Section 38 of the Freedom of Information Act 2000 exempts ­public authority information from the general right of access if its ­disclosure would, or would be likely to, endanger the physical or mental health of any individual and/or the safety of any individual. The term ‘endanger’ is the same as the term ‘prejudice’ used in other FoI ­exemptions.

Section 38 is a qualified exemption and so requires consideration of the public interest test. It was recently relied upon successfully in an appeal to the First Tier Tribunal (Information Rights), formerly the Information Tribunal. People for the Ethical Treatment of Animals Europe (PETA) v IC and Oxford University, EA/2009/0076 (13 April 2010) concerned experiments performed on a macaque by an Oxford University professor. These were the subject of a BBC documentary in November 2006 entitled Monkeys, Rats and Me.

The appellant, an animal rights pressure group, sought extracts from the relevant Home Office project licence concerning, among other things, the work plan and purposes behind those experiments. The tribunal applied its decision in Hogan and Oxford City Council v IC (EA2005/0026 and EA2005/0030), where it ruled that the application of the prejudice test involved a number of steps; namely:The tribunal in the present case found that section 38 was engaged, given the indiscriminate nature of the violence tending to accompany the publication of information about animal experiments at Oxford University. It gave weight to the evidence submitted by the university of attacks and incidents which took place following the showing of the BBC documentary. This satisfied the tribunal that disclosure of the information would increase the risk of endangerment to its staff, as well as anyone visiting or associated with the university.

  • The tribunal needs to identify the applicable interest(s) within the ­relevant exemption;
  • The nature of the endangerment being claimed must be considered;
  • Some causal relationship must exist between the potential disclosure and the endangerment;
  • The endangerment must be ‘real, actual or of substance’. There is therefore effectively a de minimis threshold which must be met; and
  • Where a public authority is relying upon the ‘would be likely to endanger’ limb of section 38, the tribunal must be satisfied that there is a real and ­significant risk of endangerment even if it cannot be said that the occurrence of endangerment is more probable than not.

The tribunal went on to rule that the public interest in withholding the information outweighed the public interest in disclosure. It gave weight to the need for transparency in the way experiments were conducted on animals, to allow public debate and scrutiny. However, this was outweighed by the fact that disclosure would increase the risk to those working in this field of being the target of bombings and arson.

The tribunal also identified the fact that private sector organisations applying for the same Home Office licence were not subject to the FoI regime. In light of the risk of endangerment, the tribunal was satisfied that it was in the public interest that there should be a ‘level playing field’, so that those working for public bodies engaged in this type of work were not exposed to a greater risk than their counterparts in the private sector.

Over the past two years, there have been many decisions of the commissioner, the tribunal and the courts on disclosure of anonymised personal information. The commissioner previously argued that such information, where the individual cannot be identified by the recipient, is not personal data and so the section 40(2) exemption (third-party personal data) cannot be used to refuse disclosure. This was until the tribunal examined this point in detail in various cases, including Department of Health v IC and the Pro Life Alliance, EA/2008/0074 (15 October 2009).

Here the tribunal ruled that anonymised personal information could still be personal data in the hands of the data controller if there is further information in the hands of the data controller that would allow the subjects to be identified.

This reasoning was applied recently in Magherafelt District Council v IC, EA/2009/0047 (3 February 2010). Following a FoI request, the council disclosed the numbers of staff disciplined and dismissed over a four-year period. However, it would not disclose the penalty issued or the reason for the action against those disciplined. It also refused to disclose the reasons for dismissal.

The tribunal ruled that this was ­personal data and went on to consider whether disclosure would be fair and lawful in accordance with the first Data Protection Principle as required by section 40(2). It accepted that the council’s employees had a reasonable expectation of privacy. Integral to the question of whether disclosure (despite this expectation) was fair, was the related question of whether there was a real risk of identification by the public if the information were to be disclosed.

It was argued by the council that it would be easy for a journalist, speaking to other members of the council’s staff, to identify the individuals referred to in the information. The tribunal, while clear that, read on its own, the information would not identify particular individuals, did accept (given the small size of the authority and indeed the local population) that it would not be hard for a journalist to take steps to identify the individuals in question. This could then lead to widespread publication of the names of the individuals, the disciplinary offences they had committed and the sanctions received.

This was not the same as concluding that the information on its own enabled identification. Further investigative steps would need to be taken, but given that these did not appear to be onerous or unlikely, it would be artificial for the tribunal to ignore what appeared to be a very real risk.

The tribunal concluded therefore that public disclosure of the information would be unfair to the data subjects (the employees in question), such that disclosure would be a breach of the first data protection principle.

For the sake of completeness, it also went on to consider whether disclosure could be justified on one of the grounds in schedule 2 of the Data Protection Act. The tribunal concluded that it was not ‘necessary’ within the terms of paragraph 6 of schedule 2 for there to be disclosure of the information. The legitimate interests in disclosure of information about disciplinary offences, such as they were, had already been met by a means that interfered less with the data subjects’ interests – that is, by the previous release of information about numbers and types of offences and sanctions. In light of the above, the tribunal concluded that disclosure of the remaining information would be in breach of the first data protection principle and that the absolute exemption under section 40(2) applied.

The outcome of the election will have a big impact on freedom of information law and practice. Massive cuts in public sector spending will no doubt lead to many more FoI requests to public authorities from interested parties, including the media, unions and disgruntled employees. It is also worth noting that the coalition agreement includes a commitment to extend the scope of the Freedom of Information Act. The era of openness and transparency is here to stay.

Ibrahim Hasan is also a director of Act Now Training.