Department of Health and Social Care – Complaint Upheld (United Kingdom, 2020)

The complainant made a two part request for information about draft regulations relating to pharmacists. The Department for Health and Social Care (DHSC) refused the information under section 35(1)(a) of the FOIA (information relating to the formulation or development of government policy). During the course of the Commissioner’s investigation the DHSC also applied section 36 (prejudice to the conduct of public affairs), to a limited amount of the information. It later withdrew its reliance on this exemption. However it also stated that other information was being withheld under section 21 (accessible to the applicant by other means) and section 40(2) (personal information). Whether the Department of Health and Social Care could prevent disclosing a name on an agenda by relying on Section 40(2) and Section 40(3A) of the Freedom of Information Act. Section 40(3A)(a) in particular prevents the disclosure of information that would contravene the principles of processing personal data under Article 5 GDPR. The Commissioner’s decision was that the DHSC was entitled to rely on section 35(1)(a) in respect of only some of the information to which it was applied. The DHSC also breached section 10 of the FOIA by failing to provide the information it tried to apply section 36 to, only to later withdraw its reliance on that exemption. However the DHSC was entitled to rely on section 21 to withhold the information to which that exemption had been applied, but by failing to inform the complainant of its application within the statutory time for doing so, the DHSC breached section 17(1). Finally, the DHSC was entitled to withhold one name from one document. Here the ICO made reference to Article 5 of the GDPR, arguing that Section 40(2) of the FOIA provides that information is exempt from disclosure if it is the personal data of an individual other than the requester and where one of the conditions listed in section 40(3A) is satisfied. In this case the relevant condition was contained in section 40(3A)(a), which applied where the disclosure of the information to any member of the public would contravene any of the principles relating to the processing of personal data under Article 5 GDPR. The ICO referenced Article 5(1)(a) to make the argument that disclosing the name to the public would constitute processing which is not 'lawful', because there would be no legitimate interest in doing so (Article 6(1)(f). Therefore, the ICO decided that the DHSC was entitled to withhold the information under section 40(2), by way of section 40(3A)(a). However, because the DHSC failed to disclose the rest of the information from the document, it had breached section 1 FOIA (the duty to communicate information). The Commissioner required the Department of Health and Social Care to take steps to ensure compliance with the legislation, and disclose the information from the agenda apart from the one name which could be witheld under section 40(2).