Information rights
Good information handling provides a range of benefits as well as helping you to comply with the Data Protection and Freedom of Information Acts. We have produced guidance for senior managers about taking a positive approach to information rights.
Data protection – looking after the information you hold
If you hold and process information about your clients, employees or suppliers, you are legally obliged to protect that information. Under the Data Protection Act, you must:
- only collect information that you need for a specific purpose;
- keep it secure;
- ensure it is relevant and up to date;
- only hold as much as you need, and only for as long as you need it; and
- allow the subject of the information to see it on request.
Find out about your data protection obligations.
The ICO has also produced specific guidance on data protection which relates to local authorities:
Advice to local authorities on disclosing personal information to elected members
This guidance aims to provide local authorities with advice on what you need to consider when deciding to disclose personal information to elected members.
Freedom of information: access to information about public authority employees
This guidance gives public authorities practical advice about dealing with requests made under the Freedom of Information Act for access to information about your employees. It should be read in conjunction with our freedom of information guidance about the exemption for personal information.
Requests for personal information
Your employees and customers have rights to see their personal information. They can make a subject access request to see the personal information you hold about them. Find out more information on this and what you need to do to reply to a subject access request.
Notification
If you handle personal information, you may need to notify as a data controller with the Information Commissioner’s Office (ICO). Notification is a statutory requirement and every organisation that processes personal information must notify the ICO, unless they are exempt. Failure to notify is a criminal offence. See our page Do I need to notify and how do I maintain my register entry? for more information.
Employment
As an employer, you are obliged to protect your employees’ personal information. For more information, see our section on employment here; our Quick Guide to the Employment Practices Code gives practical advice on handling employees’ personal information, on monitoring at work and on employees’ rights. You will also find help on your obligations regarding the storing and release of any references you supply.
Freedom of information – making public information available
The Freedom of Information Act means that public authorities must disclose official information when people ask for it (unless there is a good legal reason not to), and they must reply within 20 working days. Find out about your freedom of information obligations.
We have produced guidance for specific public authorities:
Information produced or received by councillors
This guidance tells you when information produced or held by councillors may be requested under the Freedom of Information Act or Environmental Information Regulations.
Property searches
This guidance provides advice to local authorities on how you should respond to requests made for local property search information.
Publication schemes
If the establishment you work in is a public authority, the Freedom of Information Act means you must produce a publication scheme, which outlines the information you will routinely make available to the public - such as minutes of meetings, annual reports or financial information. What information do we need to publish? To help you do this, we have provided a definition document.
Code of Practice for archivists and records managers
The Information Commissioner’s Office (ICO) has a duty to review codes of practice submitted by trade associations under section 51 (4) (b) of the Data Protection Act 1998.
The ICO has considered the following code of practice, and is satisfied that it has been developed in consultation with relevant sectors and that it promotes good practice:
Code of practice for archivists and records managers under Section 51(4) of the Data Protection Act 1998