Lynn Wyeth takes another look at some recent FOI and Data Protection cases, and what they mean for practitioners.
FOI
Public Authorities are seeing an increase in the numbers of meta requests… FOI requests about Freedom of Information (FOI) requests.
Can information be withheld about how you have dealt with a FOI request? Sometimes. As always, each request must be assessed on a case-by-case basis, but a recent decision notice by the Information Commissioners Office (ICO) gives an example of when Section 36 of the FOI Act may be the exemption to apply.
In 2024, the complainant had submitted a request for information to Sport England about a Volleyball England Annual General Meeting. Sport England refused the request under sections 40, 41 and 43 of FOI Act. In January 2025 the complainant submitted a further request asking for information about how that decision was made.
As well as re-applying sections 40, 41 and 43 of FOIA, Sport England also applied section 36 to the meta request, using section 36(2)(b)(ii) to allow the Public Authority to have space to have a free and frank exchange of views on how to answer the request. Sport England argue that
- Transparency and openness are vital for the effective conduct or public affairs [which would include exchanging views freely and frankly].
- Sport England must carry out its central duty of investing, managing and protecting public money. To do this, it needs the full engagement of funded bodies in order to resolve concerns such as those discussed in this case.
- Being able to collaborate freely with funded bodies puts Sport England in the best position to assess relevant matters and put in place action plans to improve standards where necessary. An ancillary benefit is that, as standards are improved, Sport England’s investments are better protected.
The Qualified Person’s opinion was that disclosing the information “would be likely” to cause the envisioned inhibition. The Commissioner considered that the lower level of likelihood was a credible assessment.
You can read the full Section 50 decision notice issued by the ICO here.
DP
Many organisations will have experienced staff wanting to access data about themselves held in email accounts when they are involved in some HR process such as a grievance, disciplinary or capability. There will be data held that is their personal data but also other people’s data.What right do they have to know who has also had access to data about them in those email accounts?
A recent decision notice from the ICO considered a request to NHS England (NHSE) for information regarding access to named Outlook inboxes. The Commissioner was satisfied that it would concern and identify the individuals whose Outlook inboxes were referenced, along with any other persons who have accessed those inboxes, meaning it was personal data.
The Commissioner then went on to assess if there was i) a legitimate interest and ii) a necessity, in releasing the names, and if any data protection principles would be breached.
The Commissioner decided that the complainant had a private interest in the information; they were contesting a grievance made against them, and they were concerned about the handling of their personal data. The Commissioner recognised that this was a valid legitimate interest.
Regarding necessity, however, the Commissioner believed that concerns about the grievance could be addressed through an appeal, which would be a less intrusive means of obtaining information.
As disclosure of the requested information under FOIA was not necessary to meet the legitimate interest, there was no legal basis for NHSE to disclose the requested information and to do so would be in breach of data protection law. NHSE could withhold the names under Section 40(2) of the FOI Act.
