Skip to main content
Hafan

Can we restrict the right of access under Part 3?

Contents

In detail

Can we restrict access to the information we provide under part 3?

Yes. Although people have a right to know if you are processing their information and to be provided with access to it, there are circumstances when you can restrict this right. This guidance refers to these as 'restrictions'.

You may apply a restriction in full or in part if it's necessary and proportionate to:

  • avoid obstructing an official or legal inquiry, investigation or procedure;
  • avoid prejudice to the prevention, detection, investigation or prosecution of criminal offences, or the execution of criminal penalties;
  • protect public security; or
  • protect the rights and freedoms of others.

You can only apply a restriction to the extent necessary to achieve one or more of these purposes. You must provide the person with any information that does not come within the restriction.

If you are applying a restriction, you should still provide them with certain supplementary information (eg a copy of your privacy notice).

Where someone is not aware that you are using their personal information, you don't need to provide specific privacy information if a restriction applies. (See When do we need to take action to enable someone to make a SAR?.)

In addition to these restrictions, there are also specific exemptions for the purposes of safeguarding national security and for maintaining legal professional privilege.

What information can be restricted?

You can apply a restriction to all or some of the requested information, depending on the circumstances. You can restrict access to any of the information you are required to provide to a person in response to their SAR. This includes:

  • confirmation that you are processing their personal information;
  • a copy of their personal information or access to it; and
  • other supplementary information.

However, you must provide any information that you do not need to restrict access to.

When is it necessary and proportionate to rely on a restriction?

You can only apply a restriction if it's "necessary". This means that you must demonstrate that you have identified a reasonable possibility of a potential risk. This needs to be based on more than an unsupported assumption, but it doesn't have to be an inevitable outcome. If you can reasonably achieve your purpose by another means, you should do this instead. For example, by redacting the sensitive information.

You must demonstrate that restricting access is "proportionate". This means that your reasons for applying a restriction need to be sufficiently important to justify any impacts it will have on someone. When considering the impact on the person, you must take into account their fundamental rights and legitimate interests. You should consider the actual consequences to them if you apply the restriction. You should only infringe the person's rights to the minimum extent necessary to achieve your purpose.

In general, you should consider all relevant factors and carefully balance the person's right of access against your reasons for restricting access (eg the harm that disclosure might cause). The weight you attach to the person's right of access depends on how compelling their need to have access to the information is. You should consider:

  • the nature of the requested information;
  • how you have categorised their personal information; and
  • why you are processing it.

You may restrict access to some or all of the information depending on the circumstances. As you can only restrict access to the extent necessary to achieve your purpose, you should provide as much information as you can. For example, by redacting the restricted information and providing the person with the rest of the information.

In certain circumstances, restricting access can have such an adverse impact on a person's rights that you may not be able to justify it as necessary and proportionate. In other cases, it is reasonable to restrict access, even if doing so adversely impacts the person's rights. This is the case if:

  • the underlying purpose of the restriction is compelling; and
  • there are no other ways to mitigate the risks you have identified.

Ultimately, you should make a reasoned and sensible decision based on genuine risks. You should:

  • explain your reasons to the person, where possible;
  • keep a record of your decision; and
  • be able to justify your position and provide details to us if we ask you to.

Example

An employee is injured at work, and the health and safety regulator launches a criminal investigation. The employee makes a SAR to the regulator asking for all the information held about them. They want to use the information to obtain legal advice about their chances of bringing a successful personal injury claim against their employer.

The regulator is concerned that disclosure of certain information may be prejudicial to the criminal investigation. Also, if some of the information reaches the media, this may have an impact on the fairness of any future trial. However, the person has a legitimate interest in wanting to access the information, as it may help them decide whether or not to make a claim.

The regulator must balance the person's rights against the possible prejudice to the investigation in disclosing the information. The regulator documents the impacts of disclosure against the impacts on the person of restricting access. It carefully considers any relevant factors and records how it has reached its decision.

For example, refusing to provide the information will not prevent the person from obtaining legal advice. However, the legal advice will be based on more limited information.

What rights and interests may be impacted by restricting someone's right of access?

This will vary depending on the circumstances and how you have categorised the person.

You should consider people's rights, freedoms and interests broadly. Restricting access to personal information can impact any aspect of someone's life.

