Coronavirus (Covid-19): Latest updates and information
Skip to main content Skip to navigation

Exemptions from Access

3. Qualified and Absolute Exemptions

Although the FoIA created a right for any member of the public to request specific information held by the University, it also sets out a number of exemptions from that right of access.

The exemptions(PDF document) within the FoIA are divided into qualified exemptions and absolute exemptions. In broad terms these are as follows:

(a) Qualified exemptions

These are cases where the University, having identified a possible exemption, must apply the public interest test. In essence, the public interest test involves weighing the benefits of the disclosure of information against the purpose of the exemption. There are two parts to the public interest test:

  • Consideration of whether the public interest in maintaining the exclusion to confirm or deny outweighs the public interest in confirming or denying that the University holds the requested information.

  • Consideration of whether the public interest in maintaining the exclusion to communicate the requested information outweighs the public interest in communicating the requested information.

Where the public interest for and against disclosure is evenly balanced, information should be disclosed. If it is determined after the public interest test that the information should be withheld, the University has a duty to issue a refusal notice confirming or denying whether it holds the requested information (where this is applicable), stating that an exemption has been relied upon and why the exemption applies.

(b) Absolute exemptions

These are cases where the right to know is wholly disapplied and the University has no obligations to provide the information if it does indeed hold it. The duty of the University to confirm or deny whether it holds the requested information is subject to consideration of whether this process would prejudice the purpose of the exemption (see below) or the information itself would be released through the process of confirmation or denial. In some cases there is no legal right of access at all, for instance information supplied by or relating to bodies dealing with security matters of information covered by parliamentary privilege. In other cases, for instance information available to the applicant by other means or personal information relating to the applicant, it may be possible to obtain the information through other means.

Some of the exemptions in the Act are class exemptions and some prejudice-based. Class exemptions are designed to give protection to all information falling within a particular category, for e.g. information subject to legal professional privilege. Prejudice-based exemptions only come into force if a particular disclosure would prejudice the purpose of the exemption, for e.g. prejudice to international relations. The important thing to note is that both class and prejudice-based exemptions are subject to the public interest test unless the Act states that they are absolute exemptions.

Both qualified and absolute exemptions have the effect of permitting the University to withhold some or all of the information requested, where that information can appropriately be classified under the terms of one or more of the listed exemptions, or alternatively of allowing the University to ask for more time to consider the request (typically where the University is required to apply the public interest test), providing the applicant is advised of this within the initial 20-day limit. It should be noted that where the University is relying on one or more of these exemptions to withhold or delay the provision of information, it must issue a Refusal Notice (under Section 17 of the FoIA) within the same 20 working day timeframe, specifying the exemption and why it applies (unless to do so would in itself prejudice the exemption in question) and, if applicable, informing the applicant that it needs more time to consider the public interest in disclosure together with an estimate of the date by which it expects to make its decision.

Detailed guidance on exemptions is available here.

4. Data Protection Act 1998 and Environmental Information Regulations 2004

The most important access regimes apart from the FoIA are subject access under the Data Protection Act 1998 and access to environmental information under the Environmental Information Regulations 2004. Both subject access requests and requests relating to environmental information, as defined under their respective Acts, are exempt under the FoIA and should be dealt with in accordance with the appropriate regulations.

The key similarities and differences between the FoIA and these other two access regimes are set out in the table below.

Access Regime

Subject matter

Time Limit




Need to cite Act?


Mode of request

Freedom of Information

All information not accessible under the Data Protection and Environmental Information Regulations

20 working days from receipt of request

No fee for information requests which cost less than £450 - but can charge for disbursements, i.e. photocopying, posting

23 exemptions, two different types:
i) Qualified - subject to a public interest test
ii) Absolute exemption


Must be in writing

Data Protection

Applicant's own personal data

40 calendar days

Subject Access Requests cost £10

Limited range of exemptions, not subject to the public interest test. Some vary considerably from those in the FOI Act.


