“(2) Any information to which a request for information relates is also exempt information if— (a) it constitutes personal data which do not fall within subsection (1), and (b) either the first or the second condition below is satisfied. (3) The first condition is— DH v (1) Information Commissioner, (2) Bolton Council[2016] UKUT 0139 (AAC) GIA/4597/2014 3 (a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of “data” insection 1(1) of the Data Protection Act 1998 , that the disclosure of the information to a member of the public otherwise than under this Act would contravene— (i) any of the data protection principles … (7) In this section— “the data protection principles” means the principles set out in Part I of Schedule 1 to theData Protection Act 1998 , as read subject to Part II of that Schedule and section 27(1) of that Act; “data subject” has the same meaning as in section 1(1) of that Act; “personal data” has the same meaning as in section 1(1) of that Act.”
“‘personal data’ means data which relate to a living individual who can be identified— (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,…”
“Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless— (a) at least one of the conditions in Schedule 2 is met, and (b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.”
“1. The data subject has given his consent to the processing. … 6(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.”
“In my opinion there is no presumption in favour of the release of personal data under the general obligation that FOISA lays down. The references which that Act makes to provisions of DPA 1998 must be understood in the light of the legislative purpose of that Act, which was to implement Council Directive 95/46/EC. The guiding principle is the protection of the fundamental rights and freedoms of persons, and in particular their right to privacy with respect to the processing of personal data…”
“If A makes a request under FOIA for personal data about B, and the disclosure of that personal data would breach any of the data protection principles, then the information is exempt from disclosure under the Act ... This is an absolute exemption ... Hence the Tribunal is not required to consider whether the public interest in maintaining the exemption outweighs the public interest in disclosure under section 2(2). However.... the application of the data protection principles does involve striking a balance between competing interest, similar to (though not identical with) the balancing exercise that must be carried out in applying the public interest test where a qualified exemption is being considered.”
“ - the possible consequences of disclosure on the individual; - the reasonable expectations of the individual, taking into account: their expectations both at the time the information was collected and at the time of the request; the nature of the information itself; the circumstances in which the information was obtained; whether the information has been or remains in the public domain; and the FOIA principles of transparency and accountability; and - any legitimate interests in the public having access to the information and the balance between these and the rights and freedoms of the individuals who are the data subjects.”
“The question is rather whether the Tribunal has done enough to show that it has applied the correct legal test and in broad terms explained its decision…”