EIR 12(3)

From FOIwiki
Jump to navigationJump to search

EIR 12(3) - personal data

Introduction

Can personal data be obtained under the EIRs?

Access to personal data is governed by different rules depending on whether an individual is seeking access to information about him/herself or another person (a third party). If an individual is seeking information about him/herself, the request falls within the scope of the Data Protection Act and should not be dealt with under the EIRs. Under such circumstances the request is treated as a subject access request under section 7 of the Data Protection Act. Where an individual is seeking environmental information which contains details about a third party, such information may be disclosable under the EIRs. Are there provisions in the EIRs which may prevent third party personal data being disclosed?

Regulation 13 does exempt personal information which is not about the applicant if regulations 13(2) (a) or (b) or 13(3) of the EIRs apply. Therefore, disclosure of personal data to a 3rd party must not occur if:

  • it would breach any of the data protection principles
  • it would cause substantial, unwarranted damage and distress and thus breach the data subject’s rights under section 10 of the DPA
  • the information is exempt from disclosure to the data subject due to an exemption being applicable under part IV of the Data Protection Act.

What types of personal data may be disclosable under the EIRs?

There is no hard and fast rule on what can be disclosed as each case should be considered on its own merits. However, information about some public servants in their capacity as public servants (e.g., responsibilities, grade, certain work contact details etc) could be disclosable, especially for those in public-facing roles. Information supplied to a public authority in some circumstances (e.g. in response to a consultation exercise, or expressing views as a matter of public debate), including from members of the public, which might include personal data, may also be disclosable. However, if the member of the public has stated that he/she does not wish his/her response to be made publicly available this would be taken into consideration.

What types of personal data may not be disclosable under the EIRs?

It is unlikely that sensitive personal data (e.g. information such as that pertaining to health, ethnic status, sexual behaviour) would be disclosable to a third party. Personal data, such as a home address, telephone number, marital status or information about an individual’s personal life is also unlikely to be disclosable.

Would the presence of personal data prevent disclosure of the remaining information falling within the scope of a request?

It might be possible to disclose the remaining information where it is possible to separate the personal data from the other information requested, or to provide a summary that excludes any exempt personal data (and where no other exemptions apply that might exempt the remaining information from disclosure).

(c) Crown Copyright

(Source: Defra guidance).

What the law says

Regulation 12.

(3) To the extent that the information requested includes personal data of which the applicant is not the data subject, the personal data shall not be disclosed otherwise than in accordance with regulation 13.

Regulation 13.

(1) To the extent that the information requested includes personal data of which the applicant is not the data subject and as respects which either the first or second condition below is satisfied, a public authority shall not disclose the personal data.
(2) The first condition is -
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998, that the disclosure of the information to a member of the public otherwise than under these Regulations would contravene -
(i) any of the data protection principles; or
(ii) section 10 of that Act (right to prevent processing likely to cause damage or distress) and in all the circumstances of the case, the public interest in not disclosing the information outweighs the public interest in disclosing it; and
(b) in any other case, that the disclosure of the information to a member of the public otherwise than under these Regulations would contravene any of the data protection principles if the exemptions in section 33A(1) of the Data Protection Act 1998 (which relate to manual data held by public authorities) were disregarded.
(3) The second condition is that by virtue of any provision of Part IV of the Data Protection Act 1998 the information is exempt from section 7(1) of that Act and, in all the circumstances of the case, the public interest in not disclosing the information outweighs the public interest in disclosing it.
(4) In determining whether anything done before 24th October 2007 would contravene any of the data protection principles, the exemptions in Part III of Schedule 8 to the Data Protection Act 1998 shall be disregarded.
(5) For the purposes of this regulation a public authority may respond to a request by neither confirming nor denying whether such information exists and is held by the public authority, whether or not it holds such information, to the extent that -
(a) the giving to a member of the public of the confirmation or denial would contravene any of the data protection principles or section 10 of the Data Protection Act 1998 or would do so if the exemptions in section 33A(1) of that Act were disregarded; or
(b) by virtue of any provision of Part IV of the Data Protection Act 1998, the information is exempt from section 7(1)(a) of that Act.

Official guidance

ICO Lines To Take

  • Regulation 12(3):
Relevant Lines to Take

None

  • Regulation 13:
Relevant Lines to Take
  • LTT185 - Condition 5 Schedule 3 Data Protection Act 1998 (condition for processing sensitive personal data) - 19/11/2010
  • LTT152 - Naming officials representing public authorities and third party organisations, such as lobbyists - 14/09/2010
  • LTT168 - DPA "special purposes" & disclosures under FOI / EIR - 17/02/2010
  • LTT167 - Consent - 17/02/2010
  • LTT59 - Fair Processing Notices - 21/01/2010
  • LTT57 - Schedule 2 Condition 6 of the DPA - 19/01/2010
  • LTT162 - Anonymising Post codes - 18/01/2010
  • LTT56 - Second data protection principle - 16/12/2008
  • LTT71 - Addresses of properties - 24/09/2007


ICO Decision Notices

Complaints upheld / partly upheld (P) Complaints not upheld
  • FER0256967 - Mid Suffolk District Council - 18/01/2010
  • FS50176219 - Surrey Heath Borough Council - 23/12/2009
  • FER0137609 - Veterinary Medicines Directorate - 10/12/2009
  • FS50198525 - Tandridge District Council - 03/12/2009
  • FER0184525(P) - Department of Energy & Climate Change - 03/11/2009
  • FS50195062 - Department for Transport - 05/10/2009
  • FER0178071 - Brighton and Hove City Council - 24/09/2009
  • FER0187769 - Brighton and Hove City Council - 24/09/2009
  • FS50207670 - West Sussex County Council - 20/08/2009
  • FER0184376 - University of Salford - 08/12/2008
  • FER0112249 - Department for Environment Food and Rural Affairs - 12/11/2008
  • FER0145824 - London Borough of Camden - 30/06/2008
  • FER0152885 - Environment Agency - 10/06/2008
  • FS50085782 - Welsh Assembly Government - 29/01/2008
  • FER0086785 - Tunbridge Wells Borough Council - 10/10/2007
  • FER0070849 - Mid Devon District Council - 19/07/2006
  • FER0220492 - London Borough of Sutton - 26/04/2010
  • FS50124332 - Department for Transport - 30/03/2010
  • FS50188307 - Mid Sussex District Council - 25/03/2010
  • FER0256967 - Mid Suffolk District Council - 18/01/2010
  • FER0192430 - London Borough of Camden - 21/12/2009
  • FS50080236 - Department of Health - 21/12/2009
  • FER0185236 - Department for Environment Food and Rural Affairs - 17/12/2009
  • FER0183946 - Cabinet Office - 17/12/2009
  • FER0185237 - Cabinet Office - 17/12/2009
  • FER0183947 - Department for Environment Food and Rural Affairs - 17/12/2009
  • FS50080240 - Department for Environment Food and Rural Affairs - 15/12/2009
  • FS50114757 - Cabinet Office - 15/12/2009
  • FER0221965 - Chiltern District Council - 14/12/2009
  • FER0186717 - Department for Communities and Local Government - 18/11/2009
  • FS50257908 - St Edmundsbury Borough Council - 26/10/2009
  • FER0181772 - Winchester City Council - 24/09/2009
  • FS50207672 - Norfolk County Council - 14/09/2009
  • FS50187166 - Blidworth Parish Council - 27/07/2009
  • FS50199873 - Cardiff Council - 30/04/2009
  • FS50122058 - Department for Culture, Media and Sport - 09/07/2008
  • FER0118853 - Sutton and East Surrey Water plc - 19/03/2008
  • FER0104939 - Lake District National Park Authority - 05/02/2008
  • FER0087774 - Department for Business, Enterprise and Regulatory Reform - 28/01/2008
  • FS50122983 - Department for Culture, Media and Sport - 19/11/2007
  • FER0082261 - Department of the Environment (NI) - 21/05/2007
  • FER0091004 - Nottingham City Council - 27/03/2007
  • FER0085943 - Salisbury District Council - 15/11/2006
  • FER0106205 - Worcestershire County Council - 21/08/2006
  • FER0091149 - Environment Agency - 21/08/2006

Includes DNs up to: 26 April 2010



Environmental Information Regulations 2004
Exceptions
12(3) 12(4)(a) 12(4)(b) 12(4)(c) 12(4)(d) 12(4)(e) 12(5)(a) 12(5)(b) 12(5)(c) 12(5)(d) 12(5)(e) 12(5)(f) 12(5)(g)