Refusing a request under the Environmental Information Regulations 2004 (EIR)

About this detailed guidance

This guidance explains when and how you can refuse a request for environmental information under the EIR. Read this guidance if you have questions not answered in the Guide to the EIR to the EIR or if you need further guidance on refusing a request under the EIR.

In detail

• Overview
• When can we refuse a request?
• How long do we have to issue a refusal notice?
• What should we include in a refusal notice?
• What is our duty to confirm or deny?
• What should we do when requesters seek their own personal information?
• What is our duty to provide advice and assistance?

Overview

This is part of a series of guidance pieces, which goes into more detail than the Guide to the EIR, to help you fully understand your obligations and promote good practice. This guidance explains when and how you can refuse a request for environmental information.

You may only refuse a request if one of the exceptions in regulations 12 or 13 applies. When you decide to refuse a request, you must normally issue your written refusal notice no later than 20 working days after the date of receipt of the request. You may extend the time limit to 40 working days if the request is particularly complex and involves a lot of information.

In most circumstances, your refusal notice must state the exception you are relying on and explain the reasons for the decision, including the details of any public interest test. You should also advise the requester of your internal complaints procedure and notify them of their right to complain to the ICO.

If you refuse a request on the grounds that the information is incomplete or documents are unfinished, then your refusal notice should provide the requester with details of any other public authority known to be preparing that information, along with the estimated date for completion.

If you do not hold the requested information but believe that another public authority does, then your refusal notice should either:

• provide the requester with details of the public authority that you believe holds the information; or
• advise the requester that you have transferred the request.

You normally need to confirm that you do hold information, even if you are refusing to provide it. If you do not hold any information, then you usually need to issue a refusal notice citing regulation 12(4)(a).

You do not need to issue a refusal notice when the request is for the requester’s own personal data. You should treat such requests as subject access requests (SARs) under the Data Protection Act 2018 (DPA 2018) and the UK General Data Protection Regulation (UK GDPR).

When can we refuse a request?

When you receive a request for environmental information, you have to either:

• provide the requester with the information; or
• issue a written refusal notice explaining why you are refusing to do so.

You can refuse a request if one of the exceptions in regulation 12(4) or 12(5) of the EIR applies. You need to explain how the public interest in maintaining the exception outweighs that in disclosure. You can also refuse a request if regulation 13 applies. 

You can find detailed guidance on how the exceptions and public interest test in the EIR work, and on the individual exceptions available, in the Guide to the EIR.

How long do we have to issue a refusal notice?

Regulations 14(1) and (2) state:

14(1) If a request for environmental information is refused by a public authority under regulations 12(1) or 13(1), the refusal shall be made in writing.

(2) The refusal shall be made as soon as possible and no later than 20 working days after the date of receipt of the request.

You must issue your refusal notice as soon as possible and, in most cases, no later than 20 working days after the date you received the request. You should not wait until the 20th day to respond if you can reasonably provide the notice earlier.

The EIR differs from the Freedom of Information Act 2000 (FOIA) in that there is no provision to increase this time limit specifically to consider the public interest test.

However, regulation 7 allows you to extend the time period to 40 working days. This applies in any case where the complexity and volume of the requested information means it is impractical to decide whether to refuse the request within the 20 working day period.

If you require an extension, you must still inform the requester of this within the initial 20 working day limit.

When notifying the requester of the extension, it is good practice to explain the reasons for the delay and to provide them with some indication of when you may reach the final decision.

What should we include in a refusal notice?

You should make it clear in the refusal notice that you considered the request under the EIR.

The refusal notice should contain:

• the reasons why you are refusing the request;
• details of complaints procedure;
• when you rely on regulation 12(4)(d), details of any other public authority that you know is preparing the requested information.
• when you rely on regulation 12(4)(a), details of any other public authority to whom the requester could redirect their request.

The reasons why you refuse the request

Regulation 14(3) states:

(3) The refusal shall specify the reasons not to disclose the information requested, including –

(a) any exception relied on under regulations 12(4), 12(5) or 13; and 

(b) the matters the public authority considered in reaching its decision with respect to the public interest under regulation 12(1)(b) or, where these apply, regulations 13(2)(a)(ii) or 13(3).

You must specify which regulations you are applying and normally need to explain how you reach your decision. The notice should include the full regulation number and precise wording of the exception or regulation you are applying.

