Cabinet Office Homepage
Last updated: 24 November 2008
Issue
1. In responding to a subject access request, departments will frequently discover information containing personal data relating to the data subject which also contains references to Ministers and officials, whether in that department, or in another.
2. In terms of the Data Protection Act, these references to Ministers and officials should be treated broadly in the same way as references to any other individuals who are not the data subject (see section 8 of this handbook). However, because of the fact that references to Ministers and officials are likely to be among the commonest of references to other individuals, this section expands on the specific considerations which are likely to arise.
3. Note that section 7(4) et seq, which relate to a data subject’s rights of access, do not refer to a “third party”, which is defined in section 70 of the DPA to mean:
4. Section 7(4) refers to the wider concept of “another individual”. Ministers and officials of a department are not therefore third parties but are other individuals who themselves have certain rights to protection of information relating to them.
5. Section 7 of the DPA provides, inter alia, that:
“… (4) Where a data controller cannot comply with the request without disclosing information relating to another individual who can be identified from the information, he is not obliged to comply with the request unless –
(5) In subsection (4) the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request; and that subsection is not to be construed as excusing a data controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by omission of names or other identifying particulars or otherwise.
(6) In determining for the purposes of subsection (4)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard shall be had in, particular,
to -
6. Ministers and officials are entitled to the same rights of confidentiality as other members of the public, and to the same rights provided by the Data Protection Act. Their names should not be disclosed routinely, but each case must be considered on its merits. In practice, in some instances, the identity of the actual Minister or official will be irrelevant to the data subject, and withholding his name will not affect the intelligibility of the personal data. Simply stating their title or post will be sufficient. In this case, the data controller can comply with the request without disclosing information relating to another individual.
7. The circumstances of each case will need to be carefully considered. For instance, on some occasions the identity of a Minister will be crucial to the data to be disclosed, particularly if the data concern an expression of opinion about or an indication of views towards the data subject. Similarly, if a senior official, or any other official in a position to take decisions which would significantly affect the data subject, had expressed an opinion about or an intention towards the data subject, that might well be more significant than if a junior member of staff had recorded the receipt of a letter from the data subject. In each case, a decision will need to be taken as to whether the name of the Minister or official constitutes part of the personal data. If so, it will be necessary to decide whether to seek their consent to disclosure, or whether it is reasonable to disclose the name without consent. Factors to consider in deciding whether it is reasonable, will include whether any harm or prejudice might result to the Minister or official as a result of disclosure.
Standards
8. The names of Ministers or officials should only be disclosed where they have given their consent, or where it is reasonable to do so without their consent. Refusal of consent does not mean that disclosure cannot be made, but any reasons given for such refusal must be taken into consideration in deciding if disclosure would be reasonable.
Recommended best practice
9. Ministers Where personal data include the name of a Minister, a judgement should be made as to whether the name constitutes an essential element of the personal data to be disclosed. In some cases, the identity of the Minister involved will not affect the significance or intelligibility of the information being disclosed. In those circumstances, the name of the Minister may be withheld without his views being sought. In other cases however, the identity of the Minister will be of key significance, especially in circumstances where he has expressed an opinion of, or intention towards, the data subject. Where the data subject is likely to know the identity of the Minister, either because of his personal knowledge of the circumstances described in the item of personal data, or because it is in the public arena, there is unlikely to be any need to either consult the Minister or withhold his name. Because Ministers are in the public eye, there is likely to be an expectation that their names will be disclosed from time to time in circumstances where their consent has not been sought. Therefore, when making a judgement asto whether to disclose the name of another individual, it may be reasonable to be more open in disclosing the names of Ministers than, for instance, the names of junior officials.
10. Where, a letter has been sent, for instance, between Ministers, or from an official to a Minister, a judgement will need to be made as to whether the identity of the sender and recipient constitute personal data of the person making the subject access request. If it is concluded that they do not, it will be sufficient to refer to “a letter between Ministers”, or “a letter from an official to a Minister”. This will fulfil the requirement to specify the classes of recipients, as set out in s7(1)(b)(iii).
