Legal analysis not personal data accessible under section 8 - Cabinet Office (2022-06-28)

Summary

This is an Ombudsman case decision (Case 202200069) resolving a complaint that the Cabinet Office and PACT Caucus failed to disclose all personal data in response to a section 8 Data Protection Act (2021 Revision) access request. The complainant sought access to an unredacted Cabinet Paper relating to his immigration application, arguing that legal analysis contained in the paper was his personal data.

• Finding: After reviewing the unredacted Cabinet Paper, the Ombudsman found the undisclosed portions consisted purely of legal analysis supporting the Cabinet's administrative decision and contained no data relating to the complainant.
• Legal basis: Applying the CJEU ruling in YS v Minister voor Immigratie and related UK case law (Durant, Edem), the Ombudsman concluded that legal analysis used to support an administrative decision cannot in itself be classed as personal data under the DPA, even though the analysis may relate to the same matter as the data subject.
• Outcome: Because the Data Controllers had already voluntarily disclosed all personal data (including four paragraphs initially withheld), the Ombudsman held they had fully satisfied their section 8 obligations and closed the case with no further action required.

The decision does not create new statutory rules but provides interpretive guidance on how section 8 access rights apply to legal analysis embedded in government decision-making documents, which may be relevant to other data controllers assessing similar access requests.

Key obligations

• Data controllers responding to section 8 access requests must disclose all personal data relating to the data subject, but need not disclose legal analysis that does not itself relate to the data subject, even if contained in the same document.

Applies to

data controllers, government entities subject to the Data Protection Act