Refusing a request: writing a refusal notice (section 17)

About this detailed guidance

This guidance is written for public authorities. It discusses your obligations under section 17 of the Freedom of Information Act 2000 (FOIA) to provide the requester with a refusal notice if you refuse their request. Read it if you have questions not answered in the Guide.

In detail

Overview
What does FOIA say?
How do we explain why the request has been refused?
Should we include details about our internal review and the appeals procedures?
What are the time limits for issuing a refusal notice?
- Time extensions to consider the public interest test
How do we deal with a request for the requester’s own personal data?
What are the benefits of issuing a good refusal notice?
Further reading

Overview

You have two basic duties under FOIA: to confirm or deny whether requested information is held and, if it is held, to provide the requester with that information. If you are refusing to meet either of these duties, you will usually need to issue a refusal notice to the requester explaining why.
If you intend to refuse a request on the grounds that it is subject to an exemption, or would exceed the cost limits under section 12, you must always issue the requester with a refusal notice informing them of your decision.
If you’re relying on a claim that section 14 applies, you must issue a refusal notice unless you have already done so in response to an earlier vexatious or repeated request from the same individual, and it would be unreasonable to issue another one.
The refusal notice will need to state the section of FOIA you’re relying on and in most instances explain the reasons for your decision, including the details of any public interest and prejudice tests.
If you have an internal review procedure, the refusal notice must provide the requester with the relevant details.
The refusal notice must inform the requester of their right to complain to the ICO.
You should issue your refusal notice no later than 20 working days after the date of receiving the request.
If you need further time to consider the public interest test, you should issue an initial refusal notice explaining why the exemption applies and giving an estimated date by which you’ll complete the public interest test. Once the public interest test has been completed then, if you still intend to withhold information, you will need to issue a further refusal notice explaining your application of the public interest test.
Where the requester has asked for their own personal data, we would expect you to treat this as a subject access request under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (DPA 2018) regime, rather than issuing a refusal notice under section 40(1) of the FOIA.

What does FOIA say?

When you receive a request you must:

provide the information to the requester
reply to the requester saying that the information is not held
refuse to confirm or deny whether information is held, or
confirm that information is held but refuse to provide it.

If you refuse to confirm or deny whether information is held, or refuse to provide information, you will usually need to send the requester a refusal notice explaining why.

You can only refuse a request if:

the information is subject to one of the exemptions (these are listed in Part II of FOIA)
complying with it would exceed the appropriate cost limits under section 12, or
it is vexatious or repeated under section 14.

How do we explain why the request has been refused?

The refusal notice should first make clear that you considered the request under the Freedom of Information Act 2000.

You should not make assumptions about the requester’s level of knowledge when drafting a refusal notice. It is therefore good practice to use plain English and avoid the use of jargon or abbreviations whenever possible.

Refusing a request because of a Part II exemption

Sections 17(1) and 17(3) state:

(1) A public authority which, in relation to any request for information, is to any extent relying on a claim that any provision of Part II relating to the duty to confirm or deny is relevant to the request or on a claim that information is exempt information must, within the time for complying with section 1(1), give the applicant a notice which—

(a)states that fact,

(b)specifies the exemption in question, and

(c)states (if that would not otherwise be apparent) why the exemption applies.

(3)A public authority which, in relation to any request for information, is to any extent relying on a claim that subsection (1)(b) or (2)(b) of section 2 applies must, either in the notice under subsection (1) or in a separate notice given within such time as is reasonable in the circumstances, state the reasons for claiming—

(a)that, in all the circumstances of the case, the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the authority holds the information, or

(b)that, in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information

You can find more guidance on how to apply the exemptions in part II of the FOIA in our Guide to Freedom of Information. The guide includes explanations of the differences between class and prejudice based exemptions, and qualified and absolute exemptions. It also includes an explanation of how the exclusion from the duty to confirm or deny works in practice.

