Request handling, Freedom of Information – Frequently Asked Questions

• Recognising a request for information
• Providing advice and assistance
• Consulting with third parties
• Time limits for compliance
• Internal reviews
• Cost limit
• Vexatious and repeated requests
• Publication scheme
• Transparency and confidentiality obligations in contracts and outsourced services
• Communicating with a requester

Recognising a request for information

What is a valid request?

Information requests can be varied and a one-size-fits-all approach is not appropriate under FOIA. Any written communications to a public authority, including those sent electronically, could be a request for information. This includes requests made via social media, if a real name and valid address for correspondence is supplied. People may also send you requests through websites like WhatDoTheyKnow, which generate unique email addresses for each request, and will automatically publish your response online. These are still valid requests. Requestors do not have to mention FOIA.

You should refer to section 8 of FOIA when determining whether a request is valid or not. To be valid it must be in writing, it must state the requestor’s real name, include an address for correspondence and it must also offer a clear description of the information requested.

You do not have to comply with requests that do not meet section 8, however you may wish to contact the requester to let them know this is the case.

If a requester cannot make a request in writing, for example due to a disability, you should make sure assistance is given to enable them to make a request and you take into account obligations under other legislation.

You are under no obligation to respond to requests made in a foreign language, although you may choose to ask the requestor whether they wish to resubmit it in either English or Welsh.

In many cases, requests may be dealt with in the normal course of business provided it will not result in lower standards (eg disclosing less information, or taking longer to deal with the request). It is important for a public authority to ensure that appropriate training is provided to staff so they can recognise a request under FOIA and consider any relevant codes of practice and guidance.

What are our obligations to a requestor?

When somebody makes an information request you are required to let them know in writing whether or not you hold the information.

If you do hold the information then you are required to communicate it to the requestor, unless it falls under an exemption listed in Part II of FOIA or if the request can be refused under section 12 or section 14 of FOIA.

What information is covered under FOIA?

You should refer to section 84 of FOIA for a definition of which information is covered under FOIA. In practice this means any recorded information which you hold, either in hard copy or in an electronic format. You don’t need to create new information to comply with a request.

What information is not covered by FOIA?

Information which you can provide under the normal course of business, such as standard responses to enquiries, does not need to be dealt with under FOIA. If you are not providing the information, you will need to treat this as an FOI request.

If you receive a request for environmental recorded information then you should deal with it under the EIR. EIR requests can be made verbally as well as in writing.

If somebody asks you for their own personal data then you should process the request under the subject access provisions of the DPA.

It is possible that one request could span more than one regime.

You should make sure that any staff who deal with correspondence have received suitable training and are able to determine whether a request falls under FOIA or another access regime.

When is information considered ‘held’ under FOIA?

Any recorded information which you hold for the purposes of your business is considered to be ‘held’ under FOIA. Section 3(2) sets out when information is held under FOIA, this includes:

• information you hold at the time of the request;
• information stored in off-site servers or cloud storage;
• information held by other organisations and authorities on your behalf.

You may hold information solely on behalf of another public authority or another individual. This would not be considered to be ‘held’ by you.

Similarly, information which is purely personal, political, constituency or trade union information could be considered as information which is not held by you and would not be relevant to any request which you receive.

You should maintain good records management so that appropriate, thorough and effective searches can be made for requested information. If, following relevant searches, you are not able to locate the information then, on the balance of probabilities, you may conclude that it is not held.

It is likely that most requests will only require you to search your ‘live’ systems or information held in archives. However, if your initial search identifies that relevant information may have been deleted, depending on the circumstances you may need to consider this as part of your overall response to the request.

You do not have to create new information in response to a request. FOIA only applies to any recorded information which you already held at the time of a request.

What are the consequences of deliberately preventing disclosure?

You should ensure that staff are aware that under section 77 of FOIA it is a criminal offence to deliberately conceal, tamper with or destroy information after it has already been requested. In the rare cases of this happening then individuals may face criminal prosecution.

When may fees be charged?

There are two sections of FOIA that allow for charging a fee for releasing information. Section 9 of FOIA contains the fees that may be charged for releasing information when the cost of compliance does not exceed the appropriate limit. Section 13 contains the fees that may be charged when the cost of compliance exceeds the appropriate limit but you have chosen to comply with a request.

You may only charge if information is being released, not where information is withheld under exemptions. However, most public authorities choose not to do so.

When you decide to levy a fee then you must let the requestor know within 20 working days, outlining how this was calculated, the means of payment and their right to complain to the Information Commissioner. The 20 working day period for responding will be paused until payment is received.

You may charge for:

• Transmission costs e.g. postage
• Complying with the format preferences expressed by requestors under section 11 (such as receiving information via CD)
• Actual production expenses e.g. printing, photocopying or the physical redaction of exempt information.

The fees you may charge can vary depending on whether you are applying fees under section 9 or 13, for example in relation to staff time and the physical redaction of exempt information.

Where the cost of compliance does not exceed the appropriate limit you cannot charge for any staff time, for example the time taken to redact exempt information. However, you can charge for the physical cost of redaction such as the costs of materials, (for example, tape or black ink) or the use of specialist equipment (for example, rental or licensing).

Where the cost of compliance exceeds the appropriate limit and you have chosen to respond, staff time is chargeable at a standard rate. This can include the staff time to physically redact exempt information, but it cannot include the staff time to consider whether the information is exempt in the first place. This is only in circumstances where you have chosen to respond to a request where the cost of compliance exceeds the appropriate limit.

You should be aware that time taken in redacting exempt information cannot be included in the cost estimate you may use to determine whether section 12 is engaged.

There may be other statutory bases under which you could charge for the provision of information. In these cases you cannot charge under FOIA.

How should we communicate with requestors?

Section 11 of FOIA outlines how requestors may specify a preference for how they receive the information. This must be done at the outset of the request.

You should aim to respond using the preferred means of communication if this is reasonably practical. You must decide whether it is practical to supply information in the preferred format of the requestor. You need to take into account the costs and complexities associated with the preference and weigh these factors against your resources.

Providing advice and assistance

Do we need to provide advice and assistance to requestors?

Section 16 of FOIA outlines your responsibilities to provide reasonable advice and assistance to people who propose to make, or have made, requests for information. The section 45 Code of Practice provides further guidance on how you can comply with your duty under section 16.

Is there any other legislation to consider?

Yes. You may need to refer to the Equality Act 2010 if requestors require any provisions to be made to help assist them. There may be other Acts of Parliament which are also relevant.

How do we provide advice and assistance to prospective requestors?

Your publication scheme should explain how you deal with requests for information or assistance.

You should ideally publish both a postal and email address to which people can send requests. If you have an online submission process for requests, you should send a copy of the completed request form to applicants alongside any acknowledgment notice.

If somebody asks you for recorded information and they comply with Section 8 of FOIA, then you should let them know that you are handling their request under FOIA. They do not need to mention FOIA when making any request.

What if a prospective requestor cannot write to us?

Section 8 of FOIA states that valid requests must be made in writing. If a requester is seeking to submit their request orally, you should advise them to put their request in writing.

However, if somebody is unable to do so, for example due to a disability, you should make sure assistance is given to enable them to make a request.

Where necessary, and taking into account obligations under other legislation such as the Equalities Act 2010, you may choose to accept a verbal request over the telephone. It is sensible to make a written record and send it to the requestor so that both parties are clear about the terms of the request. Once the requestor verifies the request, the clock starts ticking for you to reply within 20 working days.

If a requester makes a conditional request for a future event, you should advise the potential requester that they can choose to submit a request now and that this will be answered within 20 working days (irrespective of whether the event has happened), or they may choose to submit a request at a later date, after the anticipated event.

What do we do if a request is unclear?

You may wish to contact the requestor to seek clarification about the nature of the information they are seeking or to ascertain whether or not they are using their real identity.

If you have reason to doubt the identity of the requestor you should make them aware that you do not intend to respond and are seeking proof of identity from them before providing a response.

If a request is not worded clearly enough to understand or you are unsure which recorded information is being requested, then you are entitled to ask requestors for more detail to clarify their request.

The 20 working day period to respond will not start until you receive the clarification you have asked for. It is the responsibility of the requestor to provide clarification when asked to do so within a reasonable amount of time. When you ask for clarification you should make clear that unless you hear back from the requestor, the request will be considered closed.

The section 45 Code of Practice recommends that you allow up to two months as a reasonable amount of time for clarification to be provided before closing a request.

Do we need to offer advice about reducing the cost of a request?

Should you refuse a request under section 12 of FOIA then you should offer advice and assistance to requestors about how they could revise their request to come in under the cost limit. This may not always be possible if, for example, a request covers a very broad range of information or would impose a grossly oppressive burden on your authority.

What steps should we take when transferring requests for information?

There will be instances where you do not hold the information requested, but believe that another public authority does.

You should let the requestor know that you do not hold the information and let them know which other public authority may have what they are looking for. If you are able to provide contact details for the other public authority then it is best practice to provide them to the requestor.

If you wish to transfer a request directly to another public authority, you may only do so with the requestor’s agreement. You must be mindful of your data protection responsibilities whenever you are handling somebody’s personal details.

Will the Information Commissioner take enforcement action?

The Information Commissioner has the prerogative to take enforcement action if you fail to fulfil your obligations under section 16 of FOIA.

You may be issued with either a decision notice under section 50 or an enforcement notice under section 52 if you breach section 16 of FOIA.

Consulting with third parties

Should we consult third parties?

There may be times where you should consult third parties in order to consider whether information is suitable for disclosure. Such as when a request relates to persons or bodies who are not the requestor or public authority, or when disclosure is likely to affect the interests of a person or body who are not the requestor or authority. There may also be contractual obligations which require consultation before information is released.

Information gathered through third party consultation may be more helpful than speculative comments about any impact on business or private interests. Third parties who have created or provided the information may have a better understanding of its content and sensitivity. The third party views will be relevant where it is necessary to consider the prejudice and public interest tests, and may be helpful should there be an appeal against any refusal.

How do we consult with a large number of third parties?

If information being considered relates to a large number of third parties, and you are intending to release this information, you may wish to contact a representative organisation or a sample of organisations who can express views. This will need to be a case by case judgement.

Can we have extra time to consult with third parties?

Where consulting with third parties, you must still respond within the statutory time limits. You may be able to have extra time, if consultation is part of your consideration of the public interest test. However, you should have already applied the relevant exemption within the time limit.

What happens after third party consultation?

You do not have to follow the views provided by a third party in consultation. It is for you to take a final decision on releasing information.

It is good practice to give advance notice to third parties that you are proposing to disclose information which may affect or relate to them, where it is reasonable to do so. If that is not possible, then you should draw it to their attention as soon as possible.

Time limits for compliance

What are the statutory time limits?

Section 10(1) of FOIA provides the statutory timescales in which most public authorities must respond to requests for information. It says that you must respond promptly and within 20 working days following the date of receipt of the request.

If your organisation receives the request on a working day, this is the date of receipt. If the request is not received on a working day, then the first working day following its arrival is the date of receipt.

Working days are any day other than a weekend, or a public holiday anywhere in the UK.

There are some variations to the 20 working day time limit that are laid out in the Freedom of Information (Time for Compliance with Request) Regulations, issued under section 10(4) of FOIA. These apply to certain public authorities, or in certain circumstances where it may be difficult to respond within 20 working days, for example schools, or public records contained in archives.

In these situations, the initial deadline cannot go beyond 60 working days. The time extensions vary in each case and some require permission from the Commissioner.

Can we have extra time to consider the public interest test?

You can exceed the statutory time limit if you consider a qualified exemption is engaged and you require additional time to consider the public interest test.

Section 10(3) only permits extensions for further consideration of the public interest test, the additional time cannot be used to determine whether the exemptions themselves are engaged. However, wherever possible you should seek to complete the public interest test without an extension.

