An FOI record release is the version of a file you give a requester under the Freedom of Information Act 2000. Section 40(2) exempts personal data from disclosure where release would breach the data protection principles, and s.40(3A) — added when the DPA 2018 came in — directs the decision-maker to that question by reference to whether disclosure would be lawful, in practice a legitimate-interests balance under UK GDPR Art. 6(1)(f) for third-party personal data. anonym.plus marks that data on your device.
When this applies
A requester asks for a held file. It names staff, members of the public, and third parties whose privacy s.40 is meant to protect.
How anonym.plus handles it
- Open the held file in anonym.plus on your device.
- Local OCR reads scanned pages and faxes too.
- The tool flags names, reference numbers, and contacts.
- Decide which identities the exemption protects.
- Black out each one, then check the page for misses.
- Save the cleared version on your machine.
What you need to provide
- The held file (PDF, DOCX, or scan).
- An operator: Redact for the public release copy.
- Optional rules to keep authority case codes that are not PII.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | member of public → [PERSON] |
| Identifiers | NATIONAL_ID | reference no. 4471 → [ID] |
| Contact | PHONE_NUMBER | 020 7946 0166 → [PHONE] |
| Location | LOCATION | home address → [ADDRESS] |
| Dates | DATE_TIME | DOB 04/1971 → [DOB] |
| Names | PERSON | junior officer → [PERSON] |
Compliance achieved
- Supports a withholding under FOIA 2000 s.40(2) (personal data).
- Prepares the file for the s.40(3A) lawfulness question, applying an Art. 6(1)(f) legitimate-interests balance to third-party data.
- Hides personal PII in held files before public release.
- Offline work keeps a sensitive file on-site.
- Local OCR lifts text from scanned exhibits for review.
Anonymise FOI releases offline — see plans & start free →
Limitations & cautions
Section 40 turns on the data protection principles, and s.40(3A) sends that back to a lawfulness and legitimate-interests test rather than a single fairness checkbox. The tool flags PII; the exemption call is yours. It cannot judge whether disclosure is fair or lawful. Log each withholding in your response to the requester.
Frequently asked questions
When does FOIA 2000 s.40 apply?
Section 40(2) covers personal data in held records where disclosure would breach the data protection principles. For a third party's data, s.40(3A) points you to whether disclosure would be lawful, which in most cases means running the legitimate-interests test in UK GDPR Art. 6(1)(f): a legitimate purpose, necessity, and no override by the individual's own rights.
Are junior staff names always withheld?
Not always. The Art. 6(1)(f) balance depends on role and expectation, not seniority alone. anonym.plus flags staff and third-party names so you can apply your authority's standard consistently across a large file.
Can it handle scanned files?
Yes. Local OCR reads scanned pages and faxes, so PII in image files is flagged with the typed text, which matters for an older paper file scanned for the response.