Lynn Wyeth takes a look at some recent FOI and Data Protection issues, and what they mean for practitioners.
FOI
Extending FOI Requests to Consider the Public Interest Test
A recent decision notice (IC-516734-V6G7) from the Information Commissioner’s Office (ICO) highlights the limits on extending the time to consider the public interest test under the Freedom of Information Act 2000 (FOIA).
The complainant submitted a request to the Home Office on 18 February 2026 seeking information about private jet operators, pilots and passengers using private aviation facilities at UK airports.
Section 10 of FOIA requires public authorities to respond to requests within 20 working days. Where a qualified exemption applies and additional time is needed to consider the public interest test, section 10(3) allows the authority to extend the deadline by a reasonable period. The requester must be informed of the extension before the initial 20 working days expires. The Section 45 Code of Practice also states that, as good practice, authorities should normally complete their public interest consideration within a further 20 working days where possible.
In this case, the Home Office issued holding responses in March, April and May 2026, stating that additional time was needed to consider the public interest. However, it did not provide its substantive response until 22 May 2026.
The ICO concluded that the repeated extensions were not justified, stating that it was “not satisfied that the cumulative delay in this case was reasonable.”
The decision serves as a reminder that extensions under section 10(3) are not open-ended. Public authorities should only rely on them where genuinely necessary, keep the period under review, and issue a substantive response as soon as reasonably practicable. The decision also demonstrates that the ICO is looking at FOI complaints quickly, scrutinising lengthy public interest extensions and is prepared to find breaches where authorities cannot justify the overall delay.
Data Protection
Releasing Personal Data under the Legitimate Interests Lawful Basis
Freedom of Information practitioners frequently have to consider data protection issues when applying section 40(2) of the Freedom of Information Act. Although section 40(2) is an absolute exemption, it only applies where disclosure would breach one of the data protection principles in Article 5 of the UK GDPR. In practice, this often comes down to asking whether disclosure would be lawful, fair and transparent.
To be lawful, one of the conditions in Article 6 of the UK GDPR must apply. Whilst consent is one option, it is often impractical in the FOI context. Instead, public authorities should consider whether disclosure is justified under the legitimate interests lawful basis.
Legitimate interests can include both public and private interests. However, three questions must always be considered:
- Is there a legitimate interest? Is there a genuine interest in disclosing the information?
- Is disclosure necessary? Could the request be answered in another way, for example by anonymising or redacting the personal data?
- Do the individual’s rights and freedoms override the legitimate interest? This involves considering factors such as the individual’s reasonable expectations, the potential impact of disclosure and the public interest in transparency and accountability.
A recent ICO decision notice (IC-408943-H7V7) illustrates how this balancing exercise should be carried out. The complainant requested details of the costs associated with a formal complaint that had been investigated by external individuals, including the payments made to those individuals.
The Commissioner concluded that the names and payments could be disclosed, explaining that “any individual who enters into a contract to carry out work with a public authority should be open to scrutiny and accountability because their roles are funded by the public purse and they should therefore expect to have some personal data released.”
This decision is a useful reminder that section 40(2) should not be applied automatically whenever personal data is involved. Public authorities must carefully assess whether disclosure would be lawful under the UK GDPR, weighing the legitimate interest in transparency against the rights and expectations of the individuals concerned. In some cases, particularly where public money has been spent, the balance may favour disclosure.
