Section 40 concerns personal data within the meaning of the Data
Protection Act 1998. Section 40 applies to two distinct types
of requests for information:
if a request asks for the personal data of the applicant himself,
the information is exempt; and
if a request asks for the personal data of someone else then that
information will be exempt if its disclosure would contravene any of
the data protection principles in the Data Protection Act 1998 (or certain
other provisions of the Data Protection Act 1998).
Key points:
If information is exempt under section 40 because it is the personal
data of the applicant then its disclosure must be considered under the
subject access provisions in the Data Protection Act 1998; the Act may
require the disclosure of information which would otherwise
have been exempt under the FOI Act.
For most government departments that receive requests for personal
data of someone other than the applicant, the application of section
40 will in most circumstances turn on whether disclosure of the information
to a member of the public would be 'unfair'.
Officials must be alive to the need to consult experts where the application
of section 40 is difficult or unclear: getting a decision wrong may
result in breach of the Data Protection Act 1998.
The majority of section 40 is not subject to a public
interest balance.
