ICO updates guidance on disclosing documents to the public

The Information Commissioner's Office (ICO) has published updated guidance on disclosing documents to the public securely. In particular, the guidance addresses how to avoid accidental personal data breaches, such as those caused by hidden information contained within spreadsheets. 

While the ICO highlights that the aim of the guidance is to help organisations protect personal information (a goal that may seem obvious), events like the Police Service of Northern Ireland (PSNI) personal data breach in 2023 and the more recent discovery of the MoD data breach that led to thousands of Afghans being relocated to UK demonstrate that hidden data can have hugely significant safeguarding consequences. In this context, preventing such data breaches is vital for maintaining public trust.

The guidance offers practical steps, including "how-to" videos and checklists, for checking documents for hidden data, removing or redacting it, and selecting appropriate disclosure formats. The guidance applies to various scenarios where documents are disclosed publicly or to specific individuals, such as online publishing, customer communications, responses to Subject Access Requests (SARs) under the UK General Data Protection Regulation (GDPR) and Freedom of Information Act 2000 (FOIA) requests. The guidance also provides examples of potential data breaches and risk reduction strategies, with references to Microsoft software and supporting videos.

The guidance also covers:

• How to decide the right format for disclosure 
• How to find hidden rows, columns and worksheets
• How to convert documents to simpler formats to reveal hidden data
• How to use software tools to help identify hidden personal information 
• How to review the circumstances of a breach
• How to remove and redact personal information
• Metadata and active filters

Additional legal analysis by Pinsent Masons.