Information Commissioner orders FSA to reconsider FOI response on staffing and pay

Finance regulator told it misapplied personal data exemptions and must issue a fresh decision

The Isle of Man Information Commissioner (IC) has upheld a complaint against the Isle of Man Financial Services Authority (FSA), ruling that it incorrectly handled parts of a Freedom of Information request relating to its staffing structure, job titles and pay.

The decision follows a request made in August 2024 seeking a detailed organisational chart of the FSA, including the names of staff and postholders, job titles, and salary maxima for all roles, including board members and the chief executive.

While the FSA provided a partial response, including an organisation chart and some limited information, it withheld most staff names and salary details. It relied on section 25 of the Freedom of Information Act 2015, which provides an absolute exemption for personal data, including in relation to the chief executive’s maximum available salary.

After reviewing the case, the IC concluded that the FSA had misapplied the personal data exemption in at least one area and failed to properly justify its approach in others. As a result, the FSA has been instructed to re-process the request and issue a new response.

The Information Commissioner found that although staff names do constitute personal data, the FSA had not adequately demonstrated why disclosure would be unfair in each case. The decision notes that public bodies are expected to consider factors such as seniority, decision-making responsibility, public-facing roles and accountability for public funds when assessing whether names should be disclosed.

The ruling highlights established guidance that senior officials should generally expect a greater degree of transparency than junior staff. The IC said there was no evidence the FSA had properly documented this assessment when applying the exemption.

The decision also addresses the handling of information relating to the chief executive’s salary. During an internal review, the FSA stated that no salary maximum existed because the postholder’s pay is subject to annual review. However, the IC found it was incorrect to rely on a personal data exemption for information that did not exist. Instead, the FSA should have issued a refusal notice explaining that the information could not be located or was not held.

In addition, the IC criticised the FSA’s approach to providing advice and assistance to the applicant. While it had contacted the requester early and suggested splitting the eight-part request into separate applications, it did not fully comply with the procedural requirements set out in the official Code of Practice, including informing the applicant of the timescales for clarification.

Overall, the Information Commissioner concluded that the Financial Services Authority failed to properly record its reasoning, incorrectly applied exemptions, and did not meet its obligations under the Freedom of Information Act.

The Authority has been given 30 days to either disclose the requested information or issue a fresh refusal notice that clearly sets out the legal basis for any continued withholding of information.