Policies & Procedures

LTN 37

July  2009

Introduction

1.   The Freedom of Information Act 2000 (‘the Act’) was passed on 30 November 2000.  The Act is enforced by the Information Commissioner (see below at paragraph 41 for address) who also has responsibility for data protection issues.  NALC has issued several legal briefings (e.g. relating to fees and certain exemptions) with respect to the application of the Act to local councils and these should also be referred to.  

What does the Act do?

2.   Section 1 of the Act gives a general right of access to all types of ‘recorded’ information held by ‘public authorities’ (and those providing services for them).  It also sets out exemptions from that right and places a number of obligations on public authorities.

Who is covered by the Act?

3.   The Act applies to public authorities and those providing services for them.  A detailed list of public authorities is contained in Schedule 1 of the Act.  This includes:

• Government Departments;
• Local Authorities (including local councils and parish meetings without a separate parish council);
• NHS bodies (such as hospitals, as well as doctors, dentists, pharmacists and opticians);
• Schools, colleges and universities;
• the Police;
• the House of Commons and the House of Lords; and
• the National Assembly for Wales.

4.   Schedule 1 also contains a long list of other public bodies ranging from various official advisory and expert committees, to regulators and organisations such as the Post Office, National Gallery and the Parole Board.  There is a provision in the Act for other authorities to be named at a later date and for organisations to be named as public authorities for relevant parts of their work.

When did the Act come into force?

5.   The Act was brought fully into force on 1 January 2005.  As explained later in this note, public authorities have two main responsibilities under the Act.  Pursuant to s.19 of the Act, they have to produce a ‘publication scheme’ (effectively a guide to the information they hold which is publicly available) and they have to deal with individual requests for information.  Pursuant to Freedom of Information Act 2000 (Commencement No.2 and No.3) Orders (SI.2002/2812 and SI.2003/2603), the duty to adopt a publication scheme was imposed, according to the following timetable: 

• 30 November 2002 – Government Departments, House of Commons, House of Lords, other public bodies  and offices);
• 28 February 2003 – Local Authorities (including local councils and parish meetings without a separate parish council);
• 30 June 2003 – Police;
• 31 October 2003 – public authorities under Part III of the Act i.e. National Health Service;
• 29 February 2004 – Educational institutions;  
• 30 June 2004 – remaining public authorities.  

6.   The important date for local authorities was therefore 28 February 2003.  All public authorities were required to deal with individual requests for information from 1 January 2005, when the individual right of access came into force.

The right to information

a)   New rights

7.   Individuals already had the right to access information about them (‘personal data’) which was held on computer, and in some paper files, under the Data Protection Act 1998.  This was known as the ‘subject access right’.

8.   As far as public authorities are concerned, the Freedom of Information Act extended this right to allow access to all the types of information held, whether personal or non-personal.  This included information about third parties, although a public authority has to take account of the Data Protection Act 1998 before releasing any personal information.

9.   S.1(1) of the Act gives applicants two related rights:

• to be told whether the information exists, and
• to receive the information.

10.   The right to access information held by public authorities can be exercised by anyone; both natural and legal persons (e.g. a corporate body), worldwide.  Applicants are able to exercise their right of access to the information held by public authorities.  They are able to ask for information recorded both before and after the Act was passed (i.e.  it is fully retrospective).

b)   Making a request

11.   Applicants are not required to mention either the Freedom of Information Act or the Data Protection Act when making a request for information.  However, the request must be in writing, in a legible form and capable of being used for subsequent reference.  A request by email will suffice.  A charge may be made for dealing with the request.  The details of the charging regime are set out in the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (SI.3244).  Earlier in 2007, the government issued two consultations in respect of a revised fee structure.  Taking account of the range of responses received; in October 2007 the Government announced that it had decided to make no changes to the existing fees regulations.  

12.   In accordance with s.11 of the Act, where possible, information must be provided to the applicant in the manner requested.  This may be in the form of a copy or summary, or the applicant may ask to inspect the record.  Applicants are not entitled to information to which any of the exemptions in the Act applies.  However, information covered by an exemption may still be released if it is in the public interest to do so.  (Exemptions and the issue of public interest are considered in detail later in this note).

13.   S.10 of the Act requires public authorities to respond to requests promptly but no later than 20 working days following its receipt.  A public authority may ask for further information which it reasonably requires in order to identify and locate the information requested.  Where a public authority issued a fees notice, the applicant has 3 months to pay.  S.9(2) of the Act provides that if the payment is not made within this time, the public authority does not have to answer the request.

Responsibilities for public authorities

a)   Publication Schemes

14.   The Act places a duty on public authorities to adopt and maintain publication schemes which must be approved by the Information Commissioner.  Such schemes must set out:

• the types of information the authority publishes, 
• the manner in which the information is published, and
• details of any charges.

15.   Once approved, it will be up to the authority to decide how to publish its scheme.  S.19 requires public authorities to review publication schemes periodically.  In deciding what information should be included in the scheme, public authorities must have regard to the public interest in allowing access to information and the public interest in the publication of reasons for decisions made by the authority.  Schemes may either be designated for particular bodies or may be generic.  Model schemes, for groups of similar bodies (such as local councils) may also be approved by the Commissioner.

16.   Information is exempt from the Act if it is accessible to the applicant by other means (s.21 refers).  Where information is already accessible because it is covered by the authority’s publication scheme, the authority will not then be required to provide the information in response to an individual request.

17.   The Information Commissioner works with groups of public authorities (including NALC) to develop guidance on what should be included in publication schemes. The last publication scheme applicable to local councils and parish meetings without a separate parish council was developed in 2008 and had to be adopted by 31 December 2008. Please see NALC legal briefings issued in 2008 for further information.

b)   Responding to requests

18.   The process of making a request is outlined, from the perspective of the applicant above.

19.   Before a public authority is required to respond, a request has to satisfy certain conditions, for example: it must be in permanent form and must include sufficient information to enable the authority to identify the information requested (s.8).  Authorities do not have to comply with ‘vexatious’ requests or ‘repeated requests’ if the authority has recently responded to an identical or substantially similar request from the same person (s.14).  However, public authorities are under a duty to provide advice and assistance to anyone making a request (s.16).  Further guidance on this duty is set out in the Secretary of State’s Code of Practice (see below).

20.   A public authority may charge a fee for dealing with a request.  This is calculated according to the ‘Fees Regulations’.  An authority is not required to comply with a request if to do so means exceeding a cost limit set out in the Regulations.  This is £450 for local authorities.  However, in such cases the authority may still charge for providing the information, but will have to calculate the fee according to regulations created for that purpose.  

21.   All information, not covered by an exemption, must be released to the applicant within 20 working days of receiving the request.  Where possible the authority must respond in the manner specified by the applicant (for example, by providing a summary, copy or allowing inspection of a record).  Where an authority decides not to release the information requested, because it considers an exemption applies, it must, pursuant to s.17 of the Act give reasons for its decision and must inform the applicant if he /she has a right to complain to the public authority about the handling of the request (e.g. through a complaints or other procedure and give details of the procedure), or state that there is no procedure, and of his/her right to complain to the Information Commissioner.  In cases where an exemption applies, but an authority is then required to release the information because it is in the public interest to do so, it must disclose the information requested “within a reasonable timescale”.

22.   The Information Commissioner has developed guidance on the above procedures.  

The Public Interest

23.   In the majority of cases where an exemption applies, to some or all of the information requested, the public authority has to consider whether it must override the exemption because it is in the public interest to release the information.  This public interest test involves considering the circumstances of each particular case and the exemption that covers the information.  The balance lies in favour of disclosure, in that information can only be withheld if the public interest in withholding it is greater that the public interest in releasing it.
 
The Exemptions

24.   Whilst the Act creates a general right of access to information held by public bodies, it then sets out 23 exemptions where that right is either disapplied or qualified.  The categories of exemption are described below.

25.   Apart from vexatious or repeated requests, to which an authority need not respond, there are two general categories of exemptions: those where, even though an exemption exists, a public authority has a duty to consider whether disclosure is required in the public interest and those where there is no duty to consider the public interest.

a)   Exemptions where the public interest test applies (“qualified exemptions”)

26.   The majority of exemptions fall into this category:

• s.22 - Information intended for future publication;
• s.24 - National security (other than information supplied by or relating to named security organisations, where the duty to disclose in the public interest does not arise);
• s.26 - Defence;
• s.27 - International relations;
• s.28  - Relations within the United Kingdom;
• s.29 - The economy;
• s.30 - Investigations and proceedings conducted by public authorities;
• s.31 - Law enforcement;
• s.33 - Audit Functions;
• s.35 - Formulation of government policy, etc;
• s.36 - Prejudice to effective conduct of public affairs (except information held by the House of Commons or the House of Lords);
• s.37 - Communications with Her Majesty, etc and honours;
• s.38 - Health and Safety;
• s.39 - Environmental information;
• s.40 - Personal information of a third party (i.e. not data relating to the requester).  An exemption will stand or fall on whether disclosure of the information to a member of the public would be ‘unfair’, taking into account all the circumstances involved, in particular how the information was obtained; the likely expectations of the data subject regarding the disclosure of the information; the effect which disclosure would have on the data subject; and the public interest in disclosure of the information.  If disclosure of personal data to a member of the public would be ‘unfair’ then the request is likely to need to be refused under the Freedom of Information Act insofar as it relates to that personal data.
• s.42 - Legal Professional Privilege; and
• s.43 - Commercial interests.

To establish that the information falls within the terms of a qualified exemption, it is necessary to consider whether the public interest nevertheless requires that the information should be released.  The central question to consider is “Does the public interest in withholding the information outweigh the public interest in disclosing the information? “

27.   Where a public authority considers that the public interest in withholding the information requested outweighs the public interest in releasing it, the authority must inform the applicant of its reasons, unless to do so would mean releasing the exempt information.  The powers of the Commissioner in respect of disclosures in the public interest are considered later in this note.

b)   The ‘Absolute Exemptions’

28.   There are exemptions where, if the exemption applies, it is not necessary to go on to consider disclosure in the public interest:

• s.21 - Information accessible to applicant by other means;
• s.23 - Information supplied by, or relating to, bodies dealing with security matters;
• s.32 - Court records etc;
• s.34 - Parliamentary privilege;
• s.36 - Prejudice to effective conduct of public affairs (only applies to information held by House of Commons or House of Lords);
• s.40 - Personal information (where the applicant is the subject of the information, the applicant already has the right of ‘subject access’ under the Data Protection Act 1998; where the information concerns a third party and disclosure would breach one of the Data Protection Principles or  if disclosure would contravene a notice received under section 10 of the DPA (the right to prevent processing likely to cause damage or distress); or if the person who is the subject of the data would not be entitled to access to it under the DPA access regime because one of the DPA subject access exemptions would apply.  
• s.41 - Information provided in confidence;
• s.44 - Prohibitions on disclosure where a disclosure is prohibited by an enactment or would constitute contempt of court;

Secretary of State Codes of Practice

29.   Two Codes of Practice have been issued under the Act.  They were issued by the Secretary of State (pursuant to powers under s.45) in November 2004.  This gives guidance as to the practice which public authorities should follow in discharging their duty to provide access to information held by them.  In particular the Secretary of State’s Code of Practice gives guidance on:

• the provision of advice by public authorities to those making requests for information;
• the transfer of requests by one public authority to another;
• consultation with third parties, to whom the information requested relates to who may be affected by its disclosure;
• the inclusion in contracts entered into by the public authorities of terms relating to the disclosure of information; and
• the development of procedures for handling complaints from applicants.

30.   The Secretary of State’s Code of Practice is intended to give guidance on the practical steps to be taken by public authorities to ensure compliance with requests for information.  The Code makes different provisions for different public authorities and may be varied from time to time.

31.   The Secretary of State has a duty to consult with the Information Commissioner before amending his Code of Practice.  If it appears to the Information Commissioner that a public body has failed to comply with the provisions of the Code then he has the power to serve a “practice recommendation” setting out the steps to be taken to ensure future compliance (s.48).

