Introduction

You cannot do the jobs of Data Protection and Freedom of Information Officer without outside help. You'll need to pay attention to the guidance produced by the Information Commissioner's Office (ICO) and Scottish Information Commissioner (SIC). Even if you are not subject to the SIC, it is worth keeping an eye on its decisions, as the ICO will be doing so. If you have not already done so, you also need to read the legislation itself. I also recommend reading the decision notices relating to exemptions and exceptions that you are planning to use.

Legislation

The UK Freedom of Information Act (FoIA), 1998 and 2018 Data Protection Acts (DPAs), Environmental Information Regulations (EIR) and all the other Regulations are available through the legis - lation.gov.uk website. The Scottish legislation is available there as well. A web search on any of this legislation should bring up the direct link to it on this website.

The General Data Protection Regulation (GDPR) and other EU legislation are also available on the EUR-Lex.europa.eu website, but only as a hard-to-navigate HTML site or PDF. A better link to the GDPR is available here: https://gdpr-info.eu/. This separates out the Articles and Recitals as separate links, grouped by theme and Chapter, and makes the document so much easier to navigate.

You can also find the debates in the Houses of Lords and Commons relating to the 2018 DPA on the UK Parliament website. The 2018 DPA does not contain the text of the GDPR, so you will need access to both.

Guidance

For UK guidance on Data Protection, FoI and the EIR, go to the ICO's website: www.ico.org.uk. The guidance is split between what the public need to know and what organizations need to know. The ICO also has a helpline, including one specifically for small organizations, although I have tended to find that this is not very helpful if you have a question relating to something for which there is no case law.

For Scottish organizations, this type of guidance is available from the SIC website: www.itspublicknowledge.info/home/ScottishInformation Commissioner.aspx. Although the advice is specific to Scottish legislation, it is worth checking out if you are using a similar exemp - tion/exception in UK law to see if the argument you are making has been rejected by the SIC.