ICO - FS50839431

ICO (UK) - FS50839431
Authority:	ICO (UK)
Jurisdiction:	United Kingdom
Relevant Law:	Article 4(1) GDPR Article 5(1)(a) GDPR Article 6(1)(f) GDPR Section 3(2) DPA 40(2) FOIA
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	01.11.2019
Published:
Fine:	None
Parties:	University of Leicester Anonymous
National Case Number/Name:	FS50839431
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	English
Original Source:	ICO (in EN)
Initial Contributor:	n/a

The ICO issued a decisions regarding refusal to access to third party personal data.

English Summary

Facts

The complainant has requested information from University of Leicester about external examiners for the department of engineering between the years 2010 to 2018. The University withheld the information, citing section 40(2) (personal information) of the FOIA.

The complainant challenged the decision before the ICO.

Dispute

The Commissioner considers the scope of her investigation to be to establish whether the Universityis entitled to withhold the requested information under section 40(2) of the FOIA.

Holding

As per the applicability of Article Articles 40(2) FOIA, it must be determined whether the withheld information constitutes personal data and, in the affirmative, whether disclosure of that data would breach any of the data protection principles under the Data Protection Act.

According to the ICO the information at stake is personal data. The fact that information constitutes the personal data of identifiable living individuals does not automatically exclude it from disclosure under the FOIA.

The second element of the test is to determine whether disclosure would contravene any of the data protection principles. In the present case, the most relevant principle is the one protected under Article 5(1)(a) GDPR: "Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject".

The Commissioner considers that the most likely applicable lawful bases is the legitimate interest of the controller under Article 6(1)(f) GDPR. In considering the application of Article 6(1)(f) GDPR in the context of a request for information under FOIA it is necessary to consider the three-part test: (i) legitimate interest, (ii) necessity and (iii) balancing of conflicting interests.

The Commissioner accepts that the complainant has (i) a legitimate interest in seeing the requested information and that the disclosure is (ii) necessary for meeting a legitimate public interest. Such interest is to be (iii) balanced against the data subjects’ interests.

In carrying out the assessment under (iii) it is necessary to consider the impact of disclosure in terms of harm or distress, the reasonable expectations of the individual as well as whether the information is already in the public domain.

Within the University’s response to the Commissioner’s enquiries, it outlined that at the time of the request, the external examiners for that academic year had also been the external examiners for the previous two academic years. Therefore, the University argued, any student who had concerns about any conflicts of interest an external examiner might have had,would already have had two years in which to complain.

Based on the above factors, the Commissioner has determined that there is insufficient legitimate interest to outweigh the data subjects’ fundamental rights and freedoms. The Commissioner therefore considers that there is no Article 6 basis for processing and so the disclosure of the information would not be lawful.

In conclusion, the ICO decided that the University was entitled to rely on the exemption at section 40(2) FOIA.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English official version

 to be completed..