Must be in writing

Environmental Information Regulations

Environmental Information

20 working days

Fees may be charged and no upper limit for the cost of meeting a request beyond which the request may be refused.

Limited range of exemptions, all of which involve Public Interest Test


Orally or in writing

Table 1: Similarities and Differences between FoIA, DPA and Environmental Information Regulations

4.1 Subject Access Requests under the Data Protection Act 1998

Under the FoIA, any requests relating to personal information[1] about the applicant fall under the category of absolute exemptions. However, any such requests automatically become subject access requests under the Data Protection Act 1998 and must be treated as such. This means that despite the exemption under the FOIA the applicant has a right to his or her information under the Data Protection Act. It is then the duty of the University to provide advice and assistance to the applicant in order that his/her request can be submitted appropriately and the subject access fee (£10) paid. The University’s Data Protection guidelines can be accessed here.

In contrast, any requests for personal information where the data subject is not the applicant are covered by the FoIA. In such cases there is an exemption, but only if disclosure would breach any of the eight Data Protection Principles.

It is worth bearing in mind that under the FoIA the applicant must simply state his or her name, provide an address for correspondence and describe the specific information requested. Only in exceptional circumstances would the University be justified in seeking to verify the applicant’s identity – for instance if it is suspected that the request is a vexatious one, submitted under an assumed name. Under the Data Protection Act, by contrast, the University must avoid making disclosures of personal information that would breach the Act. In sensitive cases or where you suspect that the applicant is not who they claim to be, the University may therefore need to obtain proof of identity from the applicant.

4.2 Environmental Information Regulations 2004

Revised and strengthened Environmental Information Regulations (EIR) came into force on 1 January 2005. Like the Freedom of Information Act they give access rights to any person, anywhere in the world, but they deal specifically with information relating to any decisions, activities and policy formulation that may have an impact on the environment. The definition of environmental information is broad and will include such things as details of the University’s health and safety policies, cost benefit analysis, details of discharges and emissions, and any information relating to policies, plans and programmes that affect, or are likely to affect, the environment.

Environmental information is exempt information under section 39 of the FoIA, but must be dealt with in accordance with the Environmental Information Regulations.

5. Procedural Limitations

In addition to the exemptions set out by the FoIA, there are various other cases in which the information requested might be withheld, as follows:

  • The request is 'vexatious'. A vexatious request is determined by the information requested, not the person making the request. An individual cannot be classified as a vexatious requestor. An individual can make as many requests for information as he/she wishes, and cannot be labelled as vexatious - each of his/her requests must be determined on a case-by-case basis - but the provisions on aggregating the costs of these requests may be relevant (these provisions are intended primarily to prevent individuals or organisations circumventing the £450 cost ceiling by splitting a request into smaller parts (see Charging for Information)). Vexatiousness needs to be assessed in all the circumstances of an individual case, but if a request is not a genuine endeavour to access information for its own sake, but is aimed at disrupting the work of an authority, or harassing individuals in it, then it may well be vexatious.

  • The request is identical or substantially similar to a recent request made by the same individual/organisation. Where the University has previously complied with a request for information, it is not obliged to comply with a subsequent identical or substantially similar request from the same applicant unless a reasonable interval has elapsed between compliance with the previous request and the making of the current request.

  • The request relates to information that is not 'held' by the University (see Information Covered by the Right to Know).

  • Where the cost of fulfilling the request would amount to more than £450 (see Charging for Information).


[1] The FoIA has had the effect of expanding the definition of 'personal data' as defined in the Data Protection Act. 'Personal data' may take any of the following forms:

  • Computer input documents;

  • Information processed by computer or other equipment (e.g. CCTV);

  • Information in medical, social work, local authority housing or school pupil records;

  • Information in some sorts of structured manual records;

  • Unstructured personal information held in manual form by [the University].

The last of these categories was introduced into the Data Protection Act by the FoIA.