Chapters: 01 | 02 | 03 | 04 | 05 | 06 | 07 | 08 | annex A | annex B
3.1 If a request for information under the Act includes information which may fall within this exemption, three questions must be asked. If the answer to any of the questions is 'no', the information will not be exempt under section 41:
Each of these questions is examined in turn below.
3.2.1 Section 41 only protects information which was obtained by a public authority from "any other person (including another public authority)". The origin of the information could be a natural person, in other words an individual, or a group of individuals or an organisation.
3.2.2 Whilst this exemption may apply where a duty of confidence is owed by one public authority to another, it will not apply where both of those public authorities are government departments. Although government departments are treated as separate persons for the purposes of FOI (section 81(1)), a government department cannot claim that the disclosure of any information by it would constitute a breach of confidence actionable by any other government department (section 81(2)). The same applies between Northern Ireland departments but not between a Northern Ireland department and a UK department: a UK department can claim that the disclosure of information by it would constitute a breach of confidence owed to a Northern Ireland department, and vice versa.
3.2.3 For example, the Department for Constitutional Affairs could not claim that information is exempt by virtue of section 41 because its disclosure would breach a duty of confidence which it owes to the Department for Transport. On the other hand, section 41 may apply where the Department for Constitutional Affairs owes a duty of confidentiality to the Office of the First Minister and the Deputy First Minister of Northern Ireland.
3.2.4 The phrase, "by another person", will usually require the information to have been obtained from outside the department and not from an employee. However, this will not always be the case. Section 41 may apply where disclosure would breach a duty of confidence which a public authority owes to an employee in their private capacity (other exemptions may also apply, in particular section 40). On the other hand, if the information is disclosed in the course of employment, when an employee is acting on behalf of the public authority and solely in the capacity of employee, there will be no duty of confidentiality for the purposes of section 41.
For example, person A works for a regulatory public authority and a member of his family, person B, informs him of certain mal-practices of which he has become aware. Person A 'whistle-blows' by passing this information to his employer public authority, in the expectation that it will be kept confidential. Person A has provided the information in a private capacity and, in public law terms, the information has been obtained from 'another person'. The fact that A also has an 'official' capacity does not mean that section 41 will not protect the information: his confidence will be protected in the same way as a non-employee who 'whistle-blows'.
3.2.5 The person from whom the information was obtained may not be the person whose confidence is being protected; the information may have passed through the hands of another person before reaching the public authority.
3.2.6 For section 41 to apply, the public authority does not have to have obtained the information with the active involvement of another person. For example, if a public authority takes a photograph and that photograph includes confidential information about the subject of the photograph (for example, if it shows where that person is receiving medical treatment), section 41 may apply even though the subject of the photograph did not provide the information in an active sense or even know that the photograph had been taken.
3.3.1 Public authorities routinely hold information which has been obtained from other public bodies, private organisations and individuals to which obligations of confidence are likely to attach. For example: frank exchanges of views with other public authorities; information which is commercially sensitive; and the personal, private information of individuals.
3.3.2 Information will only be held subject to a duty of confidence if it has the "necessary quality of confidence" [footnote 1]. This means that it must be information which is worthy of protection; someone must have an interest in the information being kept confidential. For example, even if a commercial contract states that everything in the contract is 'confidential', any useless or trivial information cannot be confidential and no duty of confidence will arise in relation to that information.
3.3.3 For information to be 'confidential' it must also be "inaccessible" in the sense of not being in the public domain or a matter of public knowledge. Whether information is in the public domain is a question of degree; it will depend on the circumstances and the extent of public knowledge at the time when disclosure is requested. Information relating to an act which is done in a public place may still be private information and, equally, an activity is not necessarily private simply because it is not done in public.
3.3.4 For example, in Campbell v MGN Limited [footnotes 2], the House of Lords found that publication of a photograph of the claimant leaving a narcotics anonymous meeting could be a breach of confidence, even though the claimant had been in a public place: the photograph enabled the location of the claimant's treatment for her addiction to be identified.
3.3.5 As explained above, the courts will recognise that a person holds information subject to a duty of confidence in two types of situations:
a. where that person expressly agrees or undertakes to keep information confidential: there is an express duty of confidence.
3.3.6 Where a public authority expressly agrees to keep information confidential, a duty of confidence is likely to arise provided that the information has the necessary quality of confidence. For example, where a public authority signs a contract which contains a confidentiality clause or agrees in correspondence that, if information is provided, it will be kept confidential.
3.3.7 Whilst it will usually be a question of fact whether a public authority has agreed to or undertaken a duty of confidence, there are important policy considerations involved in the question of whether it is appropriate for a public authority to agree to a duty of confidence. As explained above, public authorities must consider the application of this exemption not only when disclosure of confidential information is requested but also when potentially confidential information is obtained. If information does not need to be kept confidential but a public authority expressly agrees to keep it confidential when it is obtained, this may result in the information being exempt from the Act under section 41. In light of the public interest in open government and freedom of information, public authorities must consider carefully whether it is appropriate to agree to keep information which it receives, confidential.
3.3.8 The Lord Chancellor has issued a Code of Practice under section 45 of the FOI Act. Paragraph 47 deals with the circumstances in which a public authority should accept information in confidence:
This code has considerable force: it is one of the duties of the Information Commissioner to promote its observance and there is a legitimate expectation that public authorities will adhere to it. It is also likely that a court would take its provisions into account when determining whether a public authority has complied with the FOI Act.
