HMRC FOI 40(2) Third Party Personal Data Decision Upheld

The Information Commissioner's Office has issued a Decision Notice finding that HM Revenue and Customs correctly relied on section 40(2) of FOIA to withhold information identifying persons who conducted an internal review of a freedom of information request. The exemption under section 40(2) applies where disclosure would contravene any data protection obligation owed to a third party. The Commissioner upheld the public authority's decision, meaning the withheld information will not be disclosed.

Public authorities handling similar requests where disclosure would identify internal reviewers or other third party individuals involved in FOI processes should assess whether section 40(2) applies. The ICO's acceptance of HMRC's reliance on this exemption confirms the scope of the third party personal data protection in this context. Authorities should document their reasoning when applying this exemption and ensure that any data protection obligations to third parties are properly considered.