ICO clarifies law on information held in private email accounts

The Information Commissioner’s Office (ICO) has published new guidance making it clear that information concerning official business held in private email accounts is subject to the Freedom of Information (FoI) Act.

Information Commissioner Christopher Graham explained: “It should not come as a surprise to public authorities to have the clarification that information held in private email accounts can be subject to FoI law if it relates to official business. This has always been the case – the Act covers all recorded information in any form.

“It came to light in September that this is a somewhat misunderstood aspect of the law and that further clarification was needed. That’s why we’ve issued new guidance today with two key aims – first, to give public authorities an authoritative steer on the factors that should be considered before deciding whether a search of private email accounts is necessary when responding to a request under the Act. Second, to set out the procedures that should generally be in place to respond to requests. Clearly, the need to search private email accounts should be a rare occurrence; therefore, we do not expect this advice to increase the burden on public authorities.”

Key points set out in the guidance include:
•Where a public authority has decided that a relevant individual’s email account may include official information that falls within the scope of the request and is not held elsewhere, it will need to ask that individual to search their account.
•Where people are asked to check private email accounts, there should be a record of the action taken. The public authority needs to be able to demonstrate, if required, that appropriate searches have taken place.
•Although the main emphasis of the guidance is on official information held in private email accounts, public authorities should be aware that the law covers information recorded in any form.
•Public authorities should remind staff that deleting or concealing information with the intention of preventing its disclosure following receipt of a request is a criminal offence under section 77 of the Act.
Mr Graham said that it is accepted that, in certain circumstances, it may be necessary to use private email for public authority business. There should be a policy which clearly states that in these cases an authority email address should be copied in to ensure the completeness of the authority’s records.