Manage the risk of disclosure of confidential information
How to protect your business' confidential information if you share it with public bodies subject to an FOI request.
The Freedom of Information (FOI) Act relates to public sector bodies. However, these organisations regularly engage with private sector companies in the provision of goods and services. This creates a situation where any information your business shares with public authorities may be subject to an FOI request and is potentially at risk of disclosure.
Risk of FOI disclosure
Types of information at risk of disclosure under the FOI Act include, for example:
- information you give to regulators in reports, annual returns, investigations, etc
- public tenders or contracts information
- your responses to public consultations
- information relating to planning procedures and proposed developments
Public authorities could also hold confidential or commercially sensitive information on your business, eg your financial records or contract details. This sort of commercially sensitive information may be exempt from the FOI Act.
How to manage the risk of FOI disclosure
You cannot entirely avoid the risks associated with passing information to public authorities. However, you can lessen them in a number of ways. For example:
Label information as 'confidential' or 'restricted'
If the information is confidential or commercially sensitive, think carefully if it is necessary to disclose it. If it is, make it clear by labelling it 'confidential' or 'restricted'. Submit it separately to the rest of the less-sensitive information to reduce the risk of accidental disclosure.
Keep in mind that the exemption that applies to confidential information is a very narrow one and that it only applies in very limited circumstances. It will not automatically apply to all documents marked 'confidential'.
Download the ICO's guidance on .
Consider consultation rights in contracts
Try to establish consultation rights in your contract, ie the right to be informed before the public authority makes any disclosure. This may give you a chance to take action to protect your business before the information goes public.
Don't rely on blanket confidentiality clauses. Look at terms and conditions for dealing with public authorities and try to minimise the impact of the Act.
Consider FOI training and devise procedures
Train your staff on FOI requirements, data protection and the potential risk of information disclosure.
Set clear internal policies and procedures for the release of information to public authorities. Record the information you share with them and review it regularly. Consider assigning FOI responsibility to an individual staff member or team.
If someone makes an FOI request, public authorities will have to release this information (subject to a number of exemptions).
While FOI can present a certain risk for your business, it can also provide an opportunity to gain useful information. For example, information about procurement criteria, decisions, previous contracts and even competitors.
Find out how to use FOI to your business advantage.