Three pieces of domestic legislation govern an individual’s general rights to request information held by public sector bodies: the Data Protection Act 2018 (DPA), the Freedom of Information Act 2000 (FOIA) and the Environmental Information Regulations (EIR).
In addition to this, most public sector bodies which process personal data are subject to Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 (known as the General Data Protection Regulation, or GDPR). However, MI5 is not subject to the GDPR and processes personal data pursuant to Part 4 of the Data Protection Act 2018.
The DPA gives individuals a right of access to personal data concerning them. Requests for access to personal data may be made to MI5 under section 94 of the DPA. Such requests are known as “subject access requests” or “SARs”.
Section 110 of the DPA contains certain exemptions to the right of access in section 94 where exemption is required for the purpose of safeguarding national security. MI5 considers on a case by case basis whether it is necessary to rely on the national security exemption. Where the national security exemption is relied upon, a certificate signed by a Cabinet Minister, the Attorney General or the Advocate General for Scotland constitutes conclusive evidence that the exemption in required, subject to a right to appeal against the certificate in the First-tier Tribunal.
Individuals who are dissatisfied with MI5’s response to a SAR have a right to complain to the Information Commissioner. For more information about your rights, please refer to the ICO website.
Please be aware that written correspondence posted in the UK may take up to a week to reach us.
FOIA allows members of the public to request access to information held by public authorities. MI5, along with the other security and intelligence agencies, is not subject to FOIA.
For further information on FOIA, please refer to the ICO website.
The Environmental Information Regulations allow the public to request access to information about the activities of public authorities which relate to the environment. MI5 is subject to the Regulations, although exemptions can be used when necessary (to protect national security, for example). We will consider on a case by case basis whether an exemption applies.