Appendix 3 - Privacy notice for FOI requests

Summary

The UK Information Commissioner's privacy notice covering the processing of information requests is set out below (ico.org.uk/global/privacy-notice/makean- information-request/). It provides an example of how to comply with the GDPR's transparency requirements (see The gist – the GDPR, FOIA and being transparent in Chapter 12) when receiving FOI and other information requests. It assumes that some information, such as contact details for the public authority, is provided elsewhere in the authority's privacy notice(s) or on their website. Some optional additions are suggested in [bold] to cover handling of personal information that is not required to meet the legal obligation of answering the request. The ICO privacy notice is reproduced under the Open Government Licence v3.0.

Why we use your data

Our primary purpose for using your data is so that we can process your information request.

[In addition, we use your data for the following secondary reasons:

• recording the types of applicant making requests to us by broad category (private individual, business, media, charity, campaign group)

• if you are a journalist or from a media organisation, our press office will be notified that you have made a request so that they are aware of any potential forthcoming news coverage to which they may need to respond

• we sometimes discuss requests that have been received with other public authorities (e.g. [add examples of organisations in sector]) to obtain advice. Although we never deliberately share the identity of applicants in these circumstances, if you have submitted the same request to a number of authorities, your identity may be obvious to those who have received the request.]

Legal basis for processing

The legal basis for processing your request is article 6(1)(C) of the GDPR, which relates to processing necessary to comply with a legal obligation to which we are subject. In the case of information requests, the legal obligations are set out in:

• General Data Protection Regulations (2016)

• Data Protection Act (2018)

• Freedom of Information Act (2000)

• Environmental Information Regulations (2004)

• RoPSI Regulations (2015)

If any of the information you provide us in relation to your information request contains special category data, such as health, religious or ethnic information the legal basis we rely on to process it is article 9(2)(g) of the GDPR, which also relates to our public task and the safeguarding of your fundamental rights.