1. Private information relating to individuals, such as details of an individual's physical or mental health, is likely to attract greater protection than commercial information or information relating to the functions of public authorities. Private, personal information is more likely to be 'confidential' information by its very nature and to be held subject to expectations of privacy, particularly where disclosure would affect the private and family lives of individuals, as protected by Article 8 of the ECHR. A duty of confidence is more likely to be implied from the nature of the information itself and it is unlikely that personal information will be considered trivial or useless.
2. The House of Lords in Campbell v MGN considered, in detail, when an action for breach of confidence will arise in relation to personal information, and asked two questions:
   1. The first question to ask is, is the information 'private'; is there a private interest which the individual would wish to protect? In other words, would the disclosure of the information give substantial offence to a person of ordinary sensibilities who was placed in similar circumstances? Whilst the fact that an individual is particularly sensitive is not relevant to this question, the circumstances in which that person is placed are relevant.
      
      The ECHR has had a considerable impact in this area: the effect which disclosure of information could have on a person's private and family life, as protected by Article 8, is important. The facts of the Campbell case provide a useful illustration of this: even though the fact that the claimant was an addict and was receiving treatment was public information, details of the treatment which she was receiving and the location of that treatment were private; their disclosure could seriously affect the claimant's private life and the continuation of the treatment.
   2. The second question is whether the interest in protecting an individual's privacy, as per Article 8, is outweighed by any other interest. Although personal information enjoys particularly stringent protection under the law of breach of confidence, the public interest in keeping the confidence may in some circumstances be outweighed by countervailing public interests in disclosure. For example, disclosure may be in the interests of freedom of expression (as protected by Article 10 of the ECHR) or in the interests of protecting the rights and freedoms of others. There is a public interest in ensuring scrutiny of the activities of public authorities and the FOI regime enhances the weight to be attached to this interest. However, if information is private, personal information of the type whose disclosure would engage Article 8 (as opposed, for example, to information relating to an individual in an 'official' capacity, for example if that person is a public office holder), it is unlikely that the public interest in open government will outweigh the public interest in keeping the confidence.
   Even if there is a legitimate aim which is pursued by disclosure, the effect of the disclosure on the Article 8 rights of the person affected must be proportionate to the legitimate aim. For example, in the case of Peck v UK [footnote 5], CCTV footage picked up the applicant walking down a road with a knife in his hand. The applicant had tried to commit suicide. The CCTV operating notified the police who were able to stop him. The CCTV footage was subsequently broadcast, without concealing the identity of the applicant, to demonstrate how its use could assist the police in averting dangerous situations. This interfered with the applicant's Article 8 right to respect for his private and family life. Although the broadcast pursued the legitimate aim of promoting the use of CCTV to prevent and detect crime, the authority could have masked the identity of the applicant or sought his consent. There were not sufficient reasons to disclose the information without taking these steps and the interference with the applicant's Article 8 rights was therefore not proportionate to the legitimate aim.
3. There are a number of other exemptions which may apply to personal information, in addition to section 41, and departments should consider carefully which exemptions it is appropriate to use in the circumstances.

Section 40 exempts information which constitutes personal data and whose disclosure would breach the data protection principles. In many situations, confidential personal information will also be personal data within the meaning of the Data Protection Act 1998. If information does not fall within section 41 because its disclosure would not breach a duty of confidence, it may still breach another aspect of the data protection principles. If disclosure would breach a duty of confidence, that disclosure will be unlawful and will breach the first data protection principle

Section 44 exempts information whose disclosure is prohibited by or under any enactment, which includes the Human Rights Act 1998. Departments must comply with section 6 of the Human Rights Act 1998 which makes it unlawful for a public authority to act in a way which is incompatible with the Convention rights. If disclosure would breach Article 8 of the ECHR, the information will be exempt under section 44.