If you are refusing a request because a Part II exemption applies, your refusal notice will usually need to include the following information:

The exemption(s) on which you’re relying, including section, subsection, and wording of the exemption concerned.
The reasons why the exemption applies.

and, where applicable

An explanation of the public interest factors you took into account.
The reasoning behind your conclusion that the public interest favoured maintaining the exemption.

Your explanation should be detailed enough to give the requester a real understanding of why you have chosen not to comply with their request. This will usually mean explaining the following things in some detail:

If you have claimed a prejudice based exemption, you should say exactly how disclosing the information, or confirming or denying whether it is held, would lead to the prejudice set out in the exemption.
Or, if you have claimed a class based exemption, you should say exactly how the information requested, or the confirmation or denial you would need to provide, meets the test set out in the exemption.
When the exemption is subject to the public interest test, all the matters you took into consideration and why the public interest was in favour of withholding the information or refusing to confirm or deny whether it is held.
When the exemption is subject to the public interest test, all the matters you took into consideration and why the public interest was in favour of withholding the information or refusing to confirm or deny whether it is held.

However, under section 17(4), you can omit those details if their inclusion would undermine the purpose for claiming the exemption. Generally, this would be because the explanation itself would disclose details of the information being withheld. Such cases should be rare though.

Section 17(4) states:

(4) A public authority is not obliged to make a statement under subsection (1)(c) or (3) if, or to the extent that, the statement would involve the disclosure of information which would itself be exempt information.

If your reasons for the decision are particularly complex or you applied several exemptions, it may be advisable to split the notice into shorter subsections to help the requester follow it.

Providing a good quality refusal notice can help satisfy a requester that their request has been properly considered and that your use of the exemptions is justified. This can reduce the likelihood that they’ll seek an internal review. Drafting a good quality refusal notice also acts as a final check of your reasons for relying on an exemption.

Should a complaint be made to the Commissioner, a detailed refusal notice should support quicker resolution. For more information on the early resolution process please see guidance on how the ICO deals with complaints: ‘How we deal with complaints’.

Refusing a vexatious or repeated request

Under section 14 you can refuse a request if it is vexatious or if it’s a repeat request. You can find detailed guidance about vexatious or repeated requests on the guidance index of our website.

Sections 17(5) and 17(6) state:

(5) A public authority which, in relation to any request for information, is relying on a claim that section 12 or 14 applies must, within the time for complying with section 1(1), give the applicant a notice stating that fact.

(6) Subsection (5) does not apply where,

(a) the public authority is relying on a claim that section 14 applies,

(b) the authority has given the applicant a notice, in relation to a previous request for information, stating that it is relying on such a claim, and

(c) it would in all the circumstances be unreasonable to expect the authority to serve a further notice under subsection (5) in relation to the current request.

Under section 17(5), if you are relying on a claim that section 14 applies, you will usually need to issue a refusal notice stating that the request has been refused on the grounds that it is vexatious or repeated.

You need not give the requester an explanation of why you’ve reached this conclusion. The possible advantages of doing so, though, are explained in our more detailed guidance on section 14.

In some situations you need not issue a refusal notice at all. Section 17(6) removes the obligation to do so when both the following conditions are met:

You have already given the same person a refusal notice for a previous vexatious or repeated request.

It would be unreasonable to issue another one.

The Commissioner will usually only consider it unreasonable to issue a further notice when you have previously warned the requester that you will not respond to any further vexatious requests on the same or similar topics.

Refusing a request because answering it would exceed the costs limit

You can find more guidance on how to establish whether a request exceeds the costs limit in the Guide to Freedom of Information or in our guidance Requests where the cost of compliance exceeds the appropriate limit.

Sections 17(5) states:

(5) A public authority which, in relation to any request for information, is relying on a claim that section 12 or 14 applies must, within the time for complying with section 1(1), give the applicant a notice stating that fact.

If you’re refusing a request under section 12, you must send the requester a refusal notice saying you are refusing the request under section 12 because compliance would exceed the appropriate cost limit.

