Skip to main content
Home

FOI complaints and ICO enforcement powers

At a glance

The ICO has a general duty to investigate complaints from members of the public who believe that an authority has failed to respond correctly to a request for information. 

If the complaint is not resolved informally, we will issue a decision notice. If we find that you have breached the Act, the decision notice will say what you need to do to put things right.

We also have powers to enforce compliance if you have failed to adopt the publication scheme or have not published information as you should (see What information do we need to publish?), whether or not we have received a complaint about this.

You may be breaching the Freedom of Information Act if you do any of the following:

  • fail to respond adequately to a request for information;
  • fail to adopt the model publication scheme, or do not publish the correct information; or
  • deliberately destroy, hide or alter requested information to prevent it being released.

This last point is the only criminal offence in the Act that individuals and public authorities can be charged with.

Other breaches of the Act are unlawful but not criminal. The Information Commissioner’s Office (ICO) cannot fine you if you fail to comply with the Act, nor can we require you to pay compensation to anyone for breaches of the Act. However, you should correct any mistakes as soon as you are aware of them.

In brief

When might the ICO receive a complaint about how we have handled a request?

If someone thinks you have not dealt with their request for information properly, they should start by complaining to you. Most public authorities have an internal complaints procedure relating to requests (see When can I refuse a request?). If after going through your complaints procedure the requester is still dissatisfied, or if you fail to review your original decision, then the requester can complain to the ICO.

Whenever you refuse a request you must always let people know about their right to complain to the ICO.

What can the ICO do about a complaint?

The ICO will often resolve complaints informally. You may accept that you have made a mistake, or the requester may withdraw their complaint once we have explained the law to them. In many cases, a satisfactory compromise is reached.

We also have the power to issue legally binding decision notices. We do this in about a third of valid freedom of information complaints. The decision notice will state whether you have complied with the law, and, if not, what you should do to put things right. Depending on the complexity of the case, a decision notice will generally include the arguments and evidence that we have considered in reaching our decision.

A decision notice may state that you have dealt with a request correctly. However, if we find that you have breached the Act, we may order you to take steps to put things right, such as disclosing some or all of the requested information. This happens in about half of cases that are resolved by a decision notice. For example, if we find that you have incorrectly applied an exemption, this is a breach of section 1 of the Act and the remedy would be for you to disclose the information. In other cases we may require you to give the requester further advice and assistance.

The ICO does not punish public authorities or compensate requesters. We cannot investigate other matters that may lie behind the request. We focus on only whether you have complied with the Act.

What should we do if someone complains to the ICO about how we have handled a request?

If a requester makes a complaint to the ICO, one of our case officers will contact you and explain what we need from you. If you know a complaint has been made, you should make sure you keep all the relevant correspondence, as well as the requested information. If you now realise you should have released more information, you should do this as soon as possible and let us know that you have done so.

In many cases we will need to see the disputed information. Our case officers will not pass this on to the requester (even if we find in their favour) and will not reveal the contents of the disputed information in any decision notice. Staff with higher levels of security clearance will be able to handle very sensitive information.

The case officer dealing with the complaint may ask you to explain your decision more fully or provide further evidence. This guide, and the guidance it links to, should help you work out what you are required to provide. Remember that you are required to disclose requested information unless there is good reason not to. It is your responsibility to show why you should be allowed to refuse a request, so it is in your interests to co-operate fully with our investigation.

In rare circumstances when a public authority persistently refuses to co-operate with us, we can issue an information notice. This is a legally binding notice, requiring an authority to give us the information or reasons we have asked for.

For further information, read our more detailed guidance:

Can we introduce a new reason for refusing a request at this stage?

It is not good practice to introduce new reasons for refusing a request at this late stage (see When can I refuse a request?) and you should avoid doing so. However, if you do decide you need to rely on a new exemption, then we will consider your arguments in the normal way. You will need to inform us and the requester about your new arguments straight away.

What should we do if we receive a decision notice from the ICO?

In our decision notice we may find against you or may decide you handled the request correctly. In some cases we may uphold your overall decision but make some findings about delays and other aspects of your request handling. This is an opportunity for you to learn and improve, and perhaps avoid future complaints.

If the decision notice requires you to take steps, such as disclosing some information, you should do this within 35 calendar days of the date of the notice, unless you intend to appeal. If you disagree with the decision and wish to appeal, you must lodge your appeal with the First Tier Tribunal (Information Rights) within 28 calendar days. The requester also has a right of appeal.

Failure to comply with a decision notice is contempt of court, punishable by a fine.

What does it cost to appeal against the ICO’s decision?

There is no fee for appealing to the Tribunal and you do not need to be represented by a barrister or solicitor, although it is advisable to have professional legal representation. Bear in mind that a Tribunal appeal may be time consuming and requires careful preparation.

Costs are not normally awarded in the Tribunal. The Tribunal may award costs where a party has acted unreasonably in bringing the case or in the way they conducted themselves, although this is rare.

More details of the appeal process are on the Tribunal’s website under Information Rights: how to appeal.

What happens when the ICO’s decision is appealed?

A public authority, the requester or both can appeal against the Information Commissioner’s decision notice.

If the Tribunal decides that the Commissioner’s decision was wrong in law, or that they exercised their discretion wrongly, it can overturn the decision and issue a substitute decision notice. This decision notice has the same legal status as the first one. Like the Commissioner, the Tribunal can only consider questions relevant to the Act, not any wider dispute that may arise from the request.

Appeals may be by oral hearing, where witnesses give evidence in person. If the evidence can be presented entirely in writing, the appeal will be decided on the basis of those documents.

If an appeal raises particularly complex or important issues, it may be transferred to the Upper Tribunal (Administrative Appeals) Chamber. The Upper Tribunal also hears appeals against decisions of the First Tier Tribunal (Information Rights). Appeals against decisions of the Upper Tribunal are heard in the Court of Appeal.

Does the ICO have any other powers to enforce the Act?

The Information Commissioner issues decision notices on complaints about specific requests for information. However, if a breach of the Act doesn’t fall within the scope of a decision notice, the ICO may decide to issue an enforcement notice.

The ICO can use an enforcement notice if you have failed to adopt the publication scheme or failed to publish in accordance with it (see What information do we need to publish?).

The Commissioner may also use an enforcement notice if an authority is repeatedly failing to comply with its obligations, which they may have been made aware of from complaints or from other information available to them. For example, the Ministry of Justice publishes statistics for the time different government departments take to respond to requests. Also, problems with the way certain public authorities handle freedom of information requests may be discussed in the media or online. In such cases the Commissioner may issue an enforcement notice covering a number of different requests, whether or not the ICO has received specific complaints. An example would be where the Commissioner becomes aware of a backlog of requests at an authority and orders it to clear this by a given date.

The ICO may also ask you to sign an agreement that you will take a particular course of action to improve your compliance with the Act.

Further information about the Commissioner’s powers can be found in our web pages Taking action – freedom of information and environmental information.

What about poor practice that doesn’t amount to a breach of the Act?

The section 45 and section 46 codes of practice (see What is Freedom of Information?) lay down good practice that you should follow in fulfilling your freedom of information responsibilities. These codes are not legally binding, but they should help you avoid breaching the Act. The Commissioner is also responsible for promoting the codes and may take action on poor practice, even if this has not led to a breach of the Act.

If you fail to follow good practice as set down in the codes of practice, the Commissioner may issue a practice recommendation. For example, they may recommend that you introduce an internal review procedure, or improve staff training. The Commissioner’s recommendations are not legally binding, but the ICO publishes and publicises all practice recommendations. In addition, if you fail to comply with good practice, you will probably be breaching the Act. Also, you may be given a practice recommendation if you have been given several negative decision notices. In our experience, public authorities generally comply with practice recommendations.

The ICO does not usually take enforcement action without first approaching you to discuss any difficulties you may be having in trying to comply with the Act, and giving you a chance to improve.

Are there criminal offences in the Freedom of Information Act?

Yes, section 77 states that it is a criminal offence to alter, block, destroy or conceal information.

Depending on the nature of the incident, an authority or its individual members of staff could be charged with this offence. The penalty is a fine.

There are no financial or custodial penalties for failure to provide information on request or for failure to publish information. But you could be found in contempt of court for failing to comply with a decision notice, enforcement notice, or information notice. This could lead to a fine or, in theory, jail for a senior officer of the authority.

Sample questions we ask public authorities

We have published the standardised sample copy that our case officers use when writing to public authorities, including introductory information about the exemptions and key questions we may need to ask. The questions are not exhaustive and case officers tailor their correspondence in each case.

We have made this internal ICO resource available to help with transparency around freedom of information requests and how we approach casework. It may help public authorities to consider these questions, when deciding if relevant exemptions apply.