You may need additional time where the information is especially complex or voluminous, or where you need to consult third parties. FOIA does not define what a reasonable extension of time might be. The section 45 Code of Practice says it is best practice for an extension to be no more than a further 20 working days. Depending on the circumstances however, in some cases a longer extension may be appropriate.

If you require a public interest test extension you must issue a refusal notice to the requester to let them know, including which exemption(s) you are considering and why and providing a new deadline for your response.

Can we have a public interest test extension under the EIR?

This is an area where FOIA differs from the EIR. The EIR contains no provision to extend the time for compliance to further consider the public interest test, nor do the EIR make any provision for variations to the time limits for certain categories of information or types of organisation.

The EIR does permit an extension to the time for compliance from 20 to 40 working days, where the authority believes that the complexity and volume of the request would make it impractical to comply or reach a decision about whether to refuse the request, within 20 working days.

Internal reviews

How should we handle a complaint?

You should have in place a procedure to handle any disputes or complaints arising from the outcome or handling of a request for information. This procedure is known as an internal review and demonstrates a commitment to openness and transparency.

Section 17(7) of FOIA explains that you must inform requestors whether or not you have an internal review procedure in any response you issue to a request for information. This must explain how requestors can ask for an internal review, as well as informing them of their right to complain to the Information Commissioner under section 50 of FOIA should they be unhappy following the review outcome, or if no internal review procedure is in place.

What constitutes a request for an internal review?

If you receive a complaint which seeks to challenge the outcome of your initial response then you should treat this as a request for an internal review. This should be distinguished from a general complaint which can be dealt with through general correspondence.

A requestor does not have to ask for an internal review explicitly.

However, an internal review request must be made in writing to a valid public authority address, in line with requests for information under FOIA.

What are the timescales for an internal review?

Internal review requests should be made within 40 working days of the initial response. This deadline should be communicated to the requester in that response. You are not obliged to provide a review if it is requested after more than 40 working days.

You should acknowledge an internal review request and provide a target date for response, which should usually be within 20 working days. Public authorities, such as schools, who may exceed the 20 working day time limit can also apply this approach to internal reviews.

There may be circumstances where you require more time to complete an internal review, for example if you need to address complex issues, consult with third parties or consider substantial amounts of information.

In these circumstances you should inform the requestor that you will need more time and provide a reasonable target date. This should be no more than an additional 20 working days, unless there are legitimate reasons why a longer extension is necessary.

As with requests for information, if you require clarification for an internal review request then the timescale to respond does not start until the clarification is provided.

Providing an internal review within a maximum of 40 working days matches the timescales for internal reviews in the Environmental Information Regulations 2004 (EIR) - in which internal reviews are a statutory requirement.

How should we conduct an internal review?

It is good practice for the internal review to be carried out, wherever possible, by somebody other than the person who issued the initial response.

Internal reviews should consider how the request was handled and the initial response, whether the relevant information was identified, and whether you wish to uphold the original exemptions or whether you wish to apply a different or additional exemption(s).

If you decide to provide the requestor with information which was withheld previously then you should supply it at the same time as the internal review outcome, or at least notify the requestor of when it will be provided.

You should practice good records management, for example by issuing reference numbers for each request, and record the outcome of any internal review, along with timescales.

You should inform the requester of their right to appeal to the Information Commissioner. If you do not conform to the spirit of the section 45 Code of Practice in relation to internal reviews then the Information Commissioner may highlight this in decision notices.

You should use any data which is recorded from internal reviews to identify potential weaknesses in your procedures and to help you improve your performance where necessary.

Cost limit

What is the ‘cost limit’ for responding to requests?

Under section 12 of FOIA, you do not need to provide a substantive response to requests where you estimate that responding to the request would exceed the “appropriate limit”, also referred to as the “cost limit”.

The cost limit is calculated at a flat rate of £25 per hour of work. For central government departments the cost limit is £600 (24 hours of work). For all other public authorities the cost limit is £450 (18 hours of work).

How do we calculate the ‘cost limit’?

The cost limit should be considered before any exemptions in Part 2 of FOIA.

You can only include the costs incurred for certain tasks when estimating whether responding to a request will exceed the limit. These tasks are:

• Establishing whether information is held;
• Locating and retrieving the information; and
• Extracting the relevant information from a document containing it.

Time for redacting information, or other costs incurred when estimated the amount cannot be included.

You are not required to make a precise calculation, but your estimates should be sensible and realistic. Some searches may take longer than others depending how the information is stored. If helpful, you may wish to conduct a sampling exercise to establish likely estimates. You should focus searches on the locations most likely to hold relevant information.

If you estimate that complying with one part of a request would exceed the cost limit then you do not need to comply with the remaining parts of the request. Furthermore, you are not obliged to search for and provide information up to the cost limit.

Can we aggregate requests when estimating the cost for responding?

Yes. When calculating the cost estimate you can aggregate requests from the same person, or a group of people acting together, that you receive within a 60 working day period. However, the requests must ask for the same, or similar, information.

How do we respond if the ‘cost limit’ is exceeded?

If you consider section 12 is engaged you are not obliged to provide a substantive response. However, you will need to provide a refusal notice explaining your application of section 12.

Should you refuse a request under section 12 of FOIA then you should offer advice and assistance to requestors about how they could reframe or refocus their request to come in under the cost limit. This may include suggesting that the subject or timespan of the request is narrowed. A refined request should be treated as a new request for information.

Vexatious and repeated requests

What is a vexatious request?

Whether a request is vexatious should be considered before any exemptions in Part 2 of FOIA.

You are not obliged to comply with a request if it is vexatious, although you will usually need to provide a refusal notice.

FOIA does not define what makes a vexatious request. For detailed information on vexatious requests and examples of case law on this issue, please see our separate guidance on dealing with vexatious requests.

While you should think carefully about applying section 14(1), it should not only be considered as a last resort. You will need to consider each case on its own merits.

A request may be so unreasonable that it is clear it is vexatious. However, if you are unsure whether a request is vexatious you should consider whether it is likely to cause disproportionate or unjustified disruption, irritation or distress.

The Code provides some examples of factors and indicators to consider when determining whether a request is vexatious. These examples are not exhaustive. You will need to consider all of the circumstances of the case before making your decision.

You can also take the wider context of a request into account when considering whether it is vexatious. For example, your previous dealings with a requester, including any previous requests they submitted. It is important to assess whether this evidence supports or weakens the vexatious argument.

What is a burdensome request?

Some requests may be so burdensome, in terms of time and resources, that you may be able to refuse it under section 14(1).

You should consider whether section 12 of FOIA applies first, and you should avoid using section 14(1) to refuse burdensome requests unnecessarily. However, if section 12 does not apply, and the request would place a grossly oppressive burden on you, you may consider refusing the request under section 14(1).

For example, section 14(1) may apply if a significant burden is imposed on you due to redacting information, consulting third parties, applying exemptions and preparing the information for publication for which you cannot claim in section 12.

What are repeated requests?

If you have previously complied with a request for information you do not need to comply with a further request for the same, or substantially similar, information made by the same person. You can refuse such requests under section 14(2) of FOIA, unless a reasonable interval has elapsed between compliance with the first request and receipt of the second. Section 14(2) only applies where you have already provided the information, or confirmed that it is not held. Whether a request is repeated will need to be considered on a case by case basis.

How should we respond to vexatious or repeated requests?

In most cases where you consider sections 14(1) or (2) are engaged you will need to provide a refusal notice stating that fact. This should be issued within 20 working days, should include details of your internal review procedure and the right to appeal to the Information Commissioner.

The Code says that you are not obliged to explain why the request is vexatious. Although, you may wish to do so as part of your duty to provide advice and assistance under section 16 of FOIA.

Under section 17(6) of FOIA you do not need to provide a refusal notice if one has previously been issued for an earlier vexatious or repeated request and you consider it is unreasonable to do so again. Although, you must still establish that each request is vexatious.

It is good practice to keep an ongoing evidence log to record relevant correspondence or behaviour that has been taken into account when citing section 14. This will be helpful if the requester complains to the Information Commissioner, as you will be required to provide evidence to support your position.