11. Officials Where personal data include the name of an official, a judgement should be made as to whether the name constitutes an essential element of the personal data to be disclosed. In many cases, it is only the fact that an official carried out a certain action which is relevant, and the identity of the official involved does not affect the significance or intelligibility of the information being disclosed. In those circumstances, the name of the official may be withheld without his views being sought. Where a document containing personal data has been sent from one official to another, it will be likely that the names of the sender and recipient are not personal data of the person making the subject access request. Only the fact that they are officials need be mentioned, in accordance with the requirement to specify the classes of recipients, as set out in s7(1)(b)(iii).
12. Where, however, the identity of the official may be significant, a balancing exercise should be carried out to determine whether the name should be disclosed, either because it is an essential part of the personal data, or because disclosure of the name is essential to the intelligibility of the data.
13. If it is decided that the identity of an official is an integral element of the personal data of the person making the subject access request, a judgement will need to be made as to whether the name should be disclosed. If the information is clearly innocuous, or is already in the public domain, or the subject is likely to be already aware of the official’s identity, it will probably be reasonable to disclose it without seeking consent – although if it is in any way contentious or likely to attract controversy, it may be prudent to notify the official in advance, as a courtesy, of the intention to disclose his name. Otherwise, it will probably be necessary, as a first step, to seek the consent of the official concerned. If consent is given, the information can be disclosed. If consent is refused, a judgement will then need to be made. A refusal by the official concerned is not sufficient on its own to prevent disclosure – he does not have a right of veto. His name can still be disclosed if the data controller considers it reasonable. Note that in all circumstances where an official is identified as a member of one of the intelligence agencies, advice must be sought from the relevant agency before the disclosure is made.
14. The fact that a large number of officials may be mentioned in personal data relating to a data subject, might in itself make it impractical to seek consent of each individual, because of the large numbers to be contacted. In these circumstances, consideration should be given to disclosing names without seeking consent, unless in any case such a disclosure appears unreasonable, in which case consent should be sought in that particular instance.
Legal considerations
15. Disclosure of the name of an official or a Minister when responding to a subject access request made by another person must be considered in the light of s7(4)–(6) and s8(7). The decision whether disclosure is reasonable must be made by reference to other obligations relating to that other person and the information that is held concerning them. Where, for instance, to disclose information relating to another individual who had refused consent would amount to a significant breach of the data protection principles in respect of that person, that would militate against disclosure. It will, of course, be a question of fact and degree in every case.
16. Disclosure of the names of staff or Ministers in circumstances other than a subject access request under the DPA, for instance in response to a request for information under the Code of Practice on Access to Government Information, or in pro-actively publishing information, may involve disclosing personal data as defined in the DPA. If so, this would constitute processing, which must be in accordance with the provisions of the DPA. In particular, a Schedule 2 condition must be met. If consent is given, condition 1 is fulfilled. Otherwise, conditions 5 (c) or 6(1) would be possible conditions to legitimise disclosure.
17. The fairness requirements (first data protection principle) mean that a name should not be disclosed in circumstances where an individual would not have reasonably expected it, or where there would be an unwarranted invasion of his privacy. Paragraphs 2 and 3 of Part II of Schedule 1 to the Data Protection Act require that, in order to ensure fair processing, so far as practicable, certain information should be provided to the data subject. This includes:
18. Departments may take the view that members of staff already have this information by virtue of their appointment process. Staff are aware that any personal data they supply is for the purposes of their employment, and it is arguable that, in handling a subject access request, it is not necessary to provide them with any further information to enable the disclosure of their personal data to be fair. Officials will be aware that as part of their duties they may be required from time to time to deal with members of the public, or will need to be identified to them.
19. The Office of the Information Commissioner has indicated, however, that, in the case of officials, implied consent may not be sufficient, and that, in order for the processing to be fair, they would normally expect officials to be informed explicitly before their names were disclosed in circumstances which were not a routine part of their job. Departments may therefore find it useful to inform staff as part of their appointment process, and by stating in their staff rules, that the department may disclose officials’ names to the public in the course of their employment (except where harm or prejudice might arise).
20. In the case of Ministers, it can probably be assumed that they have given either implicit or explicit consent for their names to be disclosed in the normal course of their ministerial business. Disclosure of their names in such circumstances is likely to be fair. Only if it were proposed to disclose information about a Minister which he would have been unlikely to anticipate, or which might cause him harm or prejudice, should it be necessary to consult him.
Data Protection Handbook [PDF, 710KB]
[Top]