I received a number of complaints in the recent past concerning the failure of some financial institutions to comply in full with access requests that are submitted to them by their customers or former customers. A recurring theme with these complaints is the withholding, under the provision set out in Section 4(4A)(b)(ii) of the Data Protection Acts, of personal data contained in credit assessments or submissions to credit committees. This provision allows a data controller to withhold personal data relating to the requester if the data consists of an expression of opinion about the requester where such an opinion was given in confidence or on the basis that it would be treated as confidential.
The exemption to the right of access in this provision is limited to expressions of opinion about the data subject given in confidence which may be contained within a document(s). The exemption does not apply to the remainder of the personal data in the document(s) which is not an expression of opinion about the data subject. It may be the case, for example, that a part, section or sentence within a document is, on its own merit, an expression of opinion given in confidence about a data subject. However, it is highly unlikely that a document would constitute in its entirety an expression of opinion given in confidence about an individual. In most circumstances, a document which contains an expression of opinion would also contain factual information about the individual who is the subject matter of the expression of opinion. I consider that an expression of opinion must be considered in its narrowest sense, namely the view(s) held by a person or entity of a living individual or what one thinks about a living individual. Clearly it does not apply to matter of fact about a living individual.
It follows, therefore, that a data controller may not be permitted to apply a blanket exemption to the right of access over an entire document(s) simply because there are parts, sections or sentences within it which may be considered to be an expression of opinion about a living individual given in confidence. The exemption, where validly claimed, may only be applied to cover the specific elements of the document(s) that constitute an expression of opinion about the data subject given in confidence. A data controller can comply with the access request and, at the same time, easily give effect to a valid exemption by blackening out the specific expression of opinion and then release the remainder of the document(s).
Some financial institutions have attempted to rely on Section 4(4A)(b)(ii) to restrict access to certain information contained in credit assessments or submissions to credit committees in the consideration of loan applications. However, I consider that an employee who submits in written form their views or opinions on the financial status of a customer does so as part of the day-to-day performance of their own functions as an employee. For that reason, I do not consider that they can validly claim that their views or opinions on the customer concerned enjoy an expectation of confidentiality. A financial services employee must be able to stand over their views or opinions on a customer without trying to conceal their thinking behind the cloak of an expectation of confidentiality.
In cases which we investigated, we upheld the rights of the requesters to access this information and the financial institutions concerned have released the personal data concerned on pain of enforcement. I am putting all financial institutions on notice that any further reliance on this exemption to withhold such personal data will be met with by enforcement proceedings.