The ICO exists to empower you through information.

FOI and other laws

Share Download options

Pages

Format

At a glance

A request for the applicant’s own personal data should be dealt with as a  subject access request under provisions the Data Protect Act 2018. Personal data about other people should only be disclosed if doing so wouldn’t infringe the UK General Data Protection Regulation.

Following disclosure, Copyright and intellectual property can still be enforced. The Re-use of Public Sector Information Regulations are relevant where the applicant wishes to reuse the information for a commercial purpose.

There are exemptions which apply when a statutory prohibition prevents the disclosure of information and which protect information provided in confidence. There’s also an exemption where access is provided under other legislation.  

In brief

How does the Freedom of Information Act affect data protection? 

The UK General Data Protection Regulation (the UK GDPR) and the Data Protection Act 2018 (the DPA 2018) give rules for handling information about people. They include the right for people to access their personal data. The Freedom of Information Act and the DPA 2018 come under the heading of information rights and are regulated by the ICO.

When a person makes a request for their own information, this is a data protection subject access request. However, members of the public often wrongly think it is the Freedom of Information Act that gives them the right to their personal information, so you may need to clarify things when responding to such a request.

The UK GDPR and the DPA 2018 exist to protect people’s right to privacy, whereas the Freedom of Information Act is about getting rid of unnecessary secrecy. These two aims are not necessarily incompatible but there can be a tension between them, and applying them sometimes requires careful judgement.

When someone makes a request for information that includes someone else’s personal data, you will need to carefully balance the case for transparency and openness under the Freedom of Information Act against the data subject’s right to privacy under the data protection legislation. You will need to decide whether you can release the information without infringing the UK GDPR data protection principles.

See When can we refuse a request? for more information on the exemptions for personal data.

How does the Freedom of Information Act affect copyright and intellectual property?

The Act does not affect copyright and intellectual property rights that give owners the right to protect their original work against commercial exploitation by others. If someone wishes to re-use public sector information for commercial purposes, they should make an application under the Re-use of Public Sector Information Regulations. See the What is PSI? section of the National Archives website for more information on this. The ICO does not have any powers to regulate copyright or the re-use of information.

When giving access to information under the Act, you cannot place any conditions or restrictions on that access. For example, you cannot require the requester to sign any agreement before they are given access to the information. However, you can include a copyright notice with the information you disclose. You can also make a claim in the courts if the requester or someone else uses the information in breach of copyright. The ICO encourages public authorities to use the Open Government Licence provided by the National Archives.

In most cases re-use of information released under the Act is dealt with under RPSI. RPSI applies to most but not all public authorities; for example, universities in general are not covered by RPSI although their libraries are. For public authorities that are not subject to RPSI, there are some re-use provisions in the Act but they only apply to one type of information, namely datasets. Under these provisions, if you are releasing a dataset that is a ‘relevant copyright work’ and you are the only owner of the copyright or database rights, then you must release it under a licence that permits re-use. The licences to use for this are specified in the section 45 code of practice on datasets. If the dataset can be re-used without charge, then the appropriate licence will usually be the Open Government Licence.

For further information, read our more detailed guidance:

What other laws may we need to take into account when applying the Freedom of Information Act?

The Freedom of Information Act may work alongside other laws.

Some of the exemptions in the Act that allow public authorities to withhold information use principles from common law, for example the section 41 exemption refers to the law of confidence.

Also, section 44 of the Act allows information to be withheld when its disclosure is prohibited under other legislation, and section 21 can exempt information that is accessible to an applicant using procedures in other legislation. See When can we refuse a request? for more information on the exemptions.

When dealing with requests for information, you should continue to be aware of your obligations under the Equality Act 2010 (or Disability Discrimination Act 1995 in Northern Ireland). These Acts are not regulated by the ICO so they are not covered in this guidance.

You should handle requests for environmental information under the Environmental Information Regulations 2004. The Regulations also require you to make environmental information available proactively by readily accessible electronic means. If you are likely to be handling requests for information, you will need to familiarise yourself with the basics of the Regulations, especially the definition of ‘environmental information’, found in regulation 2(1).

If you are a public sector body as defined by RPSI then most of the information you hold as part of your public task must be made available for re-use on request. Most, but not all public authorities are public sector bodies under RPSI. Libraries, museums and archives are covered but they have discretion as to whether to permit re-use. RPSI applies to information in which you, as the public sector body, hold the intellectual property rights but does not generally apply to information that is exempt from disclosure under the Act or under the Environmental Information Regulations.

The Infrastructure for Spatial Information in the European Community Regulations 2009 came into force on 31 December 2009. You will need to take these into account when considering your duty under the Freedom of Information Act to proactively publish information, as they require public authorities to make ‘spatial data sets’ (sets of data linked to geographical locations) publicly available in a consistent and usable electronic format.

For further information, read our more detailed guidance: