Data protection and freedom of information

Data protection information about individuals held by public authorities is governed by the data protection legislation, as is such information held by private bodies.

• If information is biographical, and is capable of being used on its own or in conjunction with other information to identify a person, it is covered by data protection.
• Where it applies, data protection legislation restricts the use that can be made of the information, and allows the individual rights to get that information. There are a wide range of exemptions which can apply, e.g. national security and where disclosure is required by law. Decision-makers should ensure that all personal information is accurate, up-to-date, kept for no longer than necessary and stored safely.
• Under the Freedom of Information (Scotland) Act 2002, members of the public are given rights to get information from most Scottish public authorities merely because it is held by the authority. Reasons for a request do not have to be given. Decisions not to release information can be reviewed by the Scottish Information Commissioner.