If you are relying on any of the exceptions in regulation 12(4), you need to explain why you believe that the request meets the description within the exception.

If you are relying on any of the exceptions listed in regulation 12(5), then you usually need to explain the adverse effect you believe would result from disclosure, and exactly why disclosing the requested information would result in that adverse effect.

Claiming the national security element of regulation 12(5)(a) is the only situation where you don’t have to explain why a 12(5) exception applies. In this situation, you may choose to issue a ministerial certificate instead. A Minister of the Crown needs to sign such a certificate to certify that the disclosure would adversely affect national security and would not be in the public interest. For more information, you should read our guidance on Regulation 12(5)(a) - international relations, defence, national security or public safety.

If you are relying on regulation 13, then you need to explain why this regulation applies by referring to the relevant provisions from the DPA 2018 and UK GDPR.

If you apply different exceptions to different parts of the requested information, then the refusal notice needs to explain why.

If you are dealing with a multi-part request, or refusing several requests at the same time, then you need to address each individual request or part of a request separately in your refusal notice.

If you carry out a public interest test then, unless you issue a ministerial certificate, you need to provide the requester with the details of how you applied that test. 

All of the exceptions in regulations 12(4) and (5) are subject to a public interest test. Regulation 13 is not. However, the ICO accepts that if you are refusing a request because you do not hold any information, then you cannot carry out a meaningful public interest test. Therefore, a regulation 12(4)(a) refusal notice does not need a consideration of the public interest test.

The refusal notice should therefore normally include:

• the regulation under which you are refusing the request;
• the reasons why that regulation applies;
• a breakdown of the public interest factors which you took into account; and
• the reasoning behind the authority’s conclusion that the public interest lay in maintaining the exception.

When drafting a refusal notice, you should not make assumptions about the requester’s level of background knowledge. It is good practice to use plain English and avoid the use of jargon or abbreviations whenever possible. The explanation in the refusal notice should also be detailed enough to give the requester a real understanding of why you are withholding the information. In most cases, you can do this without any problem. You should have relatively few cases where it is not possible to explain in detail why you are withholding the information, because to do so would undermine the purpose of claiming the exception.

If the reasons for the decision are particularly complex or you are applying several exceptions, then you may want to split the notice into shorter subsections. This would make it easier for the requester to follow.

Details of the complaints procedure

Regulation 14(5) states:

(5) The refusal shall inform the applicant–

(a) that he may make representations to the public authority under regulation 11; and

(b) of the enforcement and appeal provisions of the Act applied by regulation 18.

Your refusal notice must inform the requester that they have the right to complain to you if they disagree with the decision. They must do so in writing and within 40 days of receipt of the refusal notice. The notice should also contain details of your internal complaints procedure, known as an internal review, including:

• contact information for the relevant department or member of staff;
• an outline of the appeals process; and
• timescales for dealing with complaints.

Your notice must also advise the requester of their right to make a complaint to the ICO and should include relevant contact details.

You can find detailed guidance on how to respond to a complaint about the handling of an EIR request in our guidance on internal reviews under the EIR.

When you rely on regulation 12(4)(d): details of any other public authority that is known to be preparing the requested information

Regulation 12(4)(d) allows you to refuse a request which would require you to provide any of the following:

• Materials still in the course of completion.
• Unfinished documents.
• Incomplete data.

You should refer to our guidance on Regulation 12(4)(d): Material in the course of completion, unfinished documents and incomplete data. This gives further details of when and how you can apply this exception.

Regulation 14(4) states:

(4) If the exception in regulation 12(4)(d) is specified in the refusal, the authority shall also specify, if known to the public authority, the name of any other public authority preparing the information and the estimated time in which the information will be finished or completed. 

If you decide to refuse the request under regulation 12(4)(d), then regulation 14(4) applies. This is relevant if you know another public authority is going to ‘finish’ or ‘complete’ the requested information. If so, you must include the following additional details in your refusal notice:

• The name of any other public authority preparing the information.
• The estimated time in which they aim to finish or complete the information.

When you rely on regulation 12(4)(a): details of any other public authority to whom the request may be redirected, or to whom the request has been transferred

Regulation 10 states:

(1) Where a public authority that receives a request for environmental information does not hold the information requested, but believes that another public authority or a Scottish public authority holds the information, the public authority shall either–

transfer the request to the other public authority or Scottish public authority;

supply the applicant with the name and address of that authority,

and inform the applicant accordingly with the refusal sent under regulation 14(1).

