BAILII is celebrating 24 years of free online access to the law! Would you consider making a contribution?
No donation is too small. If every visitor before 31 December gives just £1, it will have a significant impact on BAILII's ability to continue providing free access to the law.
Thank you very much for your support!

We received a complaint in May 2013 from an employee of a media organisation  concerning an access request he submitted to it. The complainant was concerned that he had not been provided with a copy of all of his personal data as the organisation  had withheld some personal data  citing Section 4(4)(A) on the basis that it considered that the data consisted of an expression of opinion given in confidence.

 

The focus of our investigation was to establish whether the restriction to the right of access applied by the organisation  using Section 4(4)(A) of the Acts was valid in respect of the personal data which was contained in an email which was in the possession of the organisation. Section 4(4A)(a) provides as follows: "Where personal data relating to a data subject consists of an expression of opinion about the data subject by another person, the data may be disclosed to the data subject without obtaining the consent of that person to the disclosure." Section 4(4A)(b)(ii) provides as follows: "Paragraph (a) of this subsection does not apply if the expression of opinion referred to in that paragraph was given in confidence or on the understanding that it could be treated as confidential." The organisation informed the requester that it was exempt from providing details of the data in question as the data consisted of an expression of opinion given in confidence.

 

As outlined in our published guidance, an opinion given in confidence on the understanding that it will be kept confidential must satisfy a high threshold of confidentiality. Simply placing the word "confidential" at the top of the page, for example, will not automatically render the data confidential. The Commissioner will look at the data and its context and will need to be satisfied that the data would not otherwise have been given but for this understanding. Supervisors and managers will not normally be able to rely on Section 4(4A) to restrict access as it is an expected part of their role to give opinions on staff which they should be capable of standing over. On the other hand, a colleague who reports a matter relating to an individual in confidence to a supervisor or manager could be expected to be protected by the confidentiality provision.

 

We commenced an investigation of this matter by writing to the organisation outlining the details of the complaint. We asked the organisation to provide us with a copy of the withheld personal data and details of the author of the email containing it. In order to consider the context in which the email was created, we sought details of the working relationship of the author of the email and the data subject. Having examined the email, we formed the opinion that the organisation could not rely on Section 4(4)(A) of the Acts to restrict the data subject's right of access to his personal data contained in the email. We were satisfied from our investigations that the author of the email was not a peer of the data subject but, while not considered by the organisation to be the data subject's manager, they were in a position of some authority in relation to the data subject. We were satisfied that the content of the email was supplied in the context of a position of authority. Acting on our advice, the organisation proceeded then to release the previously withheld personal data.

 

As this case demonstrates, the right of access to personal data may not be restricted in any widespread manner by the provisions in Section 4(4A). Even where the personal data does qualify for restriction from access, that restriction only applies to the specific opinion(s) given in confidence. In practice this means that, in the context of a full document of personal data, the data subject is entitled to access the personal data within it which is not an opinion given in confidence and the data controller may redact the part or parts which constitute the actual opinion given in confidence. As a general rule, any opinions on an individual supplied by a supervisor or manager may not be restricted under this provision.