The Lord Chancellor’s Code of Practice

32.   The second Code of Practice was issued by the Lord Chancellor in November 2002 (pursuant to powers under s.46) has two basic functions:

• To give advice to public authorities as to desirable practice in record keeping.  Without good records management compliance with the Acts provisions will be very difficult.  It will for example, be difficult to devise a comprehensive publication scheme without knowing what information is held by the authority.  Similarly it will be difficult to respond in a timely manner to individual requests for information without knowing where the information is held.
• To give public bodies advice on the practices to be followed when transferring records to the Public Records Office in the context of the Act.

33.   Pursuant to s.47 of the Act, the Information Commissioner’s Office has similar duties and powers, as outlined in paragraph 32 above, in relation to the Lord Chancellor’s Code (upon which it must also be consulted).  

The information Commissioner

34.   The Information Commissioner is an independent public official reporting directly to Parliament.  In respect of Freedom of Information Act, the Commissioner has a duty to:

• approve / revoke publication schemes;
• promote good practice;
• promote public authorities’ compliance with the Act;
• disseminate information and give advice about the Act;
• assess, with the consent  of a public authority, whether a public authority is following good practice; and
• report annually to Parliament.

Enforcement

35.   A person who has made a request for information may apply to the Information Commissioner for a decision as to whether the request has been dealt with by the public authority according to the Act.  In response the Information Commissioner may serve a decision notice on the public authority and applicant setting out any steps which the public authority are  required in order to comply with their duties  (s.50).  Pursuant to s.51 and s.52, the Commissioner also has the power to serve information notices and enforcement notices on public authorities.  

36.   In certain circumstances when notices are served, for example, on a government department, or the National Assembly for Wales or a public authority specifically designated by the Secretary of State, the Information Commissioner can issue a decision or enforcement notice requiring disclosure of information in the public interest.  However this may be subject to an ‘Executive Override’.  In such a case the public authority has 20 days from receipt of the notice to obtain a signed certificate from a Cabinet Minister overriding the Information Commissioner’s notice (s.53).  

Appeals

37.   There is no right of appeal against the Ministerial Certificate although it may be possible to mount a Judicial Review claim against the Minister in respect of it.  Decision, information and enforcement notices may be appealed to the independent Information Tribunal (s.57).  When serving a notice of any kind, the Commissioner must at the same time explain the appeals mechanism.

38.   Where a notice has been served earlier, the complainant or the public authority may appeal to the Information Tribunal which may uphold, overturn or vary the notice (s.58).  Appeals to the High Court against any decisions of the Tribunal may be made by any party to the appeal (s.59).

Freedom of Information and Data Protection

39.   As explained in paragraph 7 of this note, the Freedom of Information Act 2000 extends access rights which already exist under the Data Protection Act 1998.  A request by an individual for information about him/herself will be exempt under the Freedom of Information Act and will continue to be handled as a ‘subject access request’ under the Data Protection Act.  In certain circumstances such a request may involve the release of associated third party information.

40.   Where an applicant specifically requests information about a third party, the request falls within the remit of the Freedom of Information Act.  However, the authority must apply the Data Protection Principles (see Legal Topic Note No.38) when considering the disclosure of information relating to living individuals.  An authority must not release third party information, if to do so would mean breaching one of the above principles.

 41.   Individual enquiries in aspect of the Act can be addressed to the Information Commissioner via their information line:

Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Information Line:   01625 54 57 45 / 08456 30 60 60
Switchboard:      01625 54 57 45
Fax:         01625 52 45 10
Website:      http://www.ico.gov.uk/

Local Councils seeking additional advice particularly relating to exemptions under the Act or the fees charging regime outside the content of this Note or other briefings are advised to refer to the detailed and user friendly guidance produced by the Information Commissioner and available from their website and the Department of Constitutional Affairs, responsibility for which is now with the Ministry of Justice: http://www.dca.gov.uk/dca-defr.htm

Other Legal Topic Notes (LTNs) relevant to this subject: