freedom of information.co.uk

The Data Protection Act 1998 (DPA) is the sister act to the Freedom of Information Act, and the Information Commissioner – formerly the Data Protection Commissioner - is responsible for enforcing both. 

Whereas the FOIA and the Environmental Information Regulations (EIRs) allow you access to a vast range of information on public issues, the DPA gives you a right of access to personal data and protects it from others.  As a general rule, any information you can access about yourself under the DPA cannot be released to others under the FOIA and the EIRs. However, some personal information might be disclosed to third parties if it is deemed not to breach the data protection principles set out in the DPA.

The DPA applies to both public and private sector bodies and you can apply to any organisation or company for personal data they hold on you.  This is known as a subject access request.  The authority has 40 calendar days to respond, compared with 20 working days for FOIA requests.

Prior to the FOIA, the DPA allowed you access to electronic data and formally structured manual files such as medical and financial records.  However, the FOIA amended the DPA, extending your right of access to ‘unstructured’ personal data held manually by public authorities. 

This new right, which began on January 1st 2005, might have obliged authorities to hand over every piece of paper concerning the subject, were it not for a 2003 Court of Appeal judgment, in the case of Durant vs the Financial Services Authority.  The judgment significantly narrowed the definition of ‘personal data’, effectively excluding any document which does not have the subject as its main focus and which could not impact on his or her privacy. The judgment also ruled that the right of access to manual files applies only to those that are both formally structured and organised for the simple retrieval of personal data.  However, this will no longer apply to public authorities once the DPA extension takes effect.