Handling FOI and EIR Requests For Personal Data - Act Now

Personal data is the subject of many FOI and EIR requests.

Requestors often ask for email addresses, staff names and other information that is capable of identifying employees, service users and the public.

Such requests require consideration of data protection and privacy legislation alongside the provisions of FOI and EIR.

This advanced workshop will provide delegates with a comprehensive understanding of how to apply S.40 of FOI and Regulation 13 of EIR when responding to requests for personal data and how these overlap with GDPR and the Data Protection Act 2018. Recent ICO and Tribunal decisions will be discussed together with case studies and exercises to give delegates the chance to test their understanding in a supportive training environment.

Key Topics

• Understand the definition of personal data and in particular understand what is meant by 'identifiable' living person
• Be able to identify a data subject access request and understand how to deal with this in the context of a FOI request
• Understand the way in which FOI Section 40 (2) and EIR reg 13 apply in relation to third party personal data
• Have greater confidence in applying the personal data exemptions in FOI S 40 (2) and EIR reg 13
• Know how to draft a Refusal Notice based on FOI S 40(2) and EIR reg 13