Staff Data and Freedom of Information

What Staff Data Can Be Disclosed Under the UK Freedom of Information Act? Many public sector organisations struggle when people make freedom of information requests  that involve information about staff and other workers. There is no automatic exemption for personal data about anyone other than the requestor under FOI. Therefore public authorities must carefully balance transparency obligations with data protection rights, particularly under the UK GDPR and the Data Protection Act 2018. The question is not whether information is held, but whether it can be lawfully and fairly disclosed.

________________________________________________________________________________________________

The Legal Framework: FOI Meets Data Protection

When a request involves staff information, Section 40 of FOIA is usually engaged. This exemption protects personal data, meaning any information relating to an identifiable individual. The information is only disclosable if:

1. Disclosing the information would not breach any of the data privacy principles. The key test is whether disclosure would be:

• Lawful
• Fair
• Transparent

2. it would not not breach any person exercising their right to object to processing

3. disclosure would not otherwise be exempt for a range of reasons set out in the Data Protection Act of the UK GDPR. These include national security, defence, some law enforcement processing, and specific exemptions to disclosure set out in Schedules to the Data Protection Act.

However, not all staff data is treated equally. The level of disclosure of information that is not excluded by the above often depends on the seniority of the employee, the nature of the information, and the reasonable expectations of privacy.

Information That Is Usually Disclosable

Certain categories of staff data are routinely disclosed because they align with the public interest in transparency and accountability.

Senior Staff Information

Information about senior employees is more likely to be disclosed. This typically includes:

• Names of senior officials (e.g. directors, chief executives)
• Job titles and organisational roles
• Salaries, salary bands, or pay grades
• Expenses and benefits funded by public money

The rationale is clear. Senior staff make strategic decisions and are accountable for public resources. Their roles carry an expectation of scrutiny.

Organisational and Structural Information

Requests about staffing structures are often disclosable, particularly where individuals are not identifiable.

Examples include:

• Departmental structures
• Job descriptions (including the salary range of a role)
• Headcounts and workforce statistics
• Vacancy numbers

This type of information enhances understanding of how public authorities operate without infringing on individual privacy.

Professional Capacity Information

Where staff are acting in an official capacity, some information may be disclosed.

For example:

• Contact details for generic roles (e.g. “FOI Officer”, Data Protection Officer, or “Press Office”)
• Work-related responsibilities
• Participation in official meetings (particularly for senior staff)

This reflects the principle that public servants operate within a framework of accountability.

Information That Is Usually Withheld

Other categories of staff data are far more likely to be exempt due to privacy concerns.

Personal and Sensitive Data

Information that is inherently private will almost always be withheld, including:

• Home addresses
• Personal email addresses or phone numbers
• Dates of birth
• Medical or health information
• Disciplinary records
• Trade union membership

Disclosure of such data would typically be unlawful and unfair, and therefore prohibited.

Junior Staff Information

The personal details of junior or front-line staff are usually withheld.

These employees:

• Have limited decision-making authority
• Do not represent the organisation at a strategic level
• Have a stronger expectation of privacy

In most cases, their roles can be described without identifying them individually.

Performance and Conduct Information

Requests for information about:

• Individual performance
• Complaints against staff
• Internal investigations

are highly sensitive. Disclosure could damage reputations and breach confidentiality. Such information is generally protected unless there is an overriding public interest, which is rare.

________________________________________________________________________________________________

The Public Interest and Reasonable Expectations

A central concept in determining disclosure is the reasonable expectation of the individual.

Would a member of staff reasonably expect their information to be made public?

For example:

• A chief executive is likely to expect scrutiny of salary and expenses
• A junior administrator would not expect their identity to be disclosed (although you can ask for consent)

Public authorities must weigh:

• The public interest in transparency
  against
• The individual’s right to privacy

This balancing exercise lies at the heart of FOI decision-making.

Context Matters: Case-by-Case Assessment

There is no rigid formula. Each request must be assessed on its own merits.

Key factors include:

• The seniority of the staff member
• The nature of the information
• The purpose of disclosure (in terms of public interest, not requester motive)
• Potential harm or distress caused by disclosure

Even similar requests can lead to different outcomes depending on context.

Redaction as a Practical Solution

Where documents contain both disclosable and exempt information, redaction plays a crucial role.

Authorities can:

• Remove personal identifiers
• Anonymise individuals
• Disclose the remainder of the information

This allows transparency to be preserved without breaching data protection obligations.

Common Pitfalls for Public Authorities

Handling staff data under the Freedom of Information Act presents several challenges:

• Over-disclosure, risking data protection breaches
• Over-redaction, undermining transparency
• Failing to distinguish between senior and junior staff
• Not properly documenting the reasoning behind decisions
• Failing to seek the advice and support of their Data Protection Officer

A structured, well-reasoned approach is essential.

Conclusion: Disclosing Staff Data under FOI

Disclosing staff data under the Freedom of Information Act requires careful navigation of competing principles. Transparency is vital. So is privacy.

In broad terms:

• Senior staff information is more likely to be disclosed
• Organisational data is often safe to release
• Personal and sensitive data must be protected

The ultimate question is always the same:

Is disclosure lawful, fair, and in the public interest?

By applying this test rigorously, public authorities can meet their obligations under FOI while respecting the rights of their employees.

________________________________________________________________________________________________