ICO - FS50865947
| ICO - FS50865947 | |
|---|---|
 | |
| Authority: | ICO (UK) |
| Jurisdiction: | United Kingdom |
| Relevant Law: | Article 5(1)(a) GDPR Article 6(1)(f) GDPR Freedom of Information Act (FOIA) Freedom of Information Act (FOIA) |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 27.07.2020 |
| Published: | |
| Fine: | None |
| Parties: | Department of Health and Social Care |
| National Case Number/Name: | FS50865947 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | English |
| Original Source: | Information Commissioner's Office (in EN) |
| Initial Contributor: | n/a |
The ICO held that the Department of Health and Social Care (DHSC) was entitled to withhold disclosing one name on a document on the grounds that there was no lawful basis for its disclosure under Article 6(1)(f) GDPR and therefore 'processing' the personal data by disclosing the name would breach Article 5(1)(a). Following this line of reasoning, the ICO decided that the DHSC was entitled to rely on Section 40(2) and Section 40(3A) of the Freedom of Information Act to prevent disclosing the name.
English Summary
Facts
The complainant made a two part request for information about draft regulations relating to pharmacists. The Department for Health and Social Care (DHSC) refused the information under section 35(1)(a) of the FOIA (information relating to the formulation or development of government policy). During the course of the Commissioner’s investigation the DHSC also applied section 36 (prejudice to the conduct of public affairs), to a limited amount of the information. It later withdrew its reliance on this exemption. However it also stated that other information was being withheld under section 21 (accessible to the applicant by other means) and section 40(2) (personal information).
Dispute
Whether the Department of Health and Social Care could prevent disclosing a name on an agenda by relying on Section 40(2) and Section 40(3A) of the Freedom of Information Act. Section 40(3A)(a) in particular prevents the disclosure of information that would contravene the principles of processing personal data under Article 5 GDPR.
Holding
The Commissioner’s decision was that the DHSC was entitled to rely on section 35(1)(a) in respect of only some of the information to which it was applied. The DHSC also breached section 10 of the FOIA by failing to provide the information it tried to apply section 36 to, only to later withdraw its reliance on that exemption. However the DHSC was entitled to rely on section 21 to withhold the information to which that exemption had been applied, but by failing to inform the complainant of its application within the statutory time for doing so, the DHSC breached section 17(1).
Finally, the DHSC was entitled to withhold one name from one document. Here the ICO made reference to Article 5 of the GDPR, arguing that Section 40(2) of the FOIA provides that information is exempt from disclosure if it is the personal data of an individual other than the requester and where one of the conditions listed in section 40(3A) is satisfied. In this case the relevant condition was contained in section 40(3A)(a), which applied where the disclosure of the information to any member of the public would contravene any of the principles relating to the processing of personal data under Article 5 GDPR. The ICO referenced Article 5(1)(a) to make the argument that disclosing the name to the public would constitute processing which is not 'lawful', because there would be no legitimate interest in doing so (Article 6(1)(f). Therefore, the ICO decided that the DHSC was entitled to withhold the information under section 40(2), by way of section 40(3A)(a).
However, because the DHSC failed to disclose the rest of the information from the document, it had breached section 1 FOIA (the duty to communicate information). The Commissioner required the Department of Health and Social Care to take steps to ensure compliance with the legislation, and disclose the information from the agenda apart from the one name which could be witheld under section 40(2).
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
