There are several approaches you can take. Here are the three most popular.
Make it a Sensitive FOI
This is an FOI request that requires personal data in the answer which you feel should be protected as if it were a SAR.
A question about several streets might be FOI but a question a bout a specific house identifies a resident and may thus include PII.
Let’s say there are 5 parts to a question which is about compensation of nurses. Part 3 asks you about the applicant’s specific compensation but the rest are about general rules and amounts over the last couple of years.
In both examples one may chjoose to use a “Sensitive FOI”. That request type should be configured as “Private” and hence it will not
- appear in the PDL (Public Disclosure Log)
- be visible to staff with out access to Private Request Types
Make it a SAR
It may be that the request is so peculiar to a person that it is really a SAR. This happens occasionally and is a natural solution which immediately covers you for any possibility that the data will be published outside your organisation. It will also not be seen by those without “Private” Request Type access.
Make two IRs: a SAR and and EIR
There may be a number of questions in the IR and you can create two IRs. Let us take the above example with 5 parts. Part 3 could be a SAR and parts 1,2,4&5 could be sent out in a second IR which was classified as an FOI request.
Which to choose?
Obviously, the first is the simplest. The advantages of a “sensitive” FOI (FOISA, EIR, etc.) are that they are excluded from the Public Disclosure Log and are not seen by any staff whose access excludes Private request types.
The automated emails will have been set up so that they do not expose PII in the wrong places. Policies and workflow procedures would need to be in place so that the information management team know to make the subject line “Bill Smith’s Compensation” (in the above example). Rather they might make the correspondence subject “Potholes Compensation”.
The only other thing to consider is triage speed. Once you have set an IR as FOI, some automated triggers may have been launched. That needs to be taken into account before changing the request to a Sensitive FOI or SAR after a week of activity. Occasionally, however, it is not obvious for an officer at first. Senior staff are not present and a mistake is made.
What if I change IR Types during a response period?
There is a related article about what happens to the Countdown and Due Date when you change and IR Type from FOI to SAR.
What are Private Request Types?
Generally, these Requests would be SARs, Sensitive FOIs and some that are specific to different jurisdictions. Examples include: CAFCAS in UK and Procurator Fiscal in Scotland.
Please see the FAQ article about configuring Request Types. It explains how their behaviour differs in the AXLR8 system.
