The Information Commissioner's Office (ICO) has recently published a number of new and updated guidance notes on the application of certain exemptions to the requirement to disclose information under the Freedom of Information Act (FOIA) for England, Wales and Northern Ireland. Such guidance notes are important as they explain the ICO's view on how exemptions should be applied. As a result, these guidance notes can have a significant impact on public authorities, as well as on those in the private sector that contract with them.
The new and updated guidance notes that are of particular interest cover exemptions on confidential information, personal information and commercial interests.
1. Confidential Information
The exemption contained in section 41 of the FOIA allows public authorities to refuse to disclose information if: (1) the information was obtained by the public authority from another person; and (2) disclosure of that information would result in an actionable breach of confidence.
Two of the new guidance notes relate to this exemption: one is entitled 'The Duty of Confidence and the Public Interest' and the other is entitled 'Information Provided in Confidence Relating to Contracts'.
(i) Public Interest
Although section 41 is an absolute exemption – i.e. on the face of it there is no need to apply the public interest test - the ICO's guidance states that the application of a public interest test is inherent in determining whether particular information is confidential at common law and therefore the public interest must be a consideration when determining whether the exemption relating to confidential information applies.
In order to establish an actionable breach of confidence, the following three requirements must be met:
- the information must have the necessary quality of confidence;
- the information must have been imparted in circumstances which imposes an obligation of confidence; and
- the unauthorised disclosure must have resulted in the detriment of the person who communicated the information.
When applying the public interest test to an exemption there is a general presumption under the FOIA that information should be disclosed unless the public interest in maintaining the exemption outweighs the public interest in disclosure. However, the ICO guidance states that when applying the exemption under section 41, this general presumption should be reversed. As a result, only if the public interest in disclosing confidential information outweighs the public interest in keeping the information confidential and maintaining the duty of confidence, should the information be disclosed.
An example given in the guidance is where an employee of a public authority 'whistle-blows' on his employer where he discovers his employer is not holding personal data securely. In this case, the public interest in informing the individuals whose data is at risk of the situation outweighs the duty of confidence the employee owes to his employer.
The ICO's guidance advises that the terms of a contract between a public authority and another party do not, as a general rule, amount to confidential information. The reason for this is that as the parties to a contract negotiate and agree on its contents, the contents of a contract are therefore technically not provided by any one party to the other but rather jointly developed. This position has been consistently applied in the ICO decisions since first being referred to in the decision with regards to a request for access to the agreement between Derry City Council and Ryanair (Case Ref: FS50066753). However, there may nevertheless be circumstances in which some of the information in a contract may be considered as confidential information obtained from the other party - for example information regarding a pre-contractual negotiating position or pricing or technical information contained in a schedule to the contract, which has not been negotiated.
For the most part, however, businesses contracting with public authorities should be aware that part or all of such contracts may be disclosed by a public authority in response to a request under the FOIA.
2. Personal Information
Section 40 of the FOIA sets out various exemptions to the disclosure of personal information covered by the Data Protection Act 1998 (DPA). These include disclosure to the person making the request of their own personal data (as this should be dealt with as a subject access request under the DPA), and disclosure of personal data relating to a third party (where this would be a breach of the DPA). Most of these are absolute exemptions and no public interest test will be applied.
Access to third party information will be denied if to provide access would breach one or more of the principles set out in the DPA. The decisions have focussed on the first principle and the need to ensure that personal information is fairly and lawfully processed.
The decisions focus in on one particular potential justification for fair or lawful processing, namely whether the disclosure is in the legitimate interests of the authority disclosing and that disclosure does not prejudice the position of the party whose data is being disclosed. Essentially it is a balancing act – balancing the legitimate public interest in disclosure against the interests of the individual whose data it is. The guidance makes the point that although this requires consideration of the public interest in disclosure it is not the same as the public interest test.
3. Commercial Interests of Third Parties
Section 43 contains an exemption from disclosure where this would prejudice the commercial interests of third parties.
The ICO's guidance states that reliance on this exemption must be based on a genuine concern for the third party, and when relying on this exemption the public authority must explain the reason for their concern. Where possible, the third party must be asked for their opinion unless input cannot realistically be obtained, for example as a result of time constraints. If the third party does not express any concern regarding the disclosure of the information then the public authority should not put forward any of its own arguments.
As this is not an absolute exemption, a public interest test will be applied in relation to disclosure. The onus is on the public authority to rebut the presumption that the public interest in disclosure outweighs the public interest in withholding the information.
The publication of guidance by the ICO is generally very helpful in providing clarification and practical guidance on what can be a very complex area of law. These guidance notes apply to the UK legislation only and reference should be made to the guidance notes provided by the Scottish information Commissioner on questions of interpretation of the Freedom of Information (Scotland) Act 2002.
For those in the private sector, it is important to be aware of the fact that when contracting with public authorities, the terms of their contract are likely to be open to disclosure and public scrutiny, even where confidentiality provisions are in place.