Can You Use FOI to Request Confirmation of Military Service for a Named Individual?

Introduction

The UK’s Ministry of Defence (MOD) has, over the years, received a range of freedom of information (FOI) requests asking for confirmation of military service for a named individual.

There is usually a mix of requests for information on deceased and living individuals.

You can learn more about freedom of information on our sister website.

man standing on stage facing an american flag — Photo by Brett Sayles on Pexels.com

Legislation

General Data Protection Regulations (GDPR).
Data Protection Act 2018 (DPA18).
Freedom of Information Act 2000 (FOIA), Section 40.
Freedom of Information (Scotland) Act 2002 (FOISA), Section 38.

Outline

Generally, any request for personal information will engage s40 of the FOIA or s30 of the FOISA.

Under the terms of the FOIA/FOISA, the release of personal data is specifically prohibited as all releases of information are to the world at large (i.e. in the public domain) and therefore, any confirmation (or denial) of such would be a breach of the Data Protection Principles as defined by the GDPR and DPA18.

In order not to breach these principles, a public authority is required to respond with the application of the exemption at s40 (FOIA) or s38 (FOISA).

In this case (for FOIA), s40(5B)(a)(i) which states that:

“The duty to confirm or deny does not arise in relation to other information if, or to the extent that any of the following applies:
(a) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)-
(i) would (apart from this Act) contravene any of the data protection principles, or”

In this case (for FOISA), s38(2A)(a) which states that:

“(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—
(a) would contravene any of the data protection principles, or”

The first data protection principle under Article 5(1)(a) of GDPR is the most relevant, which states that ‘Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject’.

Generally, a public authority will find that 40(5B)(a)(i)/s38(2A)(a) applies and, by virtue of s40(5)(b)(i)/s38(2A)(a) the authority would be unable to confirm or deny whether any information is held within scope of the request.

The authority should state that the application of the Neither Confirm or Deny provision should not be taken as an indication that information in scope of the request is held.

Under s16 (FOIA) or s15 (FOISA), ‘Advice and Assistance’, the authority may explain that under the FOI regime, request for information seeking confirmation of military service of any named individual, would constitute as personal data of that individual and, as such, disclosure of this type of information under the FOI regime is not permitted.