For example, refusing to provide the information may impact fundamental rights and freedoms, such as the:

  • right to a fair trial;
  • right to liberty and security;
  • right to respect for private and family life;
  • freedom to choose an occupation and the right to work; or
  • freedom to conduct a business.

When can we neither confirm nor deny that we hold the information?

Even if you refuse to provide access to requested information by applying a restriction, in most cases, you must confirm whether or not you hold the information.

If confirming whether or not you hold the information may undermine the purpose of restricting the right of access, you can restrict the person's right to know whether you are processing their information. In this situation, you can refuse to confirm or deny that you hold their information. This is often called a "neither confirm nor deny" (NCND) response.

Again, you can only do this if it's necessary and proportionate to do so, taking into account the person's fundamental rights and interests.

The decision to neither confirm nor deny is separate from a decision to restrict access to the information. You should make this decision entirely on its own merits. There may be circumstances when an NCND response may not be a necessary or proportionate measure.

Example

The police are investigating a murder. They suspect a person is involved and place them under surveillance without their knowledge.

This person makes a SAR for any information held about them relating to the murder investigation. The police restrict access because disclosure is likely to prejudice their investigation.

The police must separately consider whether to confirm or deny that they hold the person's personal information. Since the person is not aware they are under surveillance, confirming they hold any information is likely to undermine the purpose of restricting access. This is because the police have reasonable concerns that the person may alter their behaviours and movements if they know they are under investigation. They may also attempt to conceal evidence or take action which could prevent the apprehension of a suspect.

Therefore, the police respond to the request by providing an NCND response. This is because confirming they hold the information would undermine the reason for restricting access.

Example

A different person makes a SAR to the police for any information held about them relating to the same murder investigation. The police do not hold any information about this person, but are aware that they are acquainted with the suspect. Informing this person that they do not hold information about them may undermine the investigation. This is because there is a risk that they may discuss the police's response with the suspect, and enable them to draw inferences from the different responses they received. The police issue an NCND response.

What does "avoid obstructing an inquiry, investigation or procedure" cover?

You may restrict access to some or all of the information you hold if disclosing it would obstruct an official or legal inquiry, investigation or procedure. This can include any public investigation or inquiry, not just criminal investigations or proceedings. However, this can only apply if you are using the information for a law enforcement purpose. For example, depending on the specific context and circumstances, it may apply if disclosing the information would obstruct an ongoing or future coroner's inquiry or Procurator Fiscal's inquiry.

"Obstructing" means preventing or delaying an inquiry, investigation or proceedings from taking place or progressing within a reasonable time.

You can restrict the person's right of access if you believe that complying with the SAR may frustrate or cause difficulties or impediments in the progress of an:

  • inquiry;
  • investigation; or
  • other official or legal procedure.

However, you cannot restrict the person's right of access just because a SAR is inconvenient, time-consuming or there are ongoing proceedings. You must be able to demonstrate why restricting the right of access is necessary and proportionate.

Example

A person is arrested and questioned by police in connection with a public order offence. The police believe they are a member of a violent gang under investigation for numerous offences. The police do not have enough information to detain the person in custody but investigations are ongoing. The person requests all the personal information the police hold about them.

The police are concerned about releasing some of the information to this person, in case they share it with other gang members, who are potential suspects. The information might alert them to what the police already know about their activities. This could allow them to evade capture or cause them to engage in further criminal activity.

The police want to restrict access to the information on the basis that disclosure could obstruct the ongoing investigation. They decide that the impact on the person is minimal as they have not been charged with an offence because of a lack of evidence. Therefore, failure to disclose the information does not impact their rights.

This means that the person is only entitled to the information that has not been restricted. The police document their reasons for restricting access. They advise the person that disclosing the information would harm ongoing investigations. However, they do not provide any specific details, as this would undermine the purpose of restricting access.

What does "avoid prejudicing" cover?

You can restrict access to some or all of the information you hold if providing it may prejudice the:

  • prevention or detection of crime;
  • investigation and prosecution of criminal offences; or
  • execution of any criminal penalty.

In the context of criminal justice, "prejudice" can have different meanings depending on the context and circumstances.

In the context of the prevention, detection and investigation of crime, prejudice may occur where disclosing the information may undermine an inquiry (eg by revealing details about a covert policing operation). It may also be relevant if you have reasonable grounds to believe that disclosing information to a suspect might lead them to take steps to conceal a crime.