3.3.9 When considering whether to agree to hold information subject to a duty of confidentiality, the following factors may be relevant:
3.3.10 If it is necessary and justifiable for a public authority to agree to keep the information confidential, that public authority should take practical steps to respect the confidential nature of the information (see Annex B). Ensuring that the circulation of confidential information is controlled and that the confidential status of that information is regularly reviewed will assist with responding to future FOI requests.
b. where the nature of the information or the circumstances in which the information is obtained imply that the person should keep the information confidential: there is an implied duty of confidence.
3.3.11 Even though a public authority has no pre-existing relationship with the person to whom the duty is owed, or has not agreed to keep the information confidential, an implied duty of confidence may still arise if the circumstances so dictate.
3.3.12 Some information which is obtained by a public authority will be manifestly confidential; by its very nature it will be clear both that substantial harm could be caused by its disclosure and that the public authority should not disclose it to members of the public. For example, a public authority obtains the medical records of an individual: in most circumstances, it will be clear that disclosure of that information to the public could cause substantial harm and offence to that individual. In this type of situation, the law may step in to imply a duty of confidence: the public authority may be obliged, by virtue of the very nature of the information, to keep it confidential. Whether the nature of the information concerned means that it is held subject to a duty of confidence is a question of degree and will, to a certain extent, depend on the circumstances at the time that disclosure is requested.
3.3.13 The circumstances in which information was obtained may impose an implied duty of confidence in relation to information which is not obviously of a confidential nature (i.e. where the public authority may not be immediately aware of its confidential nature). For example, if a public authority has statutory powers of compulsion, that is to say if it can legally oblige people to provide information for certain purposes, a duty of confidentiality will often arise in relation to that information and the public authority may be prohibited from disclosing the information in other contexts [footnote 3]. This may also apply where information is provided under 'threat of compulsion', that is, where a person provides information to a public authority in the knowledge that, if they did not do so, the public authority would use its powers to compel disclosure. Additionally, when a public authority obtains information for a particular purpose, a duty of confidentiality may arise which prevents that information being used for a different purpose. For example, confidentiality attaches to information which is given to the police during the course of a criminal investigation, whether it is given by a suspect under caution or by a potential witness. [footnote 4]
3.3.14 Other factors which may be relevant to ascertaining whether information is held subject to an implied duty of confidence could include the following:
3.3.15 Whether an implied duty of confidence arises is essentially a question of law. If a public authority has not expressly agreed to keep information confidential but suspects that a duty of confidence may be implied, it will often be necessary to seek legal advice.
3.3.16 Would the disclosure of this information to the public, otherwise than under the FOIA, constitute an actionable breach of confidence?
3.4.1 For a disclosure to breach a duty of confidence it must be unauthorised. Unauthorised disclosure could take place where disclosure runs contrary to the express wishes of the person to whom the duty is owed or where a department does not have the consent of the person concerned. If a person has sanctioned disclosure of the information, for example if they have expressly consented to disclosure, section 40 will not apply as disclosure would not be a breach of confidence actionable by that person.
3.4.2 See section 5 below in relation to the consultation of third parties and when this will be appropriate. If a person has not responded to consultation or has objected to disclosure, this will not be determinative of the application of section 41.
3.4.3 The courts have recognised that disclosure will not constitute an actionable breach of confidence if there is a public interest in disclosure which outweighs the public interest in keeping the information confidential. When considering the application of section 41, departments must consider whether the public interest in disclosure of the confidential information concerned means that it would not constitute an actionable breach of confidence to disclose that information to the public. The following principles must be applied when conducting this balancing test:
3.4.4 As explained above, if this exemption is wrongly applied and information is wrongly withheld, a public authority may face sanctions under the Act for not complying with the duty to provide information. However, if the exemption is wrongly applied and information is wrongly disclosed, a public authority may, in some circumstances, face an action for breach of confidence. In balancing the relevant public interests, the question to be asked is what conclusion would a court come to if the information were disclosed to the public and an action for breach of confidence was brought? That is to say:
3.4.5 As explained above, when considering the public interest balancing test, no regard may be had to the motive for the FOI request nor to the effect which disclosure to that particular requester would have. However, regard must be had to the effect which disclosure to the public would have. Examples of cases where there may be a public interest in the disclosure of confidential information include:
Examples of cases where the public interest is unlikely to favour the disclosure of information may include:
These examples are for illustrative purposes only. Decisions on which way the delicate balance of arguments may rest will vary on a case by case basis and will, in most cases, require legal advice.
3.4.6 In the context of the public interest balancing exercise under section 41, there is an important distinction to be drawn between a duty of confidence owed by a public authority to a private person and a duty owed by one public authority to another. There is no general public interest in keeping confidential information which relates to the activities of public bodies. This applies in particular to 'old' information: there is no public interest in keeping confidential the historical activities of public authorities. (NB. If both public authorities are government departments, see paragraph 3.2.2 above.)
3.4.7 If the only interests to be protected by non-disclosure of the requested information are the interests of another public authority (rather than a third party) then the question to ask is: would the public authority to which the duty is owed be able to refuse an FOI request for that information? If it would be able to refuse because an exemption would apply, the information will be exempt under section 41. If it would not be able to so refuse, section 41 will not apply. If a public authority considers that section 41 may apply by virtue of a duty of confidence which it owes to another public authority, it should consider consulting that authority (see chapter 5).