Under the Act, there is no obligation for an authority to provide a complaints process. However, it is good practice (under the section 45 code of practice) and most public authorities choose to do so.
If you do have a complaints procedure, also known as an internal review, you should:
- ensure the procedure is triggered whenever a requester expresses dissatisfaction with the outcome;
- make sure it is a straightforward, single-stage process;
- make a fresh decision based on all the available evidence that is relevant to the date of the request, not just a review of the first decision;
- ensure the review is done by someone who did not deal with the request, where possible, and preferably by a more senior member of staff; and
- ensure the review takes no longer than 20 working days in most cases, or 40 in exceptional circumstances.
When issuing a refusal notice, you should state whether you have an internal review procedure and how to access it. If a requester complains even when you have not refused a request, you should carry out an internal review if they:
- disagree with your interpretation of their request;
- believe you hold more information than you have disclosed; or
- are still waiting for a response and are unhappy with the delay.
Even if your internal review upholds your original decision (that, as at the date of the request, the information was exempt from disclosure) you may wish to release further information if circumstances have changed and your original concerns about disclosure no longer apply. You are not obliged to do this but it may resolve matters for the requester and reduce the likelihood of them making a complaint to the Information Commissioner if you do.