Names of staff members who dealt with complaints are not necessarily personal data, Tribunal says

In its decision (10-page / 49KB PDF) the Information Rights Tribunal said that disclosing employee names alone did not necessarily "affect the individuals' privacy, whether in their personal or family life, business or professional capacity".

The appeal concerned a request for information made under the Freedom of Information(FOI) Act by a Mr Edem. Edem had asked financial services regulator the Financial Services Authority (FSA) for a copy of information it held about him and about complaints he had made to the effect that the FSA had failed to regulate credit card company Egg Plc properly.

The regulator withheld the names of the junior staff who dealt with Edem's complaints on the grounds that they were "personal data" and so exempt from disclosure. In his original decision notice, the Information Commissioner said that the FSA had been right to do so.

Under the FOI Act individuals have a general 'right to know', which entitles them to be provided with information held by Government departments and public bodies. However, those bodies can legitimately withhold information requested in some circumstances. One absolute exemption in FOI laws allows bodies to refuse to disclose information they hold when the information amounts to personal data where to do so would be a breach of the Data Protection Act.

The Data Protection Act requires organisations to process personal data fairly and lawfully. In determining whether it is fair to process the information organisations must consider the method in which they obtained the data and whether its purpose of processing would deceive or mislead the person from whom the information was obtained.

Unlike other exemptions to the FOI Act, there is no presumption in favour of the disclosure when a body seeks to use the data protection exemption. Instead, the legitimate interests of the public in the disclosure need to be balanced against the interests of the individual whose personal data would be disclosed.

As defined in the Data Protection Act, personal data means data that relates to a living individual who can be identified from that data. The Information Rights Tribunal said that the three names "may well be sufficient" to identify the individuals when taken together with information that they were employed by the FSA in certain positions on a given date, however it did not follow that the names themselves were personal data even if the individuals could be identified as the information must also be "such as to affect the person's privacy".

"In our view the Disputed Information is not biographical in any significant sense," the Tribunal said. "The information does not go beyond the recording of the data subjects' involvement in a matter that has no personal connotations. It simply concerns a transaction or matter in which the individuals in question were involved."

However, the Tribunal said that it would not always be the case that information about where an individual worked as some point in the past and in what capacity was not personal data.

"There are a number of organisations, the nature of whose activities are such that information that a particular individual was employed by them, might well amount to personal data," it said.

For example, disclosing that an individual was employed by an organisation licensed to conduct experiments on animals "may disclose something about his likely opinion on the often contentious subject of animal rights, and could lead to harassment by so-called animal rights activists", it said. In this case, it could be argued that the information was "biographical" and affected the individual's privacy.