Freedom of information and data protection
Freedom of information (FOI) gives you the right to ask any public sector organisation for information they hold. Anyone can ask for information. You can also ask for information about yourself under data protection legislation.
Organisations you can ask for information from
You can ask for information from publicly-funded organisations that work for the welfare of the whole population, such as:
- government departments
- local councils
- schools, colleges and universities
- health trusts, hospitals and doctors’ surgeries
- publicly-funded museums
- the police
- non-departmental public bodies, committees and advisory bodies
Making an FOI request
You can contact an organisation directly by letter or email to make a freedom of information request. When making your request, you should include:
- your name
- an address where you can be contacted
- a detailed description of the recorded information you want
- the format you want the information in
You can ask for the information in a number of different formats. This could be paper or electronic copies of any original documents, or other formats like large print, audio format or Braille.
Depending on the nature of your request, you can ask for all the information or just a summary.
If you plan to reproduce the information you receive, make sure you check the copyright status of it first.
Most requests are free but you might be asked to pay a small amount for photocopies or postage. You will be told by the organisation if you have to pay anything.
You should receive the information within 20 working days. If the organisation needs more time, they will contact you and tell you when you can expect the information.
If your request is turned down
Some sensitive information might not be available to members of the public. If this is the case, the organisation must tell you why they have withheld some or all of the information you requested.
An organisation can turn down your request if they think it will cost them more than £450.00 (£600.00 for a central government organisation) to deal with your request.
They might then ask you to be more specific so they can give you the information you’re looking for.
If an organisation doesn’t give you the information you asked for, you should first contact them and ask them to review their decision.
General Data Protection Regulation (GDPR) and the the Data Protection Act 2018 control how your personal information is used by organisations, businesses or the government.
Everyone who collects data has to follow strict rules called ‘data protection principles’. They must make sure the information is:
- processed lawfully, fairly and in a transparent way
- collected for written, explicit and legitimate purposes
- adequate, relevant and limited to what is necessary for the purposes for which it is processed
- accurate and kept up-to-date
- kept for no longer than is absolutely necessary
- processed in a safe and secure way
There is stronger legal protection for more sensitive information, such as:
- ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
- biometrics (when used for ID purposes, such as facial recognition or fingerprints)
- sex life
- sexual orientation
Your data protection rights
You have the following rights under data protection legislation:
- the right to be informed
- the right of access
- the right to rectification
- the right to erasure
- the right to restrict processing
- the right to data portability
- the right to object
- rights about automated decision making and profiling
If you wish to use any of the rights above, you should contact the relevant organisation. Contacts for each department are:
The Executive Office - email@example.com
- Department of Agriculture, Environment and Rural Affairs - firstname.lastname@example.org
- Department of Education - email@example.com
- Department of Finance - DataProtectionOfficer@finance-ni.gov.uk
- Department of Health - DPO@health-ni.gov.uk
- Department of Justice - DataProtectionOfficer@justice-ni.x.gsi.gov.uk
- Department for Communities - DPO@communities-ni.gov.uk
- Department for the Economy - DPO@economy-ni.gov.uk
- Department for Infrastructure - DFIGDPR@infrastructure-ni.gov.uk
Right of access
The right of access means that you have the right to get:
- confirmation that your data is being processed lawfully
- access to your personal data
- other extra information, for example information that should be provided in a privacy notice
The organisation legally must give you a copy of the information they hold about you if you ask for it.
A copy of the information should be given free of charge. However, organisations can charge a ‘reasonable fee’ in specific circumstances.
There are some situations when organisations are allowed to withhold information, for example if the information is about:
- the prevention, detection or investigation of a crime
- national security or the armed forces
- the assessment or collection of tax
- judicial or ministerial appointments
- statistics and scientific or historical research
An organisation doesn’t have to say why they are withholding information.
Worried about your data
If you think your data has been misused or that the organisation holding it hasn’t kept it secure, you should contact them and tell them.
The Information Commissioner's Office (ICO)
The Information Commissioner's Office (ICO) can help you understand what data protection, freedom of information and related issues mean to you. It can advise you on how to protect your personal information and how to gain access to official records.
If you think an organisation has failed to abide by the legislation the ICO regulates, you may be able to get help. You can find out how to make a complaint and more on the ICO website.