There is no statutory requirement under section 17 for the refusal notice to include an estimate of the costs involved or any other explanation of why the cost limit would be exceeded.

However, there is a real benefit in doing so. Explaining clearly how and why the appropriate limit would be exceeded and providing a breakdown of the tasks, hours and costs may help the requester understand why the use of section 12 is justified. This may make it less likely that they seek an internal review.

It is helpful to also identify the regulations that establish the costs limit ie The Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 SI No. 3244.

When a request is refused under section 12 you have a duty under section 16 of FOIA to provide requesters with advice and assistance.

Section 16 states:

(1) It shall be the duty of a public authority to provide advice and assistance, so far as it would be reasonable to expect the authority to do so, to persons who propose to make, or have made, requests for information to

(2) Any public authority which, in relation to the provision of advice or assistance in any case, conforms with the code of practice under section 45 is to be taken to comply with the duty imposed by subsection (1) in relation to that

The section 45 Code of Practice states:

2.10 Where it is estimated the cost of answering a request would exceed the “cost limit” beyond which the public authority is not required to answer a request (and the authority is not prepared to answer it), public authorities should provide applicants with advice and assistance to help them reframe or refocus their request with a view to bringing it within the costs limit.

And

6.9 Where a request is refused under section 12, public authorities should consider what advice and assistance can be provided to help the applicant reframe or refocus their request with a view to bringing it within the cost limit. This may include suggesting that the subject or timespan of the request is narrowed.

The ICO considers the best way to provide such advice and assistance is to include it in your refusal notice. If it is possible to refine the request, this will usually involve providing advice on how to do so. It could also involve giving an indication of what could be provided within the limit. If you have not already done so when explaining why section 12 applies, you should also consider providing a breakdown of the costs involved in meeting the request as originally formulated.

Further guidance is available on section 12 and on Section 16 – Advice and Assistance.

Should we include details about our internal review and the appeals procedures?

Section 17(7) states:

(7) A notice under subsection (1), (3) or (5) must

(a) contain particulars of any procedure provided by the public authority for dealing with complaints about the handling of requests for information or state that the authority does not provide such a procedure, and

(b) contain particulars of the right conferred by section 50

Your refusal notice must state whether or not you have an internal review procedure through which the requester can appeal your decision.

There is no statutory requirement to offer an internal review under the FOIA. But all authorities should have an internal review procedure in place so that they conform to FOIA Section 45 Code of Practice guidelines.

If you do offer an internal review, you must give its details.

In addition, you may ask them to explain what elements of the refusal they disagree with and why. This will help you when conducting the internal review.

Further information about the internal review procedure is available in our guidance on Request Handling – Frequently Asked Questions.

The refusal notice must also inform the requester of their right to make a complaint to the Commissioner and should include the relevant ICO contact details.

The ICO has an online portal through which complaints can be submitted. The portal guides requesters through the process of making a complaint, including the information they need to provide. It may be helpful to give this link to the online complaints portal. However, you should also include the ICO’s postal address for those who may prefer not to use the online portal.

It is also worth making the requester aware that the Commissioner will not normally accept complaints before they have exhausted the internal review procedure, or if there has been an undue delay in submitting the complaint.

What are the time limits for issuing a refusal notice?

You must issue your refusal notice as soon as practicable and within the time limit provided at section 10 of FOIA. The time limit for most public authorities is 20 working days after the date you receive the request, but you should not wait until the 20th day to respond if you can reasonably provide the notice earlier.

You may be subject to a different time limit (for example if you’re a school you don’t have to count school holidays as working days).

For more detail on this please refer to The Freedom of Information (Time for Compliance with Requests) Regulations 2004 or our own guidance Time limits for compliance under FOIA.

