Section 40 (Personal Information)
To the extent that the information that we hold contains personal data about individuals, section 40(2)(b) of FOIA provides that "any information to which a request for information relates is also exempt information if the first, second or third condition listed below is satisfied."
We have applied this exemption because the first condition (as stated in section 40(3A) of FOIA) is satisfied. Some of the information you have requested comprises the personal data of individuals other than yourself which, if disclosed, would contravene any of the data protection principles. It is normal practice within the FCA not to disclose the personal details of staff whose substantive role is below head of department level.
In particular, it would be a breach of the first data protection principle as set out in Article 5 of the UK GDPR, to disclose such information, as it would not be lawful or fair to the individuals concerned to do so. This is because, they would not have had the expectation that this information would be disclosed under these circumstances, and therefore disclosure would not be necessary, or lawful, where none of the conditions in Article 6 of the UK GDPR have been met.
This is an ‘absolute’ exemption, and so it is not necessary to balance the public interest for and against disclosing the information.
