Data Protection and Freedom of Information

Getting information from public bodies

Access to general information

The Freedom of Information Act 2000 (FOIA) provides the right of access to recorded information held by a public authority. It applies to all categories of information held, with the exception of your own personal data.

The What do They Know site is run by UK Citizens OnLine Democracy and help people access information about central government, local government, Parliament, the NHS, the armed forces, state funded schools and universities and other public authorities.

The blog ‘Information Rights and Wrongs’ has some useful discussion of data protection issues and disclosure. See this post relating to the ‘balancing of interests test’ when considering if personal data should be disclosed.

The Information Commissioner’s Officer sets out a clear guide to making requests for information. In particular you are advised to consider the following points before making your request:


  • Is the information you want already available, for example, on the authority’s website?
  • Is the information you want your own personal data? (If so, you will need to make a subject access request, which we discuss below)
  • Is the authority likely to have the information? Public authorities must give reasonable advice and assistance to anyone asking for information, so you should feel free to ask for help in making your request.
  • Is the information you want suitable for general publication. The aim of the Freedom of Information Act is to make information available to the general public. You can only obtain information that would be given to anybody who asked for it, or would be suitable for the general public to see.
  • Some information, such as records about a dead relative, or documents you need for legal purposes, may not always be available under the Act. However, you may have a right to see the information you want under other legislation. The public authority holding the information you want should advise you.

It is also a good idea to think clearly about how you are going to frame your request. For example, a FOI request asking a LA to confirm ‘how many corrupt social workers it employs’ is very unlikely to meet with any useful response as this is simply too broad and general a request.

The ICO advises as follows:

If your request does lack any serious or clear purpose or if it is not focused on acquiring information, then the FOIA and EIR are probably not an appropriate means through which to pursue your concern. You might do better to explore whether there are other more suitable channels through which to take up the issue with the authority.

You should also bear in mind that the FOIA includes a safeguard against requests which exceed the cost limits for compliance (Section 12). The equivalent provision in the EIR is once again [Regulation 12(4)(b)] – manifestly unreasonable requests .

Therefore, if you are planning to ask for a large volume of information, or make a very general request, you should first consider whether you could narrow or refocus the scope of the request, as this may help you get what you really want and reduce any unnecessary burden or costs on the authority. Alternatively, you could try approaching the public authority for advice and assistance to help you reduce the scope of your request and cut down the cost of compliance – they have a duty to consider what advice and assistance they can provide.

Although you don’t have to say why you want the information, if you are happy to do so it might avoid a lot of wasted time and be more likely to get you what you want.


Access to information about you

The Data Protection Act 1998 (DPA) provides you with the right to access information that relates to you personally.

Section 7 allows individuals to make requests for their personal information, which is defined as data that must relate to a living individual and allow that individual to be identified from it (either on its own or along with other information likely to come into the organisation’s possession).

Section 36 makes it clear that individuals do not need the consent of professionals to record meetings/visits, as the information being discussed in that situation is personal to them and therefore exempt from the data protection principles. There may be problems if the meeting is going to deal with issues relating to a third party. For further discussion about recording meetings between parents and social workers, see this post. 

Data Subject Access Request (DSAR)

Applying for information about yourself is called a Data Subject Access Request (DSAR). It can be helpful to ask the LA  for all documentation relating to your case, such as internal emails, if you are not happy with the way your case has been handled.

For further information, see the helpful Advice Sheet about access to records published by the Family Rights Group.

Children can also make requests, if they are considered to be sufficiently mature to understand what they are doing. To request your information, you should write to the Children’s Services department which is holding the information about you stating clearly what information you want and that you are asking for it under the Data Protection Act.

The Information Commissioner has provided a ‘Subject Access Code of Practice’ to help organisations deal with such requests for personal data by individuals. The maximum charge that can be made is £10 and organisations must respond within 40 days. 


How long can a LA hold information about you?

See this post from suesspicioussminds who discusses the case involving Northumberland County Council [2015] who were accused of acting unlawfully in holding on to data for 35 years. The claimant said he had been unfairly treated by the LA and he wanted his records destroyed. The Judge found that the LA were not acting unlawfully; there could be good reasons for holding on to such data – such as providing information to help later investigations into child abuse or malpractice.

