What does the Act say?
Section 38 is classified as being part absolute and part qualified and may, on first reading, appear very complicated. However, the exemption can be split into two key areas:
• Where the person making the request has asked for information about themselves. 1
There is an absolute exemption where the information constitutes personal data of which the person is the subject. This is known as a subject access request and falls under the remit of the Data Protection Act 1998 (‘DPA’). The rules under the DPA will determine whether the person has a right to the information. The application cannot be considered under the FOI(S)A 2002. The effect of the exemption is not to deny individuals a right to access information about themselves but to ensure the right is exercised under the DPA.
• Where the person making the request has asked for information about a third party.
Absolute Exemption.
There is an absolute exemption if the disclosure would breach any of the Data Protection
Principles, 2 which are detailed below. 3 There is also an absolute exemption for personal census information 4 and a deceased person’s health record, 5 although these parts of the exemption are no longer applicable after 100 years. 6 The section gives definitions of both ‘personal census information’ 7 and ‘health record’. 8
Qualified Exemption.
The exemption is qualified if the data subject has exercised their right under section 10 of the DPA to issue a notice to a data controller preventing the processing of certain personal information (a “Section 10 Notice”). 9 As this part of the exemption is “qualified”, it means the information must still be released if the public interest in disclosing the information is not outweighed by the public interest in withholding the information (see paragraph 4 below).
In addition, if any of the exemptions found in Part IV of the DPA apply to the information, 10 the exemption is qualified. This may result in a situation where the data subject would not be given the information, but the public authority considers the public interest in providing it to a third party to be sufficiently strong to release the information.
View the full text of these exemptions
Footnotes
1 Freedom of Information (Scotland) Act 2002, s38(1)(a); hereafter FOI(S)A 2002.
2 FOI(S)A 2002, s38(1)(b).
3 The Data Protection Principles are the principles set out in Part I of Schedule 1 of the DPA, as read subject to Part II of that Schedule and s27(1) of that Act.
4 FOI(S)A 2002, s38(1)(c).
5 FOI(S)A 2002, s38(1)(d).
6 See FOI(S)A 2002, s58(2)(b).
7 Personal census information means any census information as defined in section 8(7) of the Census Act 1920 or which has acquired or derived by virtue of sections 1 to 9 pf the Census (Great Britain) Act 1910.
8 Health record has the meaning assigned to that term by section 1(1) of the Access to Health Records Act 1990.
9 FOI(S)A 2002, s38(2)(a)(ii).
10 FOI(S)A 2002, s38(3).
< Scope of Briefing | Definition of key terms and concepts >