ICO - IC-44531-X9L7

From GDPRhub
Revision as of 17:49, 23 August 2020 by Kari (talk | contribs) (Created page with "{{DPAdecisionBOX |Jurisdiction=United Kingdom |DPA-BG-Color=background-color:#023868; |DPAlogo=LogoUK.png |DPA_Abbrevation=ICO |DPA_With_Country=ICO (UK) |Case_Number_Name=I...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
ICO - IC-44531-X9L7
LogoUK.png
Authority: ICO (UK)
Jurisdiction: United Kingdom
Relevant Law: Article 5(1)(a) GDPR
Article 6(1)(f) GDPR
Section 3 (2) DPA
Section 40 (2) FOIA
Section 40(3A)(a) FOIA
Type: Complaint
Outcome: Rejected
Started:
Decided: 29.07.2020
Published:
Fine: None
Parties: n/a
National Case Number/Name: IC-44531-X9L7
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): English
Original Source: ICO (in EN)
Initial Contributor: n/a

ICO decides that name-redacted application forms must not be disclosed by the public authority under UK Freedom of Information Act 2000 (FOIA), since they are protected by data protection law.

English Summary

Facts

The complainant requested information relating to a recruitment process within a public authority (the Trust). The Trust withheld parts of the requested information, containing redacted application forms, citing section 40 (2) FOIA.

Dispute

Do name-redacted job applications constitute personal data and would disclosure under FOIA contravene data protection principles?

Holding

The withheld information constitutes personal data and disclosure would be unlawful. Hence, the Trust was right to withhold the information requested under section 40(2) FOIA, by way of section 40(3A)(a).

The ICO saw the particular data subjects’ interests to be protected in the personal statements on the application forms. Even though the names would have been redacted, the candidates’ identity could be derived by a “motivated intruder” using other information publicly available (“mosaic argument”) and therefore constitute personal data.

As regards the breach of data protection principles the ICO refers to Article 5 (1) (a). It then elaborates on the applicability of a legal basis according to Article 6 (1) (f).

The ICO confirms a legitimate interest in that the complainant is concerned about having been discriminated against during the application process.

Furthermore, it deems the potential disclosure of the requested applications necessary to meet this interest.

However, it states that the interest is of a case specific rather than general nature, and concludes that this is easily outweighed by the interests of the data subjects, taking into account the data subjects’ reasonable expectation for their data not to be released and, connectedly, a degree of harm or stress induced by a potential release, in particular since releases under FOIA are releases to the general public.

As regards interests laid out in the Equalities Act and fairness of the trial in question, the ICO considers the Trust’s cooperation in releasing all other requested information, which it didn’t deem to be protected by data protection principles, and this to be sufficient evidence of transparency in principle.

Addressing arguments brought by the claimant, the ICO finds that if there was a reasonable expectation by the data subjects for application details to be released, it would increasingly apply to higher ranking posts, and higher than the one in question, for increased relevance of public interest to be taken into consideration.

Furthermore, an analogy to the disclosure of the application forms to the recruitment panel, as brought by the claimant, did not hold, since the applicants would reasonably expect this and have therefore directly or tacitly consented. Also, disclosure to the recruitment panel was less invasive than a release to the wider public under FOIA.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.