OG 736-2 Reviews of Freedom of Information Act (FOI) Requests and Data Protection Act Subject Access Requests (SAR)

Last reviewed:
17 April 2013
Last updated:
31 December 2013

Policy Statement/Overview

The Commission aims to deal with all FOI/SAR requests correctly on the first occasion. However sometimes, for whatever reason, the applicant may not be satisfied with our response. This is where our FOI/SAR decision review procedures come in. It is usually mandatory for applicants to seek an internal review of our response to an FOI/SAR request before they can challenge our decision to the Information Commissioner.

Summary of the guidance

This guidance provides information about review of a decision about what information we will provide under either the Freedom of Information Act 2000 or the Data Protection Act 1998 and explains the procedures for staff involved in dealing with FOI/SAR decision reviews. The series sets out:

  • What types of decisions can be reviewed under the FOI/SAR review process
  • Who can request an FOI/SAR review and how they can make their request
  • How the Commission will conduct an FOI/SAR review
  • The outcomes and remedies which may result from an FOI/SAR review
  • The alternative remedies which might be available to applicants
  • How we obtain and use feedback to monitor performance and improve our services

This guidance relates to reviews of FOI and SAR requests only.

Casework Guidance

B1 What is an FOI/SAR review and what are the key points I need to know?

 

B1.1 What is an FOI/SAR review?

An FOI/SAR review is a reconsidertion of the Commission's original decision in relation to an FOI/SAR request. The FOI/SAR review process enables the Commission to look again at the request and make a new decision using all the existing relevant information held and any new information received during the procedure. The review is not limited to the reasosn given by the applicant, but the points raised by the applicant should always be considered.

 

B1.2 Which decisions can be reviewed?

Any decisions about what information the Commission will provide under the Freedom of Information Act 2000 or Data Protection Act 1998 can be subject to review.

 

B1.3 Who can request an FOI/SAR review?

We will usually only accept an application for an FOI/SAR decision review from the person who made the original application.

An advocate or representative may request a review on an applicant’s behalf, but if they are not a professional representative such as a lawyer, we should ask the applicant for written confirmation that they have appointed an advocate or representative to act on their behalf.


B1.4 What are the time limits for requesting an FOI/SAR Review?

We will accept requests up to a maximum of 3 months after the original decision. The 3 months will be calculated from the date of the written notification to the customer, regardless of whether it is sent by email or post (unless the email