Enforcing jurisdiction
United Kingdom · Geography does not establish applicable law.
Confirmed applicable legislation
No confirmed legal basis recorded.

DPA case IC-44531-X9L7 – Dismissed (United Kingdom, 2020)

Dismissed
Information Commissioner's Office29 July 2020United Kingdom
final
Dismissed

Privacy enforcement record

This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.

In the UK, a public authority correctly withheld job application information requested by a complainant. This decision is significant because it protects the privacy of job applicants.

What happened

The public authority refused to release parts of job applications due to privacy concerns.

Who was affected

Job applicants whose information was included in the withheld documents.

What the authority found

The authority determined that disclosing the redacted job applications would violate data protection principles.

Why this matters

This case shows that organizations must balance transparency with the privacy rights of individuals. Public authorities should be careful when handling personal data.

Recorded legal citations
Automatically processed
Art. 5(1)(a) GDPR
Art. 6(1)(f) GDPR
View original scraped data
Art. 5(1)(a) GDPR
Art. 6(1)(f) GDPR

Original imported citations before automated processing; the processing history does not establish independent verification.

National Law Articles
AI-identified
Section 40(2) FOIA
Section 40(3A)(a) FOIA

Source checks

Secondary-source text retrieved.

Automated check recorded — 18 October 2026.

Processing notes: articles corrected, national law identified.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Full Legal Summary
Detailed

The complainant requested information relating to a recruitment process within a public authority (the Trust). The Trust withheld parts of the requested information, containing redacted application forms, citing section 40 (2) FOIA. Do name-redacted job applications constitute personal data and would disclosure under FOIA contravene data protection principles? The withheld information constitutes personal data and disclosure would be unlawful. Hence, the Trust was right to withhold the information requested under section 40(2) FOIA, by way of section 40(3A)(a). The ICO saw the particular data subjects’ interests to be protected in the personal statements on the application forms. Even though the names would have been redacted, the candidates’ identity could be derived by a “motivated intruder” using other information publicly available (“mosaic argument”) and therefore constitute personal data. As regards the breach of data protection principles the ICO refers to Article 5 (1) (a). It then elaborates on the applicability of a legal basis according to Article 6 (1) (f). The ICO confirms a legitimate interest in that the complainant is concerned about having been discriminated against during the application process. Furthermore, it deems the potential disclosure of the requested applications necessary to meet this interest. However, it states that the interest is of a case specific rather than general nature, and concludes that this is easily outweighed by the interests of the data subjects, taking into account the data subjects’ reasonable expectation for their data not to be released and, connectedly, a degree of harm or stress induced by a potential release, in particular since releases under FOIA are releases to the general public. As regards interests laid out in the Equality Act and fairness of the trial in question, the ICO considers the Trust’s cooperation in releasing all other requested information, which it didn’t deem to be protected by data protect

Outcome

Dismissed

The complaint or investigation was dismissed.

Related Enforcement Actions (0)

No other enforcement actions found for DPA case IC-44531-X9L7 in UK

This is the only recorded action for this entity in this jurisdiction.

Details

Decision Date

29 July 2020

Authority

Information Commissioner's Office

GDPRhub ID

gdprhub-2648

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. DPA case IC-44531-X9L7 - United Kingdom (2020). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: