8.1 General principles

Requests for access to case files will generally come from the complainant. The LGA says information obtained in the course of an investigation must not be disclosed except for the purposes of the investigation. During its course, it will normally be appropriate to pass to the complainant and the BinJ the information we may rely on to reach a decision, as this will help the investigation. Requests from third parties should be refused in accordance with the LGA, but see the Casework Policy Forum guidance note on Information requests from third parties.

8.2 Not all information on the case file is the data subject’s personal data

Not everything on a complaint file is the complainant’s personal data. Complaint files contain a mix of the complainant’s personal data, third party personal data, a mix of complainant and third party data which is inextricably linked and data which is not personal data at all. Personal data is exempt from disclosure under the FOIA but is disclosable to the data subject under the UK GDPR/DPA.

Although a Subject Access Request only entitles the data subject to their own personal data, we will generally take a broad brush approach and disclose most information on a case if appropriate (but see GDPR/DPA exemptions).

Information provided by local authorities subject to a notice under section 32 of the LGA should not be disclosed. See the Investigation Manual, about S.32(3) notices.

8.3 UK GDPR/DPA exemptions

Where the information requested is about another person, it is not the data subject’s information so the UK GDPR/DPA does not apply and we have to consider the request under FOIA (see FOIA exemptions).

Exemptions from the general presumption of access may apply. The main exemptions are:

• Where information is about the data subject but also contains information about another person, the information about a third party can be redacted or excluded from disclosure. (See information about Clinical Advisors below.)
• Legal advice and information about legal proceedings (legal professional privilege: If legal advice is obtained during an investigation, it (and the Assignment Request) is exempt from release under the UK GDPR/DPA and we will not disclose this information. Likewise, information about a judicial review challenge, even where litigation has not started, will generally be exempt from disclosure. This should be kept in the DO NOT DISCLOSE folder in ECHO.
• Social work records and health information: This information is exempt if providing the information would be likely to cause serious harm to the physical or mental health of any person. This may be relevant, for example, where the request is from a parent during the course of a child protection enquiry. Where health information is at issue, the person dealing with the request must consult a health professional who is responsible for caring for the individual concerned before making a decision.
• Where disclosure would prejudice our ability to fulfil our statutory function: this exemption applies where a local authority has asked us not to disclose information (and we agree the request is justified and reasonable), or has served a S.32(3) notice. It also applies where we believe disclosing the information may prejudice our ability to obtain information from the local authority in the future.
• Crime and taxation: Where information is about preventing or detecting crime or the prosecution of offenders or the assessment or collection of tax. This may be relevant if information has been obtained from the Police or HMRC either directly or from a local authority during an investigation.

8.4 EIR exceptions

Complainants are entitled to access environmental information we hold, for example, information on complaints files about planning and land matters, and noise nuisance. Exceptions may apply, including (under Reg. 12) where:

• The request is unreasonable: this exemption could cover very costly or vexatious requests (Reg. 12(4)(b)).
• The request is too general: this exemption should only be used where attempts to clarify the request have failed (Reg. 12(4)(c)).
• Adverse affect on the confidentiality of proceedings of that or any other public authority where such confidence is protected by law, which includes information subject to a confidentiality notice served by an authority under LGA s.32(3). (Reg. 12(5)(d))
• Where information has been provided to us on a voluntary basis with the expectation it would not be disclosed, Reg.12(5)(f) may apply. This deals with an adverse affect on the person who provided the information in certain circumstances and where they have not consented to disclosure.

8.5 FOIA exemptions

Under s.44(1)(a) FOIA, information is exempt if its disclosure is prohibited under any enactment.

The s.32(2) LGA prohibits a Local Government Ombudsman from disclosing information obtained in the course of, or for the purposes of, an investigation except ‘for the purposes of the investigation and any report’ and a few other very limited circumstances mostly linked to legal proceedings. In the interests of transparency, we normally release all information to both sides during the investigation, to help them to take part in the investigation and better understand our decision. This is not a disclosure under FOIA or EIR.

Generally, information about a complaint is the complainant’s personal data and is excluded from disclosure under s.40(1) FOIA, so the request should therefore be considered under the UK GDPR/DPA.

Where the information is not the data subject’s personal data, the absolute and qualified exemptions from disclosure need to be considered. Some material on a case file might be about another person so we must consider it under the FOIA.

• When deciding if the information should be disclosed, consider whether the other individual has consented to the disclosure or if it is otherwise reasonable to release the information, for example, where the information is generally already known by the requester. This exemption requires balancing the requester’s interest in the information against the need to protect the other person’s personal data. This third party information should be identified on receipt by the Investigator, normally excluded from information passed on to the complainant in the course of the investigation and stored in the DO NOT DISCLOSE folder in ECHO.

Where we get a request for casework material from someone other than the complainant (or someone acting on their behalf), the request will be refused under s.44(1)(a) FOIA. This includes requests for complaint decisions which the Ombudsman has directed should not be published. S.32(2) LGA extends to parts of documents created by LGSCO which set out third party information, and the generation of information and analysis derived from third party information. S.31B(1) LGA allows the Ombudsman to lift this prohibition where he considers it appropriate to publish all or part of a decision report or statement. The Ombudsman has to take account of the public interest and the interests of the complainant when considering this disclosure. It is the Ombudsman’s decision whether or not to lift the prohibition on disclosure. We have had a complaint go to the Information Commissioner who initially considered directing us to disclose a ‘not for publication’ decision to the requester on the basis of greater public interest in disclosing, but eventually issued a decision notice confirming that only the Ombudsman can lift the prohibition on disclosure of information obtained during an investigation. See decision notice FS50672575 October 2017.

8.6 Consulting other parties

Disclosure of certain information may affect the legal rights of third parties, for example, where information is obtained in confidence from that party and disclosure would constitute a breach of confidence or where the information contains personal data.

Where disclosure would constitute a legally actionable breach of confidence, we should consult the third party concerned with a view to getting their permission to disclose, unless the third party cannot be located or the cost of doing so would be prohibitive.

Where disclosure would not affect a third party’s legal rights, consultation with that individual may still be appropriate if this would help us to determine whether an exemption applied under FOIA, or to determine where the public interest lies (when having to apply the public interest test).

Under FOIA, the fact that consulted third parties have not responded does not relieve us of our duty to disclose information within the normal time limit.

8.7 Clinical Advisors used in Joint Team cases

In some cases involving health bodies, the Joint Team has access to the clinical advisors used by PHSO to provide expert opinions. We should not provide clinicians’ names and registration numbers, as this would be an invasion of privacy and potentially raise the risk of them being approached when they are still practising within the NHS. Qualifications can be provided if they do not identify the clinician. The ICO have backed this approach in the past.