Publication scheme

What is a publication scheme?

Under section 19 you must adopt and maintain a publication scheme, which sets out your commitment to make certain classes of information routinely available, such as policies and procedures, minutes of meetings, annual reports and financial information.

The Information Commissioner has produced and approved a model publication scheme which you should use. You should also produce a guide to the scheme, setting out what information is published and by what means, and a schedule of fees.

You must have a process for maintaining and updating your publication scheme.

Your sector may have published specific guidance on what you are expected to publish, and the Information Commissioner has produced sector specific definition documents which you should follow.

What compliance statistics should we proactively publish?

If you have over 100 full time equivalent employees it is best practice to publish details of your performance on handling requests under FOIA, on a quarterly basis. These statistics could include (although are not limited to) the number of requests received, a breakdown of how many have been processed, which information was granted or refused both partially and in full.

What information about pay and benefits should we proactively publish?

Your publication scheme should contain data regarding the pay and benefits of senior executives and their equivalents. Director level staff, or equivalent such as those at management board, would be considered senior staff in this context.

Remember, it is acceptable to publish the names of senior managers who would expect to be held publicly accountable, but not junior staff who do not have that same expectation.

With regard to your senior staff, you should publish information that covers the following four areas:

• Pay - this should be published annually.
• Expenses - this would include expenses of elected officials and appointed representatives, if not covered elsewhere, as well as senior staff. This should be published quarterly.
• Benefits in kind - this refers to benefits employees receive from their employment that are not included in their salary. This data should be published to the nearest £100 and it should be published annually.
• Hospitality – this would include gifts from third parties, and should include who it was from.

Your sector may have published specific guidance on what you are expected to publish, and the Information Commissioner has produced sector specific definition documents which you should follow.

Transparency and confidentiality obligations in contracts and outsourced services

What obligations should we make third party contractors aware of?

When outsourcing public services, you should do so transparently and make third party contractors aware of your obligations under FOIA, how they should assist you in these obligations and what will happen if they don’t. This should be set out in the contract or a Memorandum of Understanding.

What if information is held on our behalf?

There may be circumstances where information about contractual arrangements will be held by the third party on your behalf. Information held on behalf of a public authority should be treated as information held by that public authority and will be subject to FOIA.

It is good practice for the type of information that is held on behalf of the public authority by a third party to be agreed at the outset, including how such information would be accessed, and to indicate this within a contract or Memorandum of Understanding.

As the public authority, you should answer requests for information that is held by third parties on your behalf. Third parties should pass any requests on to you, or let requesters know that requests should be directed to the public authority.

Given your statutory obligations under FOIA, third parties should be made aware of the need to comply with your requests for access to such information in a timely manner.

How do confidentiality clauses interact with FOIA?

You may be asked to agree to confidentiality clauses when entering into a contract with a third party contractor.

Before agreeing to any confidentiality clauses, you will need to consider how any clauses may interact with your obligations under FOIA and the public interest in transparency and accountability. You and the third party also need to be aware of the enforceability of those clauses, and other transparency obligations, for example, to publish spend data.

Clauses may specify the types of information viewed as confidential and the reasons for this, and where the third party should be consulted before disclosure. Such clauses cannot, however, prevent disclosure under FOIA if the information is not, strictly speaking, confidential.

Confidentiality considerations may also apply in non-contractual circumstances, where for example third party organisations have provided certain information to you on an expressly confidential basis.

There may be circumstances where this is appropriate and this information could be protected by exemptions in FOIA. However, you and the third party must be aware of the public interest in transparency, alongside the legal limits on the enforceability of expectations of confidentiality.

Communicating with a requester

What needs to be communicated to the requester?

When providing an initial response to a request you should state that the request has been dealt with under FOIA, confirm whether the information is held (or neither confirm nor deny holding information), explain your internal review process and inform the requestor of their right to complain to the Information Commissioner. You should include details of why some or all of the information cannot be disclosed, including the relevant sections you’re relying on.

When responding to a request for an internal review, you should state whether you agree with the initial response, any new exemptions, and details regarding complaints to the Information Commissioner.