Privacy as Privilege: How Public Bodies Learned to Use Data Law as a Shield Against Scrutiny
Photo of Yvette Cooper, via Wikimedia Commons
The General Data Protection Regulation was introduced with a clear and legitimate purpose: to give individuals meaningful control over their personal information in an age when data had become a commodity traded at industrial scale. It was, at its core, a framework designed to constrain institutional power — to ensure that governments, corporations, and public bodies could not accumulate, process, and exploit personal data without consent, transparency, and proportionate justification. It was, in other words, a law designed to protect citizens from the state.
Somewhere between the regulation's drafting and its application across Britain's public sector, that logic has been comprehensively inverted. GDPR and the UK's domestic Data Protection Act 2018 have become, in the hands of councils, NHS trusts, quangos, and government departments, a versatile instrument of institutional self-protection. The language of privacy — a concept with genuine moral weight — is being deployed not to defend individuals but to prevent those individuals from finding out how their money is being spent, how services are being delivered, and how institutions are performing against the standards they have set for themselves.
The Mechanics of Refusal
The pattern is consistent enough to constitute a playbook. A journalist, campaigner, or member of the public submits a Freedom of Information request seeking performance data, internal communications, or records of decision-making. The public body, rather than engaging with the substance of the request, identifies within it any reference to named individuals — a named official, a specific contractor, a patient whose case illustrates a systemic failure — and invokes data protection as grounds for partial or total refusal. The information withheld is not personal data in any meaningful sense. It is institutional information that happens to involve people.
The Information Commissioner's Office, the body charged with regulating both data protection and freedom of information, has acknowledged this tension repeatedly. Its own guidance notes that public authorities cannot use data protection legislation as a blanket exemption from FOI obligations — that the two regimes must be balanced, and that the public interest in transparency is a legitimate and weighty consideration. That guidance has not prevented the behaviour it describes from becoming routine.
The Open Government Partnership, of which the United Kingdom is a founding member, monitors the health of transparency frameworks across member states. Independent assessments of the UK's performance have noted a persistent gap between the formal commitments made by government and the practical experience of those attempting to access public information. The gap is not random. It is structural.
Case Studies in Convenient Opacity
The NHS provides some of the most instructive examples. Hospital trusts subject to Care Quality Commission scrutiny have, in documented cases, declined to release serious incident reports on data protection grounds — citing the potential identification of staff members involved in adverse events. The effect is to prevent external scrutiny of systemic failures, not to protect the legitimate privacy interests of any individual. The staff member whose clinical decision contributed to a patient's death has a privacy interest, certainly. That interest does not extend to insulating the institution from accountability for its governance failures.
Local government has proved equally inventive. Councils facing questions about contractor performance, planning decision rationales, or the management of public assets have cited GDPR in declining to release documents that contain no personal data in any meaningful sense — or in which the personal data is entirely incidental to the information being sought. In several cases examined by transparency campaigners, the same councils that cited privacy concerns when refusing FOI requests were simultaneously publishing detailed information about individual residents in enforcement notices, planning registers, and licensing decisions. The application of data protection law was, in these instances, selective in a way that consistently favoured the institution.
Quangos — those semi-detached public bodies that occupy the productive space between ministerial accountability and market discipline — have refined the approach further. Because their governance structures are often opaque by design, and because their relationship to both FOI and data protection oversight is frequently ambiguous, they have proved particularly adept at using regulatory complexity as a barrier to scrutiny. An organisation that is technically subject to FOI but practically insulated from it by layers of legal uncertainty and the cost of challenging refusals is, for most practical purposes, unaccountable.
The Regulatory Capture of Transparency
There is a deeper problem here than individual institutions behaving badly. The problem is systemic, and it reflects a failure of institutional design. The frameworks intended to produce transparency — FOI, the Environmental Information Regulations, the duty to publish certain categories of information — were designed on the assumption that public bodies would engage with them in good faith. That assumption has not been validated by experience.
What has emerged instead is a form of regulatory capture in which the instruments of transparency have been colonised by the instinct for self-protection. Public bodies employ data protection officers whose professional function is, in part, to identify grounds for refusal. Legal teams are consulted not on how to disclose appropriately but on how to decline defensibly. The ICO, underfunded and structurally reluctant to impose meaningful sanctions on public bodies, has not provided the corrective pressure that the system requires.
The result is an accountability gap that is invisible to most of the public but acutely felt by those who attempt to exercise their legal rights. Journalists pursuing stories in the public interest, campaign groups seeking evidence of policy failure, and individual citizens trying to understand decisions that directly affect them encounter a system that is technically open and practically closed. The law says they are entitled to the information. The institution says it cannot be provided. The regulator says it will look into it. Months pass.
What Genuine Reform Would Require
A serious government would address this through several mechanisms. First, the ICO requires both significantly greater resources and a clearer mandate to treat public sector non-compliance as a priority enforcement concern rather than a matter for extended correspondence. Second, the public interest test in FOI decisions — the balancing exercise that is supposed to weigh transparency against other considerations — should be subject to independent judicial oversight as a default, not as an option available only to those with the means to pursue a tribunal appeal. Third, institutions that are found to have refused information on spurious data protection grounds should face financial penalties that actually register, rather than the largely symbolic outcomes that currently follow ICO investigations.
Conservatives should be natural champions of this agenda. Limited government depends on visible government. The case for trusting institutions with public money, public functions, and public authority rests on those institutions being genuinely accountable for how they exercise that trust. A public sector that has learned to use the language of individual rights to shield itself from collective scrutiny is not demonstrating respect for privacy. It is demonstrating contempt for democracy.
The citizens who fund these institutions did not consent to a transparency framework that exists on paper and dissolves on contact with an inconvenient question. They are owed something more honest than that.
When the law designed to protect the individual from the state becomes the tool the state uses to hide from the individual, the law has not been applied — it has been captured.
