The ICO advises you may limit the following information (in full or in part):
- confirmation that you are processing data;
- and access to personal data.
if it is necessary and proportionate in order to:
- avoid obstructing an official or legal inquiry, investigation or procedure;
- avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
- protect public security;
- protect national security;
- or protect the rights and freedoms of others.
You need to justify any restriction you apply as necessary and proportionate. It is important to balance the rights of the individual against the harm disclosure would cause. You may only limit the amount of information you provide if it would prejudice the purposes stated above.
You must also inform individuals when this limitation is in place, explaining the existence and the reasons, unless providing this information itself undermines the purpose of imposing the restriction. You also need to inform them about the process for raising a complaint with the Information Commissioner or taking matters to court. You should keep a record of your decisions and provide this reasoning to the Information Commissioner, if required.
