Can we restrict the right of access under Part 3?

In detail

• Can we restrict access to the information we provide under Part 3?
• What is a ‘necessary and proportionate measure’?
• What rights and interests may be impacted by restricting someone’s right of access?
• When can we neither confirm nor deny we hold the information?
• What does “avoid obstructing an inquiry, investigation or procedure” cover?
• What does “avoid prejudicing” cover?
• What does “protect public security” cover?
• What does “protect national security” cover?
• What does “protect the rights and freedoms of others” cover?
• Can we restrict the right of access for more than one reason?
• Can we restrict the right of access for a specified period of time?
• Do we need to record our reasons for restricting someone’s right of access?
• Do we need to tell people why we have restricted their rights?
• Can we rely on the UK GDPR exemptions to withhold personal information under Part 3?
• Can we withhold information on the basis of ‘legal professional privilege’?

Can we restrict access to the information we provide under Part 3?

Yes. Although you must tell people whether you are processing their information, and provide access to it, there are circumstances when you can restrict this right. These are referred to as ‘restrictions’ in this guidance.

You could apply a restriction in full, or in part, if it is necessary and proportionate in order to:

• avoid obstructing an official or legal inquiry, investigation or procedure;
• avoid prejudice to the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
• protect public security;
• protect national security; or
• protect the rights and freedoms of others.

You should only apply a restriction to the extent that it is necessary to achieve one or more of these purposes. You must provide the person with any information that does not come within the restriction.

If you are applying a restriction, you still need to provide them with certain supplementary information, eg by providing them with a copy of your privacy notice.

When someone is not aware that you are processing their personal information, you may be able to apply a restriction to their right to be provided with specific privacy information. See When do we need to take action to enable someone to make a SAR?.

What is a “necessary and proportionate measure”?

You must only apply a restriction if it is “necessary”. This means that you must demonstrate that you have identified a reasonable possibility of a potential risk. It must be more than speculative, but doesn’t have to be a foregone conclusion. If you can reasonably achieve your purpose by another means, you should do this instead. For example, by redacting the sensitive information.

You must also demonstrate that your decision to restrict access is “proportionate”. This means that your reasons for applying a restriction must be sufficiently important to justify any impacts that restricting access will have on someone. When considering the impact on the person, you must take into account their fundamental rights and legitimate interests; and consider the actual consequences to them if you apply the restriction. You should only infringe the person’s rights to the minimum extent necessary to achieve your purpose.

In general, you should consider all relevant factors and carefully balance the person’s right of access against your reasons for restricting access. The amount of weight you attach to the person’s right of access depends on how compelling their need to have access to the information is. If you are unsure of the motivation behind the request, you should take into account:

• the nature of the requested information;
• how you have categorised the person’s personal information; and
• why you are processing it.

You should balance the rights of the person against the harm disclosure may cause. The amount of weight you attach to any person’s rights, freedoms or legitimate interests may depend on how compelling or trivial they are, and on how compelling the need to restrict the right of access is.

You could restrict access to some or all of the information depending on the circumstances. As you must only restrict access to the extent necessary to achieve your purpose, you should generally provide as much information as you can – eg by redacting the sensitive data and providing the person with the rest of the information.

In certain circumstances, restricting access will have such an adverse impact on a person’s rights, that you may not be able to justify it as “a necessary and proportionate measure”. In other cases, it will be reasonable to restrict access, even if the person’s rights are adversely impacted. This is the case if the underlying purpose of the restriction is compelling, and there are no other ways to mitigate the risks you have identified.

Ultimately, you should make a reasoned and sensible decision based on genuine risks. You should keep a record of your decision, and be able to justify your position and provide details to the ICO, if asked to. You should explain your reasons to the person, where possible.

What rights and interests may be impacted by restricting an individual’s right of access?

You should consider the rights, freedoms and interests of people broadly. Restricting access to personal information can impact any aspect of an someone’s life, and not just in the context of criminal proceedings.

For example, refusal to provide the information may impact fundamental rights and freedoms, such as:

• the right to a fair trial;
• the right to liberty and security;
• the right to respect for private and family life;
• freedom to choose an occupation and the right to engage in work; or
• freedom to conduct a business.

Which of the person’s rights and interests are impacted will vary depending on the circumstances, and how you have categorised them.

When can we neither confirm nor deny we hold the information?

Even if you refuse to provide access to requested information by applying a restriction, in most instances you must confirm whether or not you hold the information.

However, if disclosing whether you hold the information may undermine the purpose of restricting the right of access in the first place, you can restrict the individual’s right to know whether you are processing their information – by refusing to confirm or deny whether you hold their information. This is often called a “neither confirm nor deny” (NCND) response.

Again, you must only apply a restriction if it is necessary and proportionate to do so, taking into account the person’s fundamental rights and interests.

The decision to neither confirm nor deny is separate from a decision to restrict access to the information. You should make this decision entirely on its own merits. There may be circumstances when an NCND response may not be a necessary or proportionate measure.

What does “avoid obstructing an inquiry, investigation or procedure” cover?

You could restrict access to some or all of the information you hold, if disclosing it would obstruct an official or legal inquiry, investigation or procedure. This can include any public investigation or inquiry and not just criminal investigations or proceedings. However, this is only if you are processing the information for a law enforcement purpose. For example, depending on the specific context and circumstances, it could apply if disclosing the information would obstruct an ongoing or future coroner’s inquiry.

“Obstructing” means preventing or delaying an inquiry, investigation or proceedings from taking place or progressing within a reasonable time.

You could restrict the person’s right of access, if you believe that complying with the SAR may frustrate, or cause difficulties or impediments in progressing an inquiry, investigation, or other official or legal procedure. However, you cannot restrict the person’s right of access just because a SAR is inconvenient, time-consuming, or there are ongoing proceedings. You must be able to demonstrate why restricting the right of access is necessary and proportionate.

What does "avoid prejudicing” cover?

You could restrict access to some or all of the information you hold if providing it may prejudice:

• the prevention or detection of crime;
• the investigation and prosecution of criminal offences; or
• the execution of any criminal penalty.

In the context of criminal justice, “prejudice” can have different meanings depending on the context and circumstances.

In the context of the prevention, detection, and investigation of crime, prejudice may occur where disclosing the information may undermine an inquiry. For example, by revealing details about a covert policing operation. It may also be relevant if you have reasonable grounds to believe that disclosing information to a suspect could lead to them taking steps to conceal a crime.

Prejudice, in this context, can also mean preventing an investigation from being conducted independently or fairly. For example, if disclosing the information would impair or damage the rights of anyone under investigation or charged with an offence.

Prejudice can also apply in the context of the “execution of criminal penalties”. This term is not specifically defined in the legislation but generally means any measure or process used to determine an appropriate penalty for an offender. This may include sentences handed down by a judge or out of court disposals. For example, it may be relevant if a judge is deciding whether to sentence an offender to a term in prison or community service. However, it may also apply in the context of a police caution or conditional discharge, for example.

In the context of court proceedings, including sentencing proceedings, prejudice can occur if decision-makers make a decision:

• before considering the evidence in full;
• based on unfair, irrelevant or inadmissible evidence; or
• based on irrelevant circumstances or preconceived opinions.

What does “protect public security” cover?

You could restrict a person’s right of access to their information if you consider it to be a necessary and proportionate measure to protect public security.

“Public security” generally concerns the welfare and protection of the public at large. It may cover the protection of life, institutions and organisations against public threats, crime, disasters and other threats to life, safety and well-being. For example, it may include:

• use of intelligence to address possible threats;
• policing large events; and
• investigating drugs offences, human trafficking, or institutional child abuse.

Public security can encompass most major public policy issues, or anything that threatens public order.

What does “protect national security” cover?

You could limit or restrict the right of access where this is a necessary and proportionate measure to protect national security.

“National security” is generally understood to cover the security and well-being of the UK as a whole, its population, and its institutions and system of government.

See our guidance on the national security provisions.

What does “protect the rights and freedoms of others” cover?

You could restrict a person’s right to access their personal information if you consider it is a necessary and proportionate measure to protect the rights and freedoms of others. This is usually relevant if the information contains personal information about someone else.

See, What should we do if the Part 3 request involves information about other people?’.

Can we restrict someone’s right of access for more than one reason?

Yes. However, if you need to restrict access for more than one reason, you should be able to explain why this is necessary and proportionate, and keep a record of your reasons.

Can we restrict the right of access for a specified period of time?

Depending on the circumstances, you could apply a restriction to the person’s right to access their information for a specific length of time. For example, until an investigation is complete or criminal proceedings have ended.

You are not required to keep a SAR open after you have applied a restriction and responded to the person. However, if you only need to restrict someone’s right of access for a specific length of time, you could inform them when they may be able to resubmit their request, if possible.

Do we need to record our reasons for restricting someone’s right of access?

Yes. You must record your reasons for restricting, either wholly or partly, someone’s right of access to the following information:

• confirmation of the processing (ie if you have issued an NCND response);
• any of their personal information;
• any of their supplementary information; and
• certain privacy information.

You should also record why you have decided this measure is a reasonable and proportionate response to an identified risk. You must be able to make this record available to the ICO, on request (although you should only keep personal information in accordance with the terms of your retention and disposal schedule).

You may find it helpful to refer to our Accountability Framework – see the section on Logging and tracking requests.

Do we need to tell people why we have restricted their rights?

In most cases, if you have restricted someone’s right to access their information, you must inform them as soon as possible about:

• the reasons why;
• their right to make a complaint to the ICO; and
• their ability to seek to enforce this right through the courts.

You do not need to explain that you have restricted their right of access or why, if this undermines the purposes of restricting the right in the first place. However, where possible you should be transparent about your reasons for restricting their right of access to their personal information.

Can we rely on the UK GDPR exemptions to withhold personal information under Part 3?

No. If you are processing information for law enforcement purposes, you cannot apply the UK GDPR exemptions.

Other rules apply to legal professional privilege – see the next section, Can we withhold information on the basis of legal professional privilege?.

Can we withhold information on the basis of legal professional privilege?

There is no specific restriction under Part 3 of the DPA 2018 that says you may withhold information on the basis it is protected by legal professional privilege.

However, legal professional privilege is an established common law principle. Clients have a fundamental right to seek and obtain confidential legal advice, without the risk of such details being disclosed to others. Therefore, you may withhold information on the basis of the common law principle of legal professional privilege.