Obtaining consent for FOI disclosure from data subject [Archived]
Produced in partnership with Kim Mayo of Essex County Council

The following Public Law practice note produced in partnership with Kim Mayo of Essex County Council provides comprehensive and up to date legal information covering:

  • Obtaining consent for FOI disclosure from data subject [Archived]
  • Scope of exemption
  • When is consent needed?
  • Whether consent is provided?
  • The data subject consents to disclosure within time for statutory compliance
  • The requester has indicated that the data subject has consented
  • Data subject has not consented (or not been asked to consent)
  • Fairness
  • Sensitive personal data

ARCHIVED: This Practice Note has been archived and is not maintained.

Scope of exemption

Disclosure of personal data under freedom of information (FOI) will be exempt if that disclosure would contravene data protection principles or a notice under section 40 (3) of the Data Protection Act 1998 (DPA 1998), or if the information is exempt under DPA 1998, s 40(4) (enforcement notice). In most cases the exemption under contravention of data protection principles is used. This exemption is absolute, but the public authority needs to consider fairness.

Disclosure is permissible where the data subject has consented. However, the fact that consent has been withheld is not the end of the matter. The public authority is required to consider the fairness against each of the points raised above of disclosing the information against the refusal or silence where consent has neither been given or refused.

When is consent needed?

For data to constitute personal data, it must relate to a living individual and that individual must be identifiable. In many cases an FOI request will be clear if it relates to an individual but personal data may be engaged even if the FOI request does not refer to individuals by name, for example a job title or even if an individual will be identifiable from anonymised data.

If the personal data requested relates to the requester, then the requester should apply

Popular documents