Time extensions to consider the public interest test

Section 17(2) states:

(2) Where–

in relation to any request for information, a public authority is, as respects any information, relying on a claim–

that any provision of Part II which relates to the duty to confirm or deny and is not specified in section 2(3) is relevant to the request or

that the information is exempt information only by virtue of a provision not specified in section 2(3) and

at the time when the notice under subsection (1) is given to the applicant, the public authority (or, in a case falling within section 66(3) or (4), the responsible authority) has not yet reached a decision as to the application of subsection (1)(b) or (2)(b) of section 2,

The notice under subsection (1) must indicate that no decision as to the application of that provision has yet been reached and must contain an estimate of the date by which the authority expects that such a decision will have been reached.

Under section 10(3) you may claim an extension to the statutory 20 working day limit, if necessary. The extension is only for considering the public interest.

Therefore the extension may be claimed if you need more time:

to determine whether or not the balance of the public interest lies in maintaining the exemption
to consider whether or not it would be in the public interest to confirm or deny whether the information is

FOIA does not set a specific limit on the amount of extra time you can take to consider the public interest test. It simply states that the notice communicating your final decision must be provided within ‘such time as is reasonable in the circumstances’.

The ICO position is that a public authority should take no more than an extra 20 working days to consider the public interest, which means the total time spent dealing with the request should not exceed 40 working days.

It is important to remember that the extension is only for considering the public interest test. You cannot claim additional time to consider whether the exemptions are engaged. Therefore, even if you need more time to consider the public interest, you must still decide whether the exemptions are engaged within 20 working days of receiving the request.

You are still obliged to issue an initial refusal notice, within those first 20 working days, explaining why the exemption applies and giving the date you expect to complete your consideration of the public interest test.

Once you have come to a final decision about the public interest, you must either:

disclose the relevant information to the requester, or
issue a notice explaining why you’ve found that the public interest favours maintaining the exemption or neither confirming or denying that the information is

In effect, therefore, you may need to issue two refusal notices; the first to explain that an exemption is engaged and to advise that the public interest test is still being considered, and the second to communicate your final decision. Both notices should provide details of the appeals procedure.

How do we deal with a request for the requester’s own personal data?

Under section 40(1) you are not required to provide the requester’s own personal data under FOIA. Such requests should instead be treated as a subject access request under the UK GDPR and DPA 2018 regime.

However, if the requester is seeking their own personal data, you do not usually need to issue a refusal notice under Section 40(1) of FOIA. Instead we would expect you to inform the requester, within 20 working days, that you intend to treat the request as a subject access request (SAR) made under the UK GDPR and DPA 2018. You should not require the requester to submit a separate information request. For more information on handling SARs please see our Guide to Data Protection.

Sometimes requests are made for a broad category of information that includes some of the requester’s own personal data together with other information. In this situation, if some of the ‘other’ information is being refused under a different FOIA exemption, it will make sense for the refusal notice to explain that the requester’s own personal data is exempt under section 40(1) FOIA and will be dealt with under the UK GDPR and DPA 2018.

More information about how to deal with a request for personal information can be found in our Guide to Data Protection.

What are the benefits of issuing a good refusal notice?

There are several benefits to providing as much explanation as possible when issuing refusal notices:

You may receive fewer applications for internal review, because the requester will better understand why their request has been.
If the requester does seek an internal review, it will help them explain their grounds for doing so and this can help you when carrying out the review and so lead to stronger outcomes.
This should in turn result in fewer complaints being made to the Commissioner.
If the Commissioner does receive a complaint, your giving a detailed explanation of why you refused the request in the refusal notice, together with a similar high quality explanation of the internal review outcome, may allow the Commissioner to deal more efficiently with the complaint and resolve it sooner.
When investigating a complaint, the Commissioner may consider the quality and timeliness of a refusal notice. The complainant may specifically challenge whether the notice you provided conforms with section 17.
If a decision notice is appealed to the Information Tribunal, the tribunal may consider the quality of the authority’s refusal
It will help the authority to conform to the section 45 code of practice.