Prejudice in this context can also mean preventing an investigation from being conducted independently or fairly. For example, you may restrict access if disclosing the information would impair or damage the rights of anyone under investigation or charged with an offence.

Prejudice can also apply in the context of the "execution of criminal penalties". The legislation does not specifically define this term, but it generally means any measure or process used to determine an appropriate penalty for an offender. This can include sentences handed down by a judge or out of court disposals. For example, it may be relevant if a judge is deciding whether to sentence an offender to a term in prison or community service. It may also apply in the context of a police caution or conditional discharge.

In the context of court proceedings, including sentencing proceedings, prejudice can occur if decision-makers make a decision:

  • before considering the evidence in full;
  • based on unfair, irrelevant or inadmissible evidence; or
  • based on irrelevant circumstances or preconceived opinions.

Example

The victim in a high-profile criminal trial requests all the personal information the prosecution service holds about them. This includes witness statements and other evidence gathered by the police, including notes and the opinions of senior officers about the facts or circumstances. 

Some of this evidence will not be admissible in court. The rest will be properly tested during the course of the trial. 

If the prosecution service provides the information to the victim, it cannot control what they do with it. If the victim discloses the information to the media, it could prevent the defendant from having a fair trial. 

As the victim will be compelled to testify in court, there is also a risk that providing them with this information may affect their testimony. This is because they may use it to help them reconstruct their version of events rather than basing their testimony on their own recollection.

The prosecution service considers the rights of the victim in deciding whether to provide them with access to this information. However, it decides that restricting access to some of the information is a necessary and proportionate measure to ensure that the defendant is tried fairly. It decides that the balance weighs against disclosure in these circumstances.

What does "protect public security" cover?

You can restrict a person's right of access to their information if you consider it to be a necessary and proportionate measure to protect public security.

"Public security" generally concerns the welfare and protection of the public at large. It may cover the protection of life, institutions and organisations against:

  • public threats;
  • crime;
  • disasters; and
  • other threats to life, safety and well-being.

For example, it may include:

  • using intelligence to address possible threats;
  • policing large events; or
  • investigating drug offences, human trafficking or institutional child abuse.

Public security can encompass most major public policy issues or anything that threatens public order.

Example

The police are investigating the activities of a criminal gang operating in the local area. This includes violent crime, drugs and human trafficking offences. They arrest someone on suspicion of committing a public order offence. The police have CCTV footage of the incident. The person wants to view this footage and makes a request for "all the information you hold about me".

The police also hold information that suggests the person is connected to the criminal gang they are investigating. However, they currently do not have sufficient evidence to establish the person's involvement. They are concerned that if they disclose this information, there is a risk that the person might alert other members of the criminal gang who are still at large. They are also concerned that disclosure could risk the life and safety of victims.

Taking this into account, and after considering the impact on the person's rights, they decide to restrict access to the information that links the person to the activities of the criminal gang. This is based on the need to protect public security.

However, as the alleged public order offence does not relate to these activities, the police do not need to restrict the person's access to the CCTV footage. They disclose this information after redacting any personal information about third parties.

What does "protect the rights and freedoms of others" cover?

You can restrict a person's right to access their personal information if you consider it a necessary and proportionate measure to protect the rights and freedoms of others. This is usually relevant if the information contains personal information about someone else.

(See What can we do if the part 3 request involves information about other people?.)

Can we restrict someone's right of access for more than one reason?

Yes. However, if you need to restrict access for more than one reason, you should:

  • be able to explain why this is necessary and proportionate; and
  • keep a record of your reasons.

Example

The police are investigating a crime. The person under suspicion makes a SAR for their personal information. The police believe that disclosing it is likely to:

  • prejudice the investigation;
  • present a risk to public security; and
  • place another person at risk.

The police decide to restrict the person's right of access based on these grounds.

However, they should:

  • consider each restriction separately; and
  • be able to explain in sufficient detail why applying them is necessary and proportionate in the circumstances.

Can we restrict the right of access for a specified period of time?

Depending on the circumstances, you can apply a restriction to the person's right to access their information for a specific length of time. For example, this may be until an investigation is complete or criminal proceedings have ended.

