Lynn Wyeth discusses the key takeaways from some recent FOI and Data Protection cases.
This month, I’m looking at a FOI decision notice on how you provide information and, for Data Protection, a question that comes up frequently… what is personal data?
FOI – Do I have to send all the information in the format requested?
A lot of focus is placed on the exemptions in Part 2 of the Freedom of Information Act 2000 (FOIA), namely sections 21 to 44, but sometimes we see judgements handed down on other administrative issues arising from Part 1 of the Act.
Earlier this year such a judgement was made. This case focused on how to interpret section 11(1) of the FOIA, which deals with how requested information should be provided, including the right to request it in a specific format.
Mr Walawalkar, on behalf of Liberty Investigates, asked the Maritime and Coastguard Agency (MCA) for distress calls made in the English Channel. If the audio could not be shared, he asked for written transcripts instead.
Many FOIA officers will have faced such a request. The concern about releasing recorded audio, potentially citing section 40(2) – Personal Data, can often be resolved by releasing a written transcript of the recording instead but did the MCA have to transcribe all of the recordings?
Section 11(1) says that if someone requests information in a particular format, the public authority must provide it that way “so far as reasonably practicable.”
Unfortunately, this was immediately open to interpretation. The key issue for the Upper Tribunal in this case was whether this means:
- the authority must provide all the requested information in the preferred format if it’s practical (an “all or nothing” approach),
or - the authority must provide as much as is practical in that format (a “sliding scale”).
The question came down to would the MCA have to transcribe some, but not all, of the recorded calls if there were too many. Similar discussions have been held relating to Section 12 (Exceeds the Appropriate Limit). Should we give what we can up to the limit or refuse the whole request?
In this case of Section 11(1), the Upper Tribunal ruled in favour of the “all or nothing” approach. If it’s not reasonably practical to provide all the information in the requested format, the authority doesn’t have to provide any of it that way.
Do not forget to offer advice and assistance to the requester under Section 16 of the FOIA if you find yourself in this situation.
A copy of the full judgment can be found here.
Data Protection – is all a person’s business data also personal data for the purposes of a Subject Access Request?
The High Court’s decision in Ashley v HMRC [2025] is significant for subject access requests (SARs). It favours individuals seeking access to their data, including data relating to their businesses, while highlighting how demanding these obligations can be for data controllers like HMRC. The case addressed several aspects of responding to a SAR and is well worth a read by Data Protection Officers facing similar requests.
Mr Ashley sent a SAR to HMRC, asking for all personal data held about him in connection with a tax enquiry. HMRC initially refused, then partially responded, but Ashley claimed the response was inadequate. The court ruled on several key points:
- Scope of SAR: The request covered personal data held not only by HMRC’s main department but also by the Valuation Office Agency (VOA), which HMRC could not treat as separate for SAR purposes.
- What counts as personal data: HMRC’s valuations of Mr Ashley’s 32 properties were his personal data. But background material (e.g. details of other unrelated properties) was not, unless clearly linked to him.
- Search obligations: HMRC had to search data held by the VOA as well, as this wasn’t shown to be disproportionate.
- Tax exemption: HMRC could not rely on the exemption for tax purposes unless it showed a real risk of prejudice. Speculation wasn’t enough.
- Presentation of data: HMRC must provide personal data in a way that is understandable and allows the individual to exercise their rights. Heavily redacted or decontextualised data won’t suffice.
Regarding the business data, the Court found that HMRC’s valuations of the 32 properties owned by Mr Ashley were his personal data, as they directly related to his tax liability. However, not all data used to reach those valuations—such as information about unrelated properties or HMRC’s internal processes—qualified as his personal data. Only data specifically about the 32 properties themselves was likely to be considered his personal data.
This ruling strengthens SAR rights by clarifying what counts as personal data and how it must be provided. Controllers must take care to interpret SARs broadly and make reasonable searches.
Ashley v The Commissioners for His Majesty’s Revenue and Customs [2025] EWHC 134 (KB) (27th January 2025) can be found here.
Want more guidance and advice on best practice – check out our on demand webinars
