Section 40 and Regulation 13 – personal information

13 December 2023

• This detailed guidance includes pieces of guidance which were previously separate. The pieces merged into this one are: “information exempt from the right of access”, “neither confirm nor deny in relation to personal data”, “personal data of both the requester and others”.
• We have clarified our position about what you need to consider when deciding if the requested information is personal data and if people can be identified. You can find this change in the sections “What is personal data?” and “Can people be identified?”
• We have clarified the meaning of “otherwise than” under section 40 of FOIA and regulation 13 of the EIR. We have also clarified why principle (a) of the UK GDPR is the one mostly likely to be contravened if you disclose personal information in response to an FOI request. You can find this change in “Part three: The first condition – would disclosure contravene the data protection principles?”
• We have further explained our position about what you need to consider when conducting a legitimate interest assessment to decide if you can disclose personal information in response to an FOI or EIR request. You can find this change in Part three, section “Would disclosure be lawful?”, sub-section “Does lawful basis (f) – legitimate interests – apply?”
• We have included more examples from our decisions notices and from Tribunal decisions to help you apply the personal information exemption in practice.