If you do not hold the requested information yourself, but you believe that another authority does, (including any which are based in Scotland), then you can refuse the request under regulation 12(4)(a). You should also:

• either transfer the request to the other authority; or
• provide the requester with their details so that they can submit a new request.

You can find more detailed good practice advice on when and how to transfer a request in Part VI of the Code of Practice on the discharge of the obligations of public authorities under the Environmental Information Regulations 2004.

If you choose to transfer a request, your refusal notice should provide:

• the requester with the name of the public authority to which the request has been transferred;
• that authority’s contact details; and
• the date on which the transfer was made.

If you choose not to transfer the request but to provide another public authority’s details, your refusal notice should:

• explain that another authority holds the information;
• provide that authority’s contact details; and
• advise the requester that they need to resubmit their request to that authority.

You should issue the refusal notice as soon as possible after you complete the transfer.

Once you transfer the request, the second authority must comply with their EIR obligations. This should be in just the same way as if they receive the request direct from the requester.

What is our duty to confirm or deny?

In most cases, your refusal notice needs to confirm that you hold the information before going on to explain why you have not provided it. If you do not hold the information then you should normally refuse the request by issuing a refusal notice, citing regulation 12(4)(a).

There are, however, some situations in which you can issue a refusal notice which neither confirms nor denies whether you hold the requested information.

Regulation 12(5)(a): adverse effect upon international relations, defence, national security, or public safety

Regulation 12(5)(a) provides an explicit exclusion from the duty to confirm or deny whether you hold information in certain circumstances. You can find more details on how this exclusion works in our guidance on Regulation 12(5)(a): international relations, defence, national security, or public safety.

If you wish to refuse to confirm or deny whether you hold information under regulation 12(5)(a), then you need to issue either:

• a refusal notice, explaining why you need the exclusion and why the public interest favours maintaining the exclusion; or
• a ministerial certificate, if you are claiming the exclusion because of an adverse effect on national security.

Regulation 13(5): personal data

Under regulation 13(5) you can issue a refusal notice which neither confirms nor denies whether you hold personal data about a third party. You can do this in any circumstance where:

• confirming that you hold the information would breach the DPA 2018 and UK GDPR; or
• the data subject would not themselves be entitled, under the DPA 2018 and UK GDPR, to know whether their personal data is being processed.

Regulation 12(4)(b): the request for information is manifestly unreasonable

There is nothing in the EIR which specifically allows you to refuse to confirm or deny whether you hold information about a manifestly unreasonable request. In most cases, you should confirm that you hold the information, even if you are refusing the request as manifestly unreasonable.

However, we recognise that the burden involved in even establishing whether you hold the information may be in itself manifestly unreasonable. In these cases, it may be acceptable to issue a refusal notice relying on regulation 12(4)(b) that does not state whether you hold the information.

What should we do when requesters seek their own personal information?

Regulation 5(3) exempts you from the requirement to make available environmental information which is also the requester’s personal data.

When you receive such a request, we would not expect you to issue a refusal notice under the EIR. Instead, you should advise the requester within 20 working days that you intend to treat the request as a SAR made under the DPA 2018 and UK GDPR.

You should not require the requester to submit a separate information request. However, as with any SAR, you can write back to the requester if you require further identification or a fee before processing the request.

You can find more information about how to deal with a request for personal information in our Guide to Data Protection.

What is our duty to provide advice and assistance?

The EIR does not provide any explicit requirement for a refusal notice to include advice and assistance for the requester.

However, under regulation 12(4)(c), you can only refuse requests formulated in too general a manner if you have provided reasonable advice and assistance and helped the applicant to refine their request.

If you are refusing the request under regulation 12(4)(b) as manifestly unreasonable for reason of burden or cost, we expect you to provide reasonable advice and assistance to the applicant to help them submit a less burdensome request.

Failure to provide advice and assistance does not necessarily invalidate the use of this exception. However, First-Tier Tribunals have been unwilling to support the use of regulation 12(4)(b) when public authorities did not try to give the applicant advice and assistance.

You can find more information about your duty to advise and assist in our guidance on Regulation 9 – Advice and Assistance.