How to define personal information

This is the Information Commissioner’s 
Right to Know Week 

This week the Information Commissioner’s Office has been diligently spreading the word about Freedom of Information through its annual Right to Know Week campaign, to promote and encourage the public to understand their rights to access information.  

For newcomers to our shores, FOI refers to the Freedom of Information Law 2007. Whilst the FOI Law was passed in 2007, the Information Commissioner’s Office was created in 2009. Now in its fifth year, the ICO has found that the most commonly used exemption under the Law is section 23 regarding personal information and the one with potentially the highest impact on individuals.  

Exactly what is considered personal information? Under the FOI Law, this is described as “information or an opinion (including information forming part of a database) whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can easily be ascertained, from the information or opinion.”  

This includes:  

the individual’s name, home address or home telephone number;  

the individual’s race, national or ethnic origin, color or religious or political beliefs or associations;  

the individual’s age, sex, marital status, family status or sexual orientation;  

an identifying number, symbol or other particular assigned to the individual;  

the individual’s fingerprints, other biometric information, blood type, genetic information or inheritable characteristics;  

information about the individual’s health and health care history, including information about a physical or mental disability;  

information about the individual’s educational, financial, employment or criminal history, including criminal records where a pardon has been given;  

anyone else’s opinions about the individual; or  

the individual’s personal views or opinions, except if they are about someone else 

Many may think the story ends there but if one keeps reading section 23 they soon discover that nice tidy definition specifically excludes civil servants acting in an official capacity.  

To be precise section 23 states the following is not personal information under the Law: 

(i) where the individual occupies or has occupied a position in a public authority, the name of the individual or information relating to the position or its functions or the terms upon and subject to which the individual occupies or occupied that position or anything written or recorded in any form by the individual in the course of and for the purpose of the performance of those functions;  

(ii) where the individual is or was providing a service for a public authority under a contract for services, the name of the individual or information relating to the service or the terms of the contract or anything written or recorded in any form by the individual in the course of and for the purposes of the provision of the service; or  

(iii) the views or opinions of the individual in relation to a public authority, the staff of a public authority or the business or the performance of the functions of a public authority;  

When considering the use of the exemption in section 23(1) of the FOI Law, it is important to note it provides that: 

Subject to the provisions of this section, a public authority shall not grant access to a record if it would involve the unreasonable disclosure of personal information of any person, whether living or dead.  

Subsection (1) shall not apply in any case where the application for access is made by the person to whose affairs the record relates.  

Records relating to personal information shall be exempt without limitation as to time.  

The extent to which third party rights are to be protected shall be set out in regulations made under this Law.  

Over the past 12 months, the ICO has been meeting with information managers from across the 92 public authorities within government to focus on this particular exemption and the relevant regulations under the Law.  

The seminars have been informative, well received and enabled information managers to network, compare experiences and learn from each other.  

A copy of the presentation and handout on section 23, Personal Information, as well as the FOI Law and regulations are available on the ICO website at  


Commissioner’s Office