Department of Health and Social Care – Complaint Upheld (United Kingdom, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The UK Information Commissioner's Office found that the Department of Health and Social Care mishandled a request for information about draft regulations. The department wrongly withheld some information and failed to inform the requester in a timely manner. This case highlights the importance of transparency and timely communication in handling information requests.
What happened
The Department of Health and Social Care mishandled a request for information by improperly withholding some details and failing to notify the requester on time.
Who was affected
Individuals requesting information about draft regulations related to pharmacists from the Department of Health and Social Care.
What the authority found
The ICO decided that the Department of Health and Social Care improperly withheld some information and failed to meet the statutory time requirements for informing the requester.
Why this matters
This case underscores the need for government departments to handle information requests transparently and within legal timeframes. It serves as a reminder for public bodies to ensure compliance with information access laws.
GDPR Articles Cited
National Law Articles
The complainant made a two part request for information about draft regulations relating to pharmacists. The Department for Health and Social Care (DHSC) refused the information under section 35(1)(a) of the FOIA (information relating to the formulation or development of government policy). During the course of the Commissioner’s investigation the DHSC also applied section 36 (prejudice to the conduct of public affairs), to a limited amount of the information. It later withdrew its reliance on this exemption. However it also stated that other information was being withheld under section 21 (accessible to the applicant by other means) and section 40(2) (personal information). Whether the Department of Health and Social Care could prevent disclosing a name on an agenda by relying on Section 40(2) and Section 40(3A) of the Freedom of Information Act. Section 40(3A)(a) in particular prevents the disclosure of information that would contravene the principles of processing personal data under Article 5 GDPR. The Commissioner’s decision was that the DHSC was entitled to rely on section 35(1)(a) in respect of only some of the information to which it was applied. The DHSC also breached section 10 of the FOIA by failing to provide the information it tried to apply section 36 to, only to later withdraw its reliance on that exemption. However the DHSC was entitled to rely on section 21 to withhold the information to which that exemption had been applied, but by failing to inform the complainant of its application within the statutory time for doing so, the DHSC breached section 17(1). Finally, the DHSC was entitled to withhold one name from one document. Here the ICO made reference to Article 5 of the GDPR, arguing that Section 40(2) of the FOIA provides that information is exempt from disclosure if it is the personal data of an individual other than the requester and where one of the conditions listed in section 40(3A) is satisfied. In this case the relevant condition was
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Department of Health and Social Care in UK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Department of Health and Social Care - United Kingdom (2020). Retrieved from cookiefines.eu
Last updated: