At a glance
A request for the applicant’s own personal data should be dealt with as a subject access request under provisions the Data Protect Act 2018. Personal data about other people should only be disclosed if doing so wouldn’t infringe the UK General Data Protection Regulation.
Following disclosure, Copyright and intellectual property can still be enforced. The Re-use of Public Sector Information Regulations are relevant where the applicant wishes to reuse the information for a commercial purpose.
There are exemptions which apply when a statutory prohibition prevents the disclosure of information and which protect information provided in confidence. There’s also an exemption where access is provided under other legislation.
- How does the Freedom of Information Act affect data protection?
- How does the Freedom of Information Act affect copyright and intellectual property?
- What other laws may we need to take into account when applying the Freedom of Information Act?
The UK General Data Protection Regulation (the UK GDPR) and the Data Protection Act 2018 (the DPA 2018) give rules for handling information about people. They include the right for people to access their personal data. The Freedom of Information Act and the DPA 2018 come under the heading of information rights and are regulated by the ICO.
When a person makes a request for their own information, this is a data protection subject access request. However, members of the public often wrongly think it is the Freedom of Information Act that gives them the right to their personal information, so you may need to clarify things when responding to such a request.
The UK GDPR and the DPA 2018 exist to protect people’s right to privacy, whereas the Freedom of Information Act is about getting rid of unnecessary secrecy. These two aims are not necessarily incompatible but there can be a tension between them, and applying them sometimes requires careful judgement.
When someone makes a request for information that includes someone else’s personal data, you will need to carefully balance the case for transparency and openness under the Freedom of Information Act against the data subject’s right to privacy under the data protection legislation. You will need to decide whether you can release the information without infringing the UK GDPR data protection principles.
See When can we refuse a request? for more information on the exemptions for personal data.
The Act does not affect copyright and intellectual property rights that give owners the right to protect their original work against commercial exploitation by others. If someone wishes to re-use public sector information for commercial purposes, they should make an application under the Re-use of Public Sector Information Regulations. See the What is PSI? section of the National Archives website for more information on this. The ICO does not have any powers to regulate copyright or the re-use of information.
When giving access to information under the Act, you cannot place any conditions or restrictions on that access. For example, you cannot require the requester to sign any agreement before they are given access to the information. However, you can include a copyright notice with the information you disclose. You can also make a claim in the courts if the requester or someone else uses the information in breach of copyright. The ICO encourages public authorities to use the Open Government Licence provided by the National Archives.
In most cases re-use of information released under the Act is dealt with under RPSI. RPSI applies to most but not all public authorities; for example, universities in general are not covered by RPSI although their libraries are. For public authorities that are not subject to RPSI, there are some re-use provisions in the Act but they only apply to one type of information, namely datasets. Under these provisions, if you are releasing a dataset that is a ‘relevant copyright work’ and you are the only owner of the copyright or database rights, then you must release it under a licence that permits re-use. The licences to use for this are specified in the section 45 code of practice on datasets. If the dataset can be re-used without charge, then the appropriate licence will usually be the Open Government Licence.
For further information, read our more detailed guidance: