Devon Partnership NHS Trust

The complainant has requested a copy of a Data Protection Impact Assessment (‘DPIA’). Devon Partnership NHS Trust (“the public authority”) disclosed a redacted copy of the DPIA, with redactions made under section 31(1)(f). The Commissioner’s decision is that the majority of the withheld information engages section 31(1)(f) and the public interest lies in maintaining the exemption. However, there’s information that’s been withheld that doesn’t engage the exemption and therefore must be disclosed. In failing to disclose all non-exempt information within the statutory timeframe, the public authority has breached section 10 (timescale for compliance) of FOIA. The public authority’s refusal also failed to comply with section 17 (refusal notice) of FOIA. The Commissioner requires the public authority to take the following steps to ensure compliance with the legislation: disclose the information identified in this decision notice.