The (UK) Freedom of Information Act’s disclosure process is broken: where do we go from here?

This article builds on previous literature in the data protection and freedom and information field, which has argued that the “release and forget” disclosure model utilised by the Freedom of Information Act 2000 (FOIA) is unfit for purpose in the context of personal data that have been subject to a process of anonymisation, and that reform is necessary. Rather than outlining a detailed proposal for reform, the article intends to stoke debate in this area by highlighting a range of issues and factors that could help inform discussions regarding what shape any reform of the FOIA’s disclosure model should take. The article argues that the notions of privacy and data protection by design, data licensing, risk, contextual controls, metadata, and privacy enhancing technologies, should all have a role to play in respect of improving how anonymised data are disclosed under the FOIA.