The exemption for personal information - updated ICO guidance

The Information Commissioner's Office has published updated guidance on the exemption for personal information in section 40 of the FOI Act.

Personal data of any other person (third party data) is exempt under section 40(2) if disclosure would breach one of the data protection principles. Generally this will mean considering whether it is unfair to release the information and balancing the necessary public interest in disclosure against the interests of the individual under the first principle.
...
As disclosure under the FOIA is considered disclosure to the public at large and not to the individual applicant, you will therefore need to balance the legitimate public interest in disclosure against the interests of the individual whose data it is. Although this requires consideration of the public interest in disclosure, the test is not the same as the public interest test used for qualified exemptions and there is no assumption of disclosure.

Following the Tribunal decision in Corporate Officer of the House of Commons v Information Commissioner and Leapman, Brooke and Thomas (EA/2007/0060 etc; 26 February 2008) (upheld on appeal by the High Court1), we recommend that public authorities approach condition 6 as a three-part test:

1. there must be a legitimate public interest in disclosure;

2. the disclosure must be necessary to meet that public interest; and

3. the disclosure must not cause unwarranted harm to the interests of the individual.

The exemption for personal information - version 3 (11 November 2008)