You are not required to keep a SAR open after you have applied a restriction and responded to the person. However, if you only need to restrict someone's right of access for a specific length of time, you could inform them when they may be able to resubmit their request.

Do we need to record our reasons for restricting someone's right of access?

Yes. You must record your reasons for restricting someone's right of access (either in full or in part) to any of the following information:

  • confirmation of the processing (ie if you have issued an NCND response);
  • any of their personal information; or
  • any of the supplementary information to which they are entitled.

You should record why you have decided this is a reasonable and proportionate action to take. You must make this record available to us on request (although you should only keep personal information in accordance with the terms of your retention and disposal schedule).

Do we need to tell people why we have restricted their rights?

In most cases, if you have restricted someone's right to access their information (either in full or in part), you must inform them as soon as possible and within one month that:

  • you intend to withhold the information, giving reasons why;
  • they have a right to make a complaint to the controller;
  • they have a right to make a complaint to the ICO; and
  • they can seek to enforce this right through the courts.

You do not need to explain that you have restricted their right of access or why, if this undermines the purposes of restricting the right. However, where possible, you should be transparent about your reasons for restricting the right of access.

Is there an exemption for 'legal professional privilege'?

Yes - personal information is exempt from the right of access if it consists of information:

  • to which a claim to legal professional privilege (or confidentiality of communications in Scotland) may be maintained in legal proceedings; or
  • in respect of which a professional legal adviser owes a duty of confidentiality to their client.

This exemption covers the two branches of legal professional privilege. In England, Wales and Northern Ireland, the concept of legal professional privilege encompasses both litigation privilege and legal advice privilege:

  • Litigation privilege applies to confidential communications between a client, professional legal adviser or a third party, but only where litigation is contemplated or in progress.
  • Legal advice privilege applies only to confidential communications between a client and a professional legal adviser for the purpose of seeking or obtaining legal advice.

The Scottish law concept of confidentiality of communications protects:

  • confidential communications between a client and solicitor, where the client seeks and the solicitor gives legal advice; and
  • confidential communications made in connection with legal proceedings. This extends beyond communications solely between solicitors and clients to cover communications with third parties, such as experts or witnesses.

Legal professional privilege is only available for communications that are:

  • confidential in nature;
  • except where litigation is in contemplation, made solely between client and professional legal adviser acting in a professional capacity; and
  • made for the dominant purpose of obtaining or providing legal advice or being used by lawyers in possible or probable litigation.

A communication is a document that conveys information, and it can take any form, including a:

  • letter;
  • report;
  • email;
  • memo;
  • photograph;
  • note of a conversation; or
  • audio or visual recording.

It can also include draft documents prepared with the intention of putting them before a legal adviser.

This exemption only applies where the obligations under data protection legislation prejudice the confidentiality of the work that lawyers are carrying out for their clients. It does not apply to all the processing carried out by a lawyer or a law firm.

Example

A prosecutor is tasked with deciding whether to prosecute someone for a number of offences. The case is complex and involves specialised legal matters outside the scope of the prosecutor's office. For these reasons, the prosecutor decides to obtain external legal advice.

The person concerned makes a SAR for any information the prosecution service holds about them, including any advice or reports obtained. The prosecution service decides that the legal advice is protected by legal professional privilege. This is because it is a confidential communication between client and lawyer, made for the purposes of obtaining legal advice.

The prosecution service:

  • decides to apply the legal professional privilege exemption; and
  • refuses to provide information protected by legal professional privilege.

If you are relying on this exemption to withhold information, you must take the steps outlined in the above section (Do we need to tell people why we have restricted their rights?).

You do not need to explain that you have applied this exemption or why, if this would undermine the purposes of applying it. However, where possible, you should be transparent about applying this exemption and your reasons for doing so.

You must:

  • keep a record of your reasons for applying the exemption; and
  • make this available to us if we ask you for it.

Is there an exemption for national security?

Yes, you can withhold information processed for law enforcement purposes for the purpose of safeguarding national security.

"National security" is generally understood to cover the security and well-being of:

  • the UK as a whole;
  • its population; and
  • its institutions and system of government.

(For further details, see our guidance on the national security exemption.)

Can we rely on the UK GDPR exemptions to withhold personal information under part 3?

No. If you are processing information for law enforcement purposes, you cannot apply the UK GDPR exemptions.