Depends what they have asked for and how they have asked for it.
If you are dealing with this as a straightforward SAR there is no requirement for a refusal notice. You simply disclose the PD they are entitled to.
If they are pressing specifically for a notice in the context of a SAR where the request implies a link between themselves and the notice then it is a simple application of s40(5)(a)FOI: We are unable to confirm or deny whether we hold [xxx] because to do so would be a disclosure of personal data relating to you, in respect of which a duty to confirm or deny does not arise in accordance with s40(5)(a) ...
Otherwise you will need to use s40(5)(b)(i): Insofar as your request relates to a [xxx] we are unable to confirm or deny whether we hold such because to do so, if we had one, would be a breach of the data protection principles and the exemption in accordance with s40(5)(b)(i) FOIA is accordingly applied ...
These are just outlines - the exact wording would depend on the context and wording of the request
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|