The Freedom of Information Act requires public authorities to share data held by them or on their behalf. Although there are exemptions to disclosure typically the information requested has to be provided within 20 working days and free of charge.
However, many public authorities do not meet their statutory duties under the Act. In this article we’ll explore the most common mistakes these organisations make and the potential consequences of non-compliance.
Contents
________________________________________________________________________________________________
________________________________________________________________________________________________
Download This Post Here
________________________________________________________________________________________________
Common Freedom of Information Mistakes
There are a number of ways in which public authorities fall down when it comes to Freedom of Information. The ones we see most are:
Exceeding Statutory Timescales
It is normal that from time to time the 20 working day time limit will be breached. However some organisations become overwhelmed with the volumes of requests they receive and build up large backlogs.
For example, [1] South Yorkshire has recently been served with an Enforcement Notice by the Information Commissioner because fewer than 18% of requests were responded to within 20 working days. It also had a significant and rapidly-expanding backlog of requests.
We worked with a large hospital in London that has also built up a significant backlog of requests. We helped address this in part by contacting people with the oldest outstanding requests still wanted the information.
Misapplying Exemptions
There are a number of exemptions under the Act but organisations often get them wrong. This comes in two forms:
-
they do not provide a justification if they are relying on a public interest exemption. These require a justification to be provided. For example if you withhold information on the grounds of commercial confidentiality, you need to explain the potential commercial harm that could come from disclosing the information.
-
applying the wrong exemption. People have the right to complain to the Information Commissioner if they are not satisfied with the response they get. If the Information Commissioner finds a public authority cannot justify the exemption it has applied, or if it has applied an exemption incorrectly, then it may require the public authority to release the information requested after all.
Failing to Maintain a Publication Scheme
Organisations subject to the Freedom of Information Act should publish certain information in the form of a publication scheme [2]. The type of information that should be part of the publication scheme includes:
-
details of the organisation’s leadership
-
policies and procedures
-
financial or spending and cost information
-
how the organisation makes decisions
A good publication scheme will also include freedom of information requests received and their responses. Many organisations publish this information on their websites. It does not need to be on one page.
Failing to Conduct an Internal Review
If people are not satisfied with the response they get to an information request they can complain to the Information Commissioner. First however they should ask the public authority in question to conduct an internal review. This is when the organisation reflects on the response it gave and considers whether it should act differently. In many instances these organisation fail to do this properly because they don’t do one or more of:
-
having an independent person reviewing the request and the response
-
considering any arguments the requestor makes
-
explain their reasons for not changing their minds
________________________________________________________________________________________________
Sign Up Here:
________________________________________________________________________________________________
Freedom of Information: Consequences of Non-Compliance
Unlike the GDPR, where organisations can face monetary penalties for personal data breaches, there are no direct financial penalties for failing to comply with freedom of information legislation. However there are a number of consequences organisations can face for non-compliance. Some of these can include prosecution and legal penalties. In some circumstances you may be found in contempt of court.
Enforcement Notices
Like the example above organisations can be directed to improve their performance either generally or in relation to individual requests. If the Information Commissioner disagrees with a decision not to disclosure information in response to an information request it can tell the organisation to disclose. The Information Commissioner will never disclose records or information themselves.
Typically an enforcement notice will come with a deadline, but organisations can appeal against enforcement notices if they are received.
Enforcement notices are often published. This can have a negative effect in terms of reputation and publicity.
Contempt of Court
A failure to comply with the Information Commissioner’s requirements can lead to a public authority being held in contempt of court. This again can cause bad publicity but the penalties for contempt of court can include fines, seizure of assets or even imprisonment.
Time, Effort and Money
Alongside the reputational damage and any fines organisations must spend time, effort and money dealing with complaints and engaging with the Information Commissioner. In our experience this can be a big distraction from day to day work. Remember the information in dispute will be held by a team or department in your organisation and they will need to focus on the freedom of information issue rather than their “day jobs”.
Destroying Information to frustrate Freedom of information
It is a criminal offence to destroy information in order to prevent disclosing it. Under Section 77 of the Act [3]. People who do this can be fined. Specifically it is an offence if a person “alters, defaces, blocks, erases, destroys or conceals any record held by the public authority, with the intention of preventing the disclosure by that authority of all, or any part, of the information to the communication of which the applicant would have been entitled.”
The Information Commissioner or the Crown Prosecution Service can initiate a prosecution. The maximum amount you can be fined is £5,000 [4].
Conclusion
A failure to comply with statutory duties under the Freedom of Information Act is not consequence free. There are a number of risks for breaching the Act, notwithstanding that compliance is a good way of engaging with stakeholders and raising your organisational profile.
________________________________________________________________________________________________
Gain the practical skills you need work with Freedom of Information and GDPR with these five-star rated training course.
Available in person, online or in-house the focus on practical skills and unique post-course support you get by learning with us will ensure you and your organisation can tackle this key governance activity with confidence.
________________________________________________________________________________________________
Resources:
[1] Enforcement Notice published by the Information Commissioner
[2] ICO Guidance on a Model Publication Scheme
[3] Section 77, Freedom of Information Act 2000