«Redaction Policy London Borough of Barnet DATA PROTECTION Data Protection – Redaction Policy Document Control Document Redaction Policy Description ...»
London Borough of Barnet
Data Protection – Redaction Policy
Document Redaction Policy
This document details the process which should be applied when
redacting information prior to disclosure / publication of information.
This policy is written in conjunction with our obligations under the
Data Protection Act 1998 and Freedom of Information Act 2000.
Version V1 Date Created April 2012 Status Approved Authorisation Name Date Prepared By: April 2012 XXXXXX Checked By Standard and Information Rights Team (SIRT) April 2012 Approved by Information Governance Council (IGC) May 2012 Version Control Version Date Author Reason for New Version number V 1.1 April 2012 Creation of Policy and Toolkit XXXXXX V 1.2 May 2012 IGC Comments and approval V1.2 Jan 2014 Review XXXXXX Date last reviewed: April 2012 Date of next review: April 2013 Data Protection – Redaction Policy Contents 1 Introduction
3 Key legislation
4 What is redaction
4.1 Key principles for redaction
5 Identifying material for redaction
6 Withholding without redaction
7 Redaction and scanning
Delegated Powers Reports (DPR), ‘Exempt’ Committee reports/ etc:............. 4 9 Commonly redacted information
9.1 Names and contact details
9.3 Bank details
9.5 Declaration of interests
9.6 Gifts and Hospitality
9.8 Sole trader information
10 Contact information
1 Introduction Barnet Council routinely publishes information and is continually striving to be a more transparent organisation. Information is published in various ways, including via the website, leaflets, newsletters, brochures and similar documents that are published specifically to provide information to members of the public about services provided by the organisation. There are other instances where information is published where redaction is more likely to apply, because the documents being considered for publication contain some
confidential information that must be made unreadable ahead of publication:
This policy and accompanying toolkit has been produced to provide guidance on the editing of exempt material from information held by the London Borough of Barnet. Its purpose is to assist in the implementation of the Freedom of Information Act 2000 (FOIA) and the Environmental Information Regulations 2004 (EIRs), whilst complying with our obligations under the Data Protection Act 1998 to protect personal information.
Under the FOIA and EIRs, the council is required to supply information to anyone that requests it unless an exemption applies. Even then there is a further requirement, in most cases, to consider whether the public interest lies in favour providing the information or maintaining the exemption.
This guidance is based on the Redaction Toolkit for the Editing of Exempt Information from Paper and Electronic Documents Prior to Release (version 2.1, 2011) published under Crown Copyright by the National Archives.
This guidance is aimed at FOI/SAR Link Officers and any other officers who handle requests for information under the FOIA, the EIRs and the DPA, or undertake any process of redaction.
3 Key legislation The main legislation which require that redaction is carried out before information is disclosed, are listed below. This list is not exhaustive and other legislation may require the release of information redacted where applicable.
Data Protection Act 1998 Freedom of Information Act 2000 Environmental Information Regulations 2004 Common Law Duty of Confidentiality The Data Protection Act 1998 prohibits the processing, which may include publishing, of personal data unless certain conditions are met (for example, if an individual has given consent for data about them to be processed).
Personal information means information which relates to a living individual
who can be identified:
(a) from that information, or (b) from that information and other information in the possession of the Data Controller. This will include any expression of opinion about the individual and any indication of the intentions of the Data Controller, or any other person, in respect of the individual.
Even if certain conditions for processing are met, Section 10 of the Data Protection Act 1998 gives individuals the right to stop the processing of their data if it causes damage or distress which is unwarranted.
Redaction is a process which is undertaken to render information unreadable.
This is done by blocking out individual words, sentences or paragraphs or by removing whole pages or sections prior to the release of the document.
4.1 Key principles for redaction Redaction is carried out in order to remove exempt information from a document. It should be used when one or two individual words, a sentence or paragraph, a name, address or signature needs to be removed.
However, if so much information is deemed to be exempt and the document becomes nonsensical, the entire document should be withheld.
When responding under FOI you must ensure you state what exemption the information has been redacted / withheld under, this should be done for every exemption, either in the covering response letter or if more than one exemption has been applied, this should be clearly marked on the document itself next to the redacted area.
Redaction must never be undertaken on an original document. A copy must be taken first to ensure all the information contained in the original document remains intact.
This ensures that while the redacted information is permanently removed from the copy of the record, which can then be made accessible, the original text remains in the original record. Redaction can be challenged and for this reason the unredacted document must always be kept related to the redacted version. Redaction should never result in the complete removal or amendment of text or information from an original record.
When undertaking redaction, reviewers should consider whether any other factors are important for the understanding of the material. For example, if colour within a document makes the meaning clear, a redacted colour copy should be released.
Redaction should be performed by the service who holds the information and by staff that are knowledgeable about the records and can determine what material is exempt.
Redactions shouldn’t just be blank space, it should be clear that redactions have been made to a document. The amount of information redacted should also be clear.
Applicants may request that information be presented to them in electronic form. For paper documents, this will usually mean scanning the redacted version of the document.
Under FOIA the reason for the redaction must always accompany the redacted document, for example, “redacted as it is considered to be personal data under Section 40 of the Freedom of Information Act 2000”.
5 Identifying material for redaction All staff should be aware of the requirements of the Data Protection Act and ensure personal data is not released in breach of the Act. Further guidance can be found in the Data Protection Policy.
In order to comply fully with a request for information, it is essential that only exempt material be redacted. A whole sentence or paragraph should not be removed if only one or two words are non-disclosable, unless release would place the missing words in context and make their content or meaning clear.
Reviewers should also consider that earlier statements in a document might suggest the content of removed material. For example, if a paragraph refers to reports from overt sources, and the following paragraph refers to reports from covert sources, as well as removing the words ‘covert sources’, ‘overt sources’ would also need to be removed or the meaning of the missing words from the second paragraph could be inferred.
Records should also be checked for other copies of the same documents so that redaction is carried out consistently, and indexes should be checked to ensure that they do not contain details of the redacted material.
6 Withholding without redaction Redaction only applies where certain elements of a page of a document can be released and certain elements must be withheld. If it is decided that a whole document or a page or pages of a document are not to be disclosed, then the information contained within it does not need to be redacted.
Instead, the information can be withheld in total. Where such information is withheld this must be referenced in any response or stated when published.
For example: “This report is 30 pages long, pages 23 to 25 have been withheld as they are exempt under section 43 of the Freedom of Information Act 2000”
7 Redaction and scanning
Once redactions have been made on copies of documents, you must ensure that the redacted text is completely illegible on the final copies to be released.
When redacting by hand with a black marker pen the best approach to take is to scan the documents on an MFD on the “Black and White” and “Text” settings. This should ensure that the text does not show through. However, you should always check that the text is unreadable before releasing documents.
Delegated Powers Reports (DPR), ‘Exempt’ Committee reports/ etc:
An exempt DPR or a report that was exempt when it went to committee is not automatically exempt under FOIA.
Although Schedule 12A of the Local Government Act states that certain information is exempt information this does not operate as a statutory bar and s.44 of the Freedom of Information Act, which covers information prohibited from disclosure under other legislation is not applicable.
This correct interpretation is:
Schedule 12A lists the information that is exempt from the requirements of Part VA, and not information that is exempt from disclosure under any other regime.
Consideration of disclosure under the FOIA requires the application of the FOIA categories of exempt information to the information and not the Schedule 12A description of exempt information.
Nothing in Part VA or Schedule 12A actually prohibits the disclosure of information. At no point is it provided that such information should not be disclosed, merely that it is not subject to the Part VA requirement to disclose. Therefore, s.44 of FOIA cannot apply.
However, this does not mean that all information exempted under Schedule 12A must be released as a result of requests for information. Whilst it may be the case that all of the report can be released under the FOIA, it may well be that one or more of the exemptions and exceptions contained within the FOIA and EIR would apply. It may also be the case that some DPRs/reports exempted under Schedule 12A lose their sensitivity over time.
When considering what to release in response to a request for exempt DPRs/reports, the section below should be consulted.
9 Commonly redacted information The following are details which are commonly redacted. In all cases where redactions are undertaken, the reasons must be stated and the relevant exemptions/exceptions applied.
9.1 Names and contact details 9.1.1 Freedom of Information Names and contact details of individuals should not be disclosed as a matter of course.
It is council policy, in line with guidance issued by the Information Commissioner’s Office (ICO), not to routinely release the names and contact details of officers below the level of Head of Service or senior officers whose details are listed on the corporate structure chart.
There may be circumstances where it is appropriate to release the details of more junior officers and similarly where the names of senior officers should be redacted. For example, if officer names are in the public domain through attendance at a public meeting, then there would be no need to redact them from the published minutes. If you are unclear as to the approach you should take, please contact the Information Management Team.
9.1.2 Subject Access Requests When dealing with the redaction of names in relation to Subject Access requests, disclosure considerations are slightly different. We should look to be as transparent as possible whilst still taking into account any conflicts of interest or confidentiality concerns.
The rights of the individuals named on documentation should be weighed against the right of access of the individuals who is seeking the information and a decision made based on this.
Information generally known by the individual making the request - If the name of an individual or council officer has previously been provided to the individual i.e. a member of staff (acting in the course of their duties), who is well known to the individual making the request through their previous dealings, would be more likely to be disclosed than information relating to an otherwise anonymous private individual.
Circumstances relating to the individual making the request – If the names of the officers involved have been the ones that have made key decisions and choices in regards to the individual, it may be deemed appropriate to release their names.
Consent – where there is uncertainty as to whether to disclose an officer name or nor it is considered good practice to consult with affected officers to seek consent rather than applying a blanket redaction approach.
Further guidance and advice should be sought from the Information Management Team if in doubt.
9.2 Pronouns When redacting names you must follow the redaction through, by redacting any pronouns which relate to the redacted names. e.g. her/his, he/she.
9.3 Bank details The bank account details of both individuals and businesses must be redacted from all documents that are to be released into the public domain.
9.4 Signatures In most cases, signatures constitute personal data as they can identify the person signing.