to a public interest test.
• 38: Health and Safety.
  • Qualified exemption and subject to a public interest test.
• 39: Environmental Information.
  • Qualified exemption and subject to a public interest test.
• 40: Personal Information/Data.
  • Absolute exemption and there is, therefore, no requirement to consider the public interest in making a decision to withhold the information.
  • 40(2) third party personal data “has been applied to some of the information in order to protect personal information as governed by the Data Protection Act 1998.” or “as governed by the Data Protection Act 2018.”
  • Under 40(5) of the FOIA, the public authority neither confirms nor denies whether it holds any information in scope of your request.
    • If your request asks about your own personal data. Were any of your personal data to be held it would be exempt under section 40(5). A release under FOIA is assumed to be a release to the public at large, therefore, admitting to holding or not holding the information would be to breach the fair processing principal of the Data Protection Act. In view of this the public authority neither confirms nor denies it holds any information in scope of your request.
    • The fact that Section 40(5) of the FOIA has been cited should not be taken as an indication that the information you have requested is or is not held by the public authority. The terms of this exemption of the FOIA mean that they do not have to consider whether or not it would be in the public interest for them to reveal whether or not the information is held.
    • Notwithstanding the above, under Section 16 of the FOIA (Advice and Assistance), the public authority will inform that you do have the right to request access to any personal data which may be held by the public authority under the Data Protection Act 2018 and as such they will have likely passed your requests to the relevant Subject Access Request (SAR) Team, who will contact you in order to establish if any such information exists.
  • The authority is, therefore, unable to release the titles, GMC numbers and full names of the Medical Advisers that Veterans UK currently employ, as they have either not consented to, or are unable to consent to, the release of their personal information, and it remains unreasonable to do so without their consent (refer to Section 16 regarding Veterans UK MA’s).
• 41: Information Provided in Confidence.
  • Absolute exemption.
• 42: Legal Professional Privilege (LPP).
  • Exempts information in respect of which a claim to legal professional privilege could be maintained in legal proceedings.
  • This is a qualified exemption which requires a public interest test to establish the balance on releasing or withholding information.
  • There are two types of LPP: legal advice privilege and litigation privilege.
  • In this case, the arguments for release include the public interest in the openness and transparency of Defence activity. Arguments to withhold information include the fact that the release of advice to a Minister from lawyers would be likely to impact a Minister’s ability to speak freely and frankly with his or her legal adviser in order to obtain appropriate legal advice. This is a fundamental requirement of the English legal system. Withholding the information from disclosure will help to protect the thinking space in which free and frank exchanges of views between Ministers and their legal advisors can take place, safe in the knowledge that the legal advice and discussion will be kept confidential. It has therefore been decided that, on balance, some of the information should be withheld.
• 43: Commercial Interests.
  • Qualified exemption and subject to a public interest test.
  • Section 43(2) concerns information which if disclosed would or would likely prejudice the commercial interests of any person (including, for example, defence contractors and the public authority holding it).
• 44: Prohibitions on Disclosure.
  • Absolute exemption.
• 45: Code of Practice, Request Handling.
• 46: Code of Practice, Records Management.
• 47: General Functions of Commissioner.
• 48: Recommendations as to Good Practice.
• 49: Reports to be Laid Before Parliament.
• 50: Application for Decision by Commissioner.
  • You have an absolute right under the Act at any point in the process to appeal to the Information Commissioner under the provisions of section 50 of the Act.
• 51. Information notices.
• 52. Enforcement notices.
• 53. Exception from duty to comply with decision notice or enforcement notice.
• 54. Failure to comply with notice.
• 55. Powers of entry and inspection.
• 56. No action against public authority.
• 57. Appeal against notices served under Part IV.
• 58. Determination of appeals.
• 59. Appeals from decision of Tribunal.
• 60. Appeals against national security certificate.
• 61. Appeal proceedings.
• 62. Interpretation of Part VI.
• 63. Removal of exemptions: historical records generally.
• 64. Removal of exemptions: historical records in public record offices.
• 65. Decisions as to refusal of discretionary disclosure of historical records.
• 66. Decisions relating to certain transferred public records.
• 67. Amendments of public records legislation.
• 68. Extension of meaning of “data”.
• 69. Right of access to unstructured personal data held by public authorities.
• 70. Exemptions applicable to certain manual data held by public authorities.
• 71. Particulars registrable under Part III of Data Protection Act 1998.
• 72. Availability under Act disregarded for purpose of exemption.
• 73. Further amendments of Data Protection Act 1998.
• 74. Power to make provision relating to environmental information.
• 75. Power to amend or repeal enactments prohibiting disclosure of information.
• 76. Disclosure of information between Commissioner and ombudsmen.
  • 76A. Disclosure between Commissioner and Scottish Information Commissioner.
  • 76B. Disclosure of information to Tribunal.
• 77. Offence of altering etc. records with intent to prevent disclosure.
• 78. Saving for existing powers.
• 79. Defamation.
• 80. Scotland.
  • 80A. Information held by Northern Ireland bodies
• 81. Application to government departments, etc.
• 82. Orders and regulations.
• 83. Meaning of “Welsh public authority”.
• 84. Interpretation.
• 85. Expenses.
• 86. Repeals.
• 87. Commencement.
• 88. Short title and extent.
• Schedules:
  • Schedule 1: Public Authorities.
  • Schedule 2: The Commissioner and the Tribunal.
  • Schedule 3: Powers of Entry and Inspection.
  • Schedule 4: Constitution of Tribunal.
  • Schedule 5: Amendments of Public Records Legislation.
  • Schedule 6: Further Amendments of Data Protection Act 1998.
  • Schedule 7: Disclosure of Information by Ombudsmen.
  • Schedule 8: Repeals.