Disclosure of sensitive information 

The right to information and UCL's responsibilities 

The Freedom of Information Act 2000 (FOI) provides two related rights: the right to be told whether a public body holds information, and the right to receive the information. These rights apply regardless of the identity of the applicant, the purpose of the request and the age of the information. The information must be provided or refused within 20 working days.

The underlying assumption in the Act is that information will be released: it is a criminal offence to alter, destroy or conceal a record, or attempt to do so, with the intention of preventing its disclosure under the legislation.

Exempt information

Because not all information can be provided, the Act provides 23 exemptions from the right of access. Where sensitive information held by UCL is concerned, these exemptions will most likely be applied where there would be prejudice to:

  • The personal safety of staff and students
  • The security of UCL’s property
  • The commercial interests of UCL and its partners
  • Confidential relationships, both personal and commercial.

The exemptions in question are:

Section 36 Prejudice to the effective conduct of public affairs

This exemption is extremely wide-ranging, and its use is constrained by the need for the opinion of a ‘qualified person’, who in UCL is the Provost. The duties of the qualified person cannot be delegated.

Section 36 is designed to be used when no other exemption applies, but there is still a public interest in withholding information.

Section 39 Environmental information

Information is exempt from disclosure under the FOI Act if it relates to the environment: requests should be handled under the Environmental Information Regulations 2004 (EIR). The Regulations are discussed below.

Section 41 Information provided in confidence

This exemption cannot apply to information provided by UCL’s own staff, only to information from another person (another public authority, private sector organisation or individual).

It should also be remembered that marking documents ‘confidential’, ‘secret’ etc. does not protect them from disclosure. At best, they are an indicator of the likely sensitivity of the information.

Section 43 Commercial interests

There are two main parts to this section. The first relates to trade secrets, the second to prejudice to commercial interests – of UCL or another organisation or individual.

The Act does not define a trade secret, but it is generally taken to mean trade or business information which is not generally known and which, if available to a rival, would cause significant harm to its owner.

Commercial interests are wider than trade secrets. These interests would be prejudiced when disclosure would damage an organisation’s business reputation, and have a negative effect on revenue or weaken its competitive position.

Environmental Information Regulations

If the information is about the state of the elements of the environment, emissions, discharges, radiation, waste, the state of human health and safety and built structures, it is environmental information, and exempt under section 39 of the FOI Act. Requests should instead be handled under the EIR, which have similar provisions to FOI.

The Regulations can apply to organisations that are not public authorities. There is no exemption (‘exception’ in the Regulations) for cost, fewer exceptions, which are more narrowly expressed and all of which require a public interest test. The exception for commercial confidentiality must also pass a stronger harm test.


Exemptions and request handling

As for all Freedom of Information requests, if you receive a request which you believe may be sensitive in terms of safety, security, or commercial confidentiality, you should refer it immediately – with the requested information - to your Freedom of Information Coordinator. If you are unsure who this is, send the request directly to UCL's FOI Officer, Jon Tomkinson.

You should outline the reasons why you believe the information should not be provided, and describe the likely impact of disclosure.

Consultation will take place along the following lines:

  • If it is thought likely that disclosure would harm anyone’s personal safety, the FOI Officer will consult the Security Manager before taking a decision on disclosure. The Security Manager may in turn consult relevant external agencies.
  • If it is thought likely that disclosure would harm the commercial interests of UCL or any other organisation or person, the FOI Officer will consult the Director of Finance (or if a UCL subsidiary is concerned the CEO of the subsidiary).
  • If it is thought likely that disclosure would constitute an actionable breach of confidence, the FOI Officer will consult the Department or Institute responsible for the relevant contracts or agreements.
  • If no agreement on disclosure is reached between the FOI Officer and the holder of the information, or the Security Manager or Director of Finance, the FOI Officer will consult the Vice Provost (Operations). The arguments in favour of and against disclosure will be presented, including any public interest arguments. Legal advice will be sought if necessary.
  • Contractors and other third parties will always be consulted before a decision on disclosure is taken.

Further information may be needed to determine whether is exempt, and you will be kept informed about the progress of the request.

Third parties and partners

It is vital to ensure that third parties are aware that UCL cannot contract out of its FOI obligations. Officers and staff should avoid making commitments in confidentiality clauses and agreements that interfere with UCL’s absolute discretion to take decisions on requests. The FOI Officer can help in drawing up suitable language. In addition, consideration should not be given to storing information with private sector partners to avoid the provisions of information legislation: the Act applies to information held both by and on behalf of public authorities. Instead, adequate consultation and a robust application of the exemptions will protect the information that UCL considers exempt.

The decision on disclosure will be taken by UCL, taking into account the views and concerns of contractors and other third parties: third parties may express their views, which may be significant in helping UCL reach a decision, but they cannot place conditions on the process or prevent disclosure.

Raymond Harding

December 2008

Page last modified on 11 jun 14 14:14