Personal data
13.—(1) To the extent that the information requested includes personal data of which the applicant is not the data subject and as respects which either the first or second condition below is satisfied, a public authority shall not disclose the personal data.
(2) The first condition is—
(a)in a case where the information falls within any of paragraphs (a) to (d) of the definition of “data” in section 1(1) of the Data Protection Act 1998, that the disclosure of the information to a member of the public otherwise than under these Regulations would contravene—
(i)any of the data protection principles; or
(ii)section 10 of that Act (right to prevent processing likely to cause damage or distress) and in all the circumstances of the case, the public interest in not disclosing the information outweighs the public interest in disclosing it; and
(b)in any other case, that the disclosure of the information to a member of the public otherwise than under these Regulations would contravene any of the data protection principles if the exemptions in section 33A(1) of the Data Protection Act 1998(1) (which relate to manual data held by public authorities) were disregarded.
(3) The second condition is that by virtue of any provision of Part IV of the Data Protection Act 1998 the information is exempt from section 7(1) of that Act and, in all the circumstances of the case, the public interest in not disclosing the information outweighs the public interest in disclosing it.
(4) In determining whether anything done before 24th October 2007 would contravene any of the data protection principles, the exemptions in Part III of Schedule 8 to the Data Protection Act 1998 shall be disregarded.
(5) For the purposes of this regulation a public authority may respond to a request by neither confirming nor denying whether such information exists and is held by the public authority, whether or not it holds such information, to the extent that—
(a)the giving to a member of the public of the confirmation or denial would contravene any of the data protection principles or section 10 of the Data Protection Act 1998 or would do so if the exemptions in section 33A(1) of that Act were disregarded; or
(b)by virtue of any provision of Part IV of the Data Protection Act 1998, the information is exempt from section 7(1)(a) of that Act.
Section 33A of the Data Protection Act 1998 (c. 29) was inserted by section 70(1) of the Freedom of Information Act 2000 (c. 36).