Regulation 11 - Personal data

What this exception means#

The authority is saying the information is personal data and that disclosing it would breach data protection law. This is the EIR equivalent of FOISA section 38.

Regulation 11 has two parts:

• Regulation 11(1) - if the information is your own personal data, it cannot be disclosed under the EIRs. Instead, you should make a Subject Access Request under data protection law.
• Regulation 11(2) - if the information is someone else’s personal data, it can only be disclosed if doing so would not breach the data protection principles (primarily the requirement that processing is lawful and fair).

Important: Regulation 11 sits outside regulation 10, so it works differently depending on which condition the authority relies on. In the usual case - the first condition, that disclosure would breach the data protection principles - there is no separate public interest test, but an equivalent balancing exercise is built into the data protection principles themselves, through the legitimate interests test under Article 6(1)(f) of the UK GDPR. In the two rarer cases - the second condition (the person has objected to processing under Article 21 of the UK GDPR) and the third condition (the person would not get the data through their own subject access request) - regulation 11 requires an explicit public interest test: the data can only be withheld if the public interest in making it available is outweighed by the public interest in not doing so.

What the authority must show#

For regulation 11(2) to apply (third party personal data), the authority must demonstrate that:

1. The information is personal data - it relates to an identifiable living individual
2. One of the three conditions is met - usually the first: disclosure would breach a data protection principle, because there is no lawful basis for disclosure or disclosure would be unfair
3. It has carried out the legitimate interests balancing test - weighing the public interest in disclosure against the individual’s rights and freedoms
4. If it relies on the second or third condition (an Article 21 objection, or data exempt from the person’s own subject access request): that the public interest in making the information available is outweighed by the public interest in withholding it
5. It has considered redaction as an alternative to full withholding - removing names and identifying details while releasing the substance
6. The information relates to a living individual - regulation 11 cannot be applied to information about deceased persons

Things to check#

• Is it genuinely personal data? Not all information that mentions a person’s name is personal data in a meaningful sense. The names of public officials in official documents, for example, may be disclosable regardless.

• Could they redact instead? Authorities should always consider whether they can release the information with personal details removed. Blanket refusals under regulation 11, where redaction is possible, are a common failing.

• Is the person a public official? Information about public officials acting in their official capacity - particularly senior officials - generally has a weaker privacy claim. The public has a legitimate interest in knowing who makes decisions about environmental matters.

• Did they do the balancing test? The authority must carry out a genuine balancing exercise under the legitimate interests test. Simply asserting “personal data” without analysis is not sufficient.

• Is the data really about an identifiable individual? If the information is statistical, anonymised, or about an organisation rather than a person, regulation 11 does not apply.

• Is the person alive? Regulation 11 only protects living individuals. Information about deceased persons is not personal data.

Use the interactive tool#

Answer the questions below to check whether regulation 11 has been properly applied to your request.