Northumberland’s policy is:

… specifically to retain the records for 35 years after the case is closed, unless the child is or becomes looked after (in which case the retention policy is 75 years from the date of birth) or adopted (in which case the retention period is 100 years from the date of the Adoption Order).

Individual LA’s may have different policies and apply different time periods. What the Northumberland case makes clear is that this particular policy has survived legal challenge and found to be lawful. So it may be that information is retained for a considerable time.


Contact the Information Commissioner

The Information Commissioner’s Office is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals. You can find out more here.

If you are not happy with the way a public body deals with your request for information,  you can make a complaint to the Information Commissioner.

Information Commissioner’s Office
Wycliffe House
Water Lane

Telephone: 0303 123 1113
Fax: 01625 524 510
Email the Information Commissioner:


5 thoughts on “Data Protection and Freedom of Information

  1. C

    …Sad to say the ICO are by their own admission toothless. As an individual the best you can expect from them is a ‘compliance unlikely’ decision, which you can then take to court. They will not support their semi-decision, and say that the judge will frequently ignore it. The local authority are under no compunction to follow the decisions of the ICO, although they usually comply, to some minimal degree. In our particular case, the LA agreed to add comments to the inaccuracies, stating that we thought they were inaccurate. The LA said that this was approved by the ICO. The ICO said that they didn’t disagree that it might be appropriate, and that they didn’t disapprove… They weren’t prepared to press the LA any further, saying that we should take the matter to court.

    Of course taking the LA to court in these dark times, can be expensive even if you win.

    Another option to consider is an appeal to the LA under section 10 of the DPA:

    … an individual is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing, or processing for a specified purpose or in a specified manner, any personal data in respect of which he is the data subject, on the ground that, for specified reasons—

    (a) the processing of those data or their processing for that purpose or in that manner is causing or is likely to cause substantial damage or substantial distress to him or to another, and
    (b)that damage or distress is or would be unwarranted.

    Anyway, the message is: don’t expect much from the ICO.

  2. C

    I should add that the inaccuracies in our case are multiple, significant, and 100% demonstrable. They are not at all a matter of opinion or point of view, and so the LA’s agreement to place comments alongside ‘what we consider inaccuracies’ is a breach of the DPA, which the ICO are supposed to enforce. What ho!

  3. Sarah Phillimore

    Thanks for comments C. I hope it is some small crumb of comfort that your negative experiences may illuminate a path for others…

  4. C

    ‘Unfortunately’ there is an army of families out there who have been treated in much the same poor way. Misfeasance has become standard procedure. And no obvious path is illuminated.

    I bother to write comments here – and elsewhere – just in case someone with some power – Edward Timpson, for example, or Isabelle Trower – or an academic that somebody might listen to, like June Thorburn, or Harry Ferguson (…I don’t know whether anyone in the executive even listens to these people, actually…) might stumble onto them, and care that this kind of injustice is occurring so frequently under their radar.

    For instance, that the statutory framework ‘Getting the Best from Complaints’ can be thoroughly flouted and abused, and nobody at the LGO thinks that matters, and nobody at the Dept. of Education cares because, to quote Matthew Tagney, ‘it was initiated by a previous administration’.

    Somehow what has happened to us is considered insignificant because they didn’t actually come and steal our children. The LGO tell us we should consider ourselves ‘fortunate’, even though there was never any cause for our being investigated. ‘Fortunate’ that the LA only sent them false information, and are only maintaining inaccurate records on our family for 21 years. ‘Fortunate’ not to have had to undergo a full s. 47.

    Oh, fortuna, when did law become a lottery?
    And imprecation and kow-towing a necessity?

    When did justice stop even bothering to resemble justice?

  5. Sarah Phillimore Post author

    When ‘targets’ began to drive public services. And when for ‘targets’ they really mean ‘saving money in the short term’. When ‘management’ from behind the scenes became more important than the front line. When the culture grew and solidified of never taking responsibility but trying to push blame off on to someone else.

    But if you have a system that is now set up to pay hypocritical lip service to principle and buries everything under a mass of ‘targets’ it is small wonder that those in the system become jaded and may feel they have nothing left worth sticking up for.

Comments are closed.