- Enforcing jurisdiction
- United Kingdom · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
DPA case IC-44531-X9L7 – Dismissed (United Kingdom, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
In the UK, a public authority correctly withheld job application information requested by a complainant. This decision is significant because it protects the privacy of job applicants.
What happened
The public authority refused to release parts of job applications due to privacy concerns.
Who was affected
Job applicants whose information was included in the withheld documents.
What the authority found
The authority determined that disclosing the redacted job applications would violate data protection principles.
Why this matters
This case shows that organizations must balance transparency with the privacy rights of individuals. Public authorities should be careful when handling personal data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The complainant requested information relating to a recruitment process within a public authority (the Trust). The Trust withheld parts of the requested information, containing redacted application forms, citing section 40 (2) FOIA. Do name-redacted job applications constitute personal data and would disclosure under FOIA contravene data protection principles? The withheld information constitutes personal data and disclosure would be unlawful. Hence, the Trust was right to withhold the information requested under section 40(2) FOIA, by way of section 40(3A)(a). The ICO saw the particular data subjects’ interests to be protected in the personal statements on the application forms. Even though the names would have been redacted, the candidates’ identity could be derived by a “motivated intruder” using other information publicly available (“mosaic argument”) and therefore constitute personal data. As regards the breach of data protection principles the ICO refers to Article 5 (1) (a). It then elaborates on the applicability of a legal basis according to Article 6 (1) (f). The ICO confirms a legitimate interest in that the complainant is concerned about having been discriminated against during the application process. Furthermore, it deems the potential disclosure of the requested applications necessary to meet this interest. However, it states that the interest is of a case specific rather than general nature, and concludes that this is easily outweighed by the interests of the data subjects, taking into account the data subjects’ reasonable expectation for their data not to be released and, connectedly, a degree of harm or stress induced by a potential release, in particular since releases under FOIA are releases to the general public. As regards interests laid out in the Equality Act and fairness of the trial in question, the ICO considers the Trust’s cooperation in releasing all other requested information, which it didn’t deem to be protected by data protect
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case IC-44531-X9L7 in UK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case IC-44531-X9L7 - United Kingdom (2020). Retrieved from cookiefines.eu
Last updated: