The ICO exists to empower you through information.

Internal reviews under the Environmental Information Regulations (EIR)

Share

About this detailed guidance

This guidance discusses how you should deal with a complaint about your handling of a request for environmental information under the Environmental Information Regulations 2004. It explains how and when you should carry out an internal review to address such a complaint.

In detail

Are we required to carry out an internal review under the EIR?

Unlike the Freedom of Information Act 2000 (FOIA), the EIR specifies that you must offer an internal review.

Under Regulation 11 of the EIR, a requester is entitled to ask for an internal review if they consider that you have failed to comply with a requirement of the EIR.

Under Regulation 14(5) of the EIR, you must include details of your complaints (internal review) procedure when issuing a response to a request. You must also notify requesters of their right to complain to the ICO.

Part XII of the EIR code of practice (the code) offers you advice about how to administer your review and complaints procedure.

How do we recognise a request for an internal review?

To request an internal review, the requester must contact you in writing within 40 working days after the date on which they believe you did not comply with the EIR.

Part XII of the code makes it clear that a requester does not have to ask specifically for an internal review when complaining about your handling of their request.

You should treat any correspondence from the requester that expresses dissatisfaction with the initial response as a request for an internal review.

In most cases, the date on which the requester believes you did not comply with the EIR should be easy to determine. It is usually the date that you sent your initial response to them.

In a few cases, however, identifying this date may not be so straightforward.

Example 1

If the requester continues to write to you after the initial response then subsequent exchanges may convince them that you hold more information than you initially provided. In this case the date they believe a breach of the EIR occurred will fall sometime later than the date of your original response.

Example 2

Where you have considered a request under the wrong legislation, the requester may not initially be aware of their right to submit a complaint under the EIR. This can make the precise date on which they became aware of the problem more difficult to pinpoint.

The ICO therefore considers it good practice for you to exercise a degree of flexibility over the 40 working day limit if you cannot establish the exact date on which the requester became convinced of a breach.

If the ICO receives a complaint in which you and the requester are in dispute over whether the internal review request was submitted in time, then we will make a decision based on the individual circumstances of that case.

What are the time limits for an internal review?

You should carry out the internal review within a maximum of 40 working days after you receive the complaint.

As a matter of best practice, the ICO considers that, in most cases, you should aim to complete the review within 20 working days.

It is also good practice to send the requester an acknowledgement specifying your target date for a response.

If you find that you are unable to meet the target date because the issue is particularly complex or requires more lengthy consideration, then you should inform the requester of the reasons for the delay.

You must, however, complete the review and notify the requester of the outcome within the 40 working day time limit.

How do we carry out an internal review?

Regulation 11(3) states:

3) The public authority shall on receipt of the representations and free of charge

(a) consider them and any supporting evidence produced by the applicant; and

(b) decide if it has complied with the requirement.

Once you receive a request for an internal review, you should take into account the requester’s grounds of complaint and reconsider whether or not you handled the request in accordance with the EIR.

You should conduct your complaints procedure in a fair and impartial manner.

Your review should involve a thorough re-examination of your original decision. It should also be genuinely possible to amend or reverse your previous decision.

This should include a review of the outcome of the public interest test.

It is good practice for the internal review to be carried out, wherever possible, by somebody other than the person who issued the initial response.

Your procedure should be a clear, straightforward, single-stage process that is capable of producing a prompt decision for the requester.

What if the circumstances have changed?

It is quite possible that the circumstances relating to the request will have changed by the time you carry out the internal review.

However, you must take into account the circumstances which applied at the time of the request, rather than those in place at the time of the review. Or, at the latest, the time limit for responding, which is normally 20 working days after you received the request.

Nevertheless, if circumstances have changed to the extent that you are now able to release the information, then it obviously makes sense to do this. This may lead to the requester withdrawing their complaint.

If the requester does not withdraw their complaint and still wants an internal review then you need to decide if your original response complied with the requirements of the EIR. You should refer to the circumstances in place when the request was originally made.

For further guidance on the time limits for responding to requests see ‘What should we do when we receive a request for information’ in the Guide to the Environmental Information Regulations.

How do we communicate our decision?

Once you have reached your decision, you should notify the requester about the outcome in writing.

If you do not uphold the complaint, then you should let the requester know your reasoning.

You should also alert the requester to their right of appeal to the ICO if they wish to challenge your review outcome.

What happens if we uphold the complaint?

Regulation 11(5) states:

(5) Where the public authority decides that it has failed to comply with these Regulations in relation to the request, the notification under paragraph (4) shall include a statement of:

(a) the failure to comply;

(b) the action the authority has decided to take to comply with the requirement; and

(c) the period within which that action is to be taken.

If you reverse your decision to withhold information, then you should disclose it to the requester immediately.

If your review identifies any other failings then you should state what these are and set out when and how you intend to correct them. Obviously, you are not able to correct any time breaches that have already occurred, but you should still acknowledge that they have happened.

Where you have found that your staff failed to follow the proper procedures, it is good practice to provide the requester with an explanation and apologise.

You should also take appropriate steps to prevent any problems recurring in future.

How should we monitor complaints?

You should keep a record of each complaint and the outcome of your subsequent internal review, including the reasoning behind your decision.

This will help you to highlight any areas where you could improve your information handling procedures and identify training needs. You will also need this if the requester submits a complaint to the ICO.

Are we required to publicise our complaints (internal review) procedure?

You should include the details of your complaints procedure in your publication scheme or make them readily available elsewhere (such as on your website, if you have one). You should also include information about your timescale for dealing with complaints.

Further reading