The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

ICO clarifies law on information held in private email accounts

Subscribe to our latest news

News release: 15 December 2011


The Information Commissioner’s Office (ICO) has today published new guidance making it clear that information concerning official business held in private email accounts is subject to the Freedom of Information Act.

Information Commissioner, Christopher Graham said:

“It should not come as a surprise to public authorities to have the clarification that information held in private email accounts can be subject to Freedom of Information law if it relates to official business. This has always been the case – the Act covers all recorded information in any form.

“It came to light in September that this is a somewhat misunderstood aspect of the law and that further clarification was needed. That’s why we’ve issued new guidance today with two key aims – first, to give public authorities an authoritative steer on the factors that should be considered before deciding whether a search of private email accounts is necessary when responding to a request under the Act. Second, to set out the procedures that should generally be in place to respond to requests. Clearly, the need to search private email accounts should be a rare occurrence; therefore, we do not expect this advice to increase the burden on public authorities.”

Key points set out in the guidance include:

  • Where a public authority has decided that a relevant individual’s email account may include official information which falls within the scope of the request and is not held elsewhere, it will need to ask that individual to search their account.
  • Where people are asked to check private email accounts, there should be a record of the action taken. The public authority needs to be able to demonstrate, if required, that appropriate searches have taken place.
  • Although the main emphasis of the guidance is on official information held in private email accounts, public authorities should be aware that the law covers information recorded in any form.
  • Public authorities should remind staff that deleting or concealing information with the intention of preventing its disclosure following receipt of a request is a criminal offence under section 77 of the Act.
  • It is accepted that, in certain circumstances, it may be necessary to use private email for public authority business. There should be a policy which clearly states that in these cases an authority email address should be copied in to ensure the completeness of the authority’s records.

Mr Graham continued:

“As part of our work on understanding more generally how FOI handling works across government, we conducted a good practice visit at the Department for Education. We’ve today published the findings of that visit and are now keen to carry out similar visits to other Whitehall departments. Work on specific complaints made to the Commissioner about the Department of Education’s handling of individual FOI requests is still ongoing. We hope to issue our decisions on these cases early in the New Year.” 

 

Notes to Editors

1. The Information Commissioner’s Office upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

2. The ICO has specific responsibilities set out in the Data Protection Act 1998, the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003.

3. Anyone who processes personal information must comply with eight principles of the Data Protection Act, which make sure that personal information is:

  • Fairly and lawfully processed
  • Processed for limited purposes 
  • Adequate, relevant and not excessive
  • Accurate and up to date 
  • Not kept for longer than is necessary 
  • Processed in line with your rights 
  • Secure 
  • Not transferred to other countries without adequate protection 

4. The ICO is on Twitter, Facebook and LinkedIn. Read more in the ICO blog and e-newsletter.

5. If you need more information, please contact the ICO press office on 0303 123 9070 or ico.gov.uk/press