The complainant requested copies of all correspondence and documents held by the Financial Ombudsman Service (the FOS) in relation to their complaint. The FOS refused the request citing section 40(1) of the FOIA on the basis that the information was the applicant’s own personal data. The FOS further suggested that the complainant submitted a subject access request (under the UK GDPR) During the course of the Commissioner’s investigation, the FOS also confirmed that it was refusing some limited information on the basis of section 40(2) (third party personal data) of the FOIA. The Commissioner’s decision is that section 40(1) (personal data of the requestor) of the FOIA applies as the information requested constitutes the complainant’s own personal data. The Commissioner has also determined that the FOS was entitled to refuse a small amount of information in reliance on section 40(2) of the FOIA. The Commissioner does not require any steps to be taken.