Line to take - LTT2 - Deleted electronic information

• FOI/EIR: FOI
• Section/Regulation: s1
• Issue: Deleted electronic information
• Source: Information Tribunal
• Details: Harper / Royal Mail (15 November 2005)
• Related Lines to Take: LTT3, LTT4
• Related Documents: FS50058993, EA/2005/0001
• Contact: EW
• Date: 30/11/2007
• Policy Reference: LTT2
• © Copyright Information Commissioner's Office, re-used with permission
• Original source linked from here: LTT

Line to take

Electronic information which has been deleted but remains in a trash can/recycle bin is held for the purpose of the Act. Information deleted from a recycle bin is not held, even where it can technically be recovered / restored.

Further Information

Deleted information

Deletion is generally a two stage process - files are firstly moved to a recycle bin/trash can, and then deleted from the recycle bin/trash can. When a computer file has been completely deleted, the area it occupies is designated as being free, and ready to accept new data. The file can still technically be retrieved or recovered until it has been overwritten; that is, until new data has been written over the existing data so that that previously extant data is completely erased. Files which remain in a trash can/recycle bin cannot be overwritten.

Information which has not yet been overwritten can be recovered. Recovery of information still retained in a local computer’s recycle bin or networked computer’s drive can generally be achieved by using software that is part of the computer’s own operating system, whilst recovery of information which has been deleted from these areas but not yet overwritten will generally require the use of specialist software, such as readily available ‘undelete’ data recovery programmes.

Backup

Backup refers to making additional copies of data so that those copies can be used to restore the original after data loss. Backing up data involves storing files separately from the computer. The main purpose of backup is disaster recovery; that is to restore a computer to an operational state after disaster (such as fire or flood). Backups are also used to restore small numbers of files if they have been accidentally deleted or corrupted. Occasionally organisations will store certain information wholly on backup media (such as old versions of databases.) The recovery of information from backup is likely to require the use of specialist staff.

ICO view

In the case of Harper v the ICO & the Royal Mail, the Tribunal proposed that, in cases where requested information is merely deleted rather than eliminated (overwritten), public authorities should, “consider whether the information can be recovered and if so by what means.” (para 21). As explained above, the ICO is of the view that such information can, as a matter of fact, be recovered, and the question of whether or not the information is recoverable is not a relevant factor.

The Tribunal in the case found that information retained in a trash can or recycle bin folder is held (para 27). In respect of deleted (but not overwritten) information, the Tribunal found that whether or not it is held will be a matter of fact and degree. The ICO’s view is that, in general, a public authority will not hold information when it is capable of being overwritten; that is, after it has been deleted from a recycle bin.

Public authorities are entitled to delete information that they no longer require - indeed they should do so, in accordance with good records management practice. If information is still said to be held when it has been intentionally and properly deleted, in line with the public authority’s disposal schedule, the concept of deletion and disposal becomes meaningless. In such cases a public authority will not consider the information to be held, and will make no use of it. The ICO’s view is therefore that information which has been properly and intentionally deleted from a recycle can but not yet overwritten is not held.

Whether or not the deletion was intentional is critical, however. Where information is accidentally deleted through user error, virus or ‘disaster’, and the public authority therefore intends anyway to restore it because it continues to require it, this information should be regarded as being held. However, any costs associated with such restoration cannot be passed onto an applicant, because the restoration will not be for the purpose of responding to the applicant’s information request.

The Tribunal found in Harper that information on backup media will be held. The ICO takes the view that in general information on backup will not be held, as the public authority will have no use for it otherwise than where it is required after data loss. Therefore it will be held only in cases where a public authority only holds information on backup media, because its primary data store has been wiped out, or where it is in fact using backup as a method of storage.