The UK Freedom of Information Act (FOI) outlines that public authorities must release recorded information when they receive an FOI request. Recorded information includes printed documents, computer files, letters, emails, photographs, and sound or video recordings.
While the law requires authorities to provide the maximum amount of information, several exemptions are available, and organisations are allowed/obliged to redact certain sensitive information.
The ICO recommended National Archives Redaction Toolkit defines redaction as “the separation of disclosable from non-disclosable information by blocking out individual words, sentences or paragraphs or the removal of whole pages or sections prior to the release of the document. In the paper environment some organisations will know redaction as extracts when whole pages are removed, or deletions where only a section of text is affected.”
Common categories for redactions include:
Personal Data: Names, addresses, contact details, and any other identifying information of a third party, in compliance with the UK General Data Protection Regulation (the UK GDPR) or the Data Protection Act 2018 (the DPA 2018). However, if an employee’s contact details are already in the public domain, their details do not have to be redacted from meeting minutes, for example.
If the requester if seeking access to his/her own personal data, they should instead submit a Data Subject Access Request. See ICO guidance for further details.
Commercial Interests: Organisations do not have to disclose any sensitive financial figures, intellectual property, or trade secrets that could disadvantage a third party or the authority itself. While the FOI Act does not define ‘trade secret’, the ICO has issued some guidance on how it interprets this term.
Security & Law Enforcement: Organisations may withhold information if disclosing it would harm either their ability, or the ability of another body, to enforce the law.
Formulation of Policy: Qualified public authorities do not have to disclose information that is needed for these authorities to have a free and frank discussion internally about a policy.
Legal professional privilege: In-house-lawyers, solicitors and barristers do not have to disclose information shared between a client and themselves for the purposes of providing legal advice or for ongoing or proposed legal action.
Most of these exemptions are not ‘absolute’ but require a public interest test.
Organisations therefore need a comprehensive redaction policy and the means to securely black out or remove any information that is legally exempt.
Responding to an FOI request may be an onerous task as the scope of documents to be searched can vary from tens of thousands up to a million documents, even if just 2-3 per cent of the information is relevant to the request. This is where a good redaction tool comes in. Organisations typically see 79-90 per cent time savings when they start using specialist software. The main time savings can be seen when identifying which data needs to be looked at for a case. Phaselaw’s redaction software can deal with any format of documents thus avoiding the painful task of converting files into PDFs. Other benefits include being able to check records for other copies of the same documents so that redaction is carried out consistently.
It is important to work on a copy and ensure the originals remain untouched. Before responding to an FOI request and checking that the response does not contain unnoticed personal data, it is also good idea to perform an additional check regarding ‘metadata’. The ICO advises that metadata might include the name of the author, or details of earlier draft versions. “In particular, a spreadsheet displaying information as a table will often also contain the original detailed source data, even if this is not immediately visible at first glance,” the ICO says.
In the response, organisations must also tell the requester why certain information has been redacted (mention the exemption that applies). The National Archives advises that “a whole sentence or paragraph should not be removed if only one or two words are non-disclosable, unless release would place the missing words in context and make their content or meaning clear.” If there are so many redactions that the document is nonsensical, you may produce a summary of the document – this is automatically done by Phaselaw’s redaction software.
Being able to conduct searches easily will make your request handling process more efficient and also promote transparency in your organisation, the ICO says. An audit log, created in the redaction process will effectively be your evidence should the ICO ever come and inspect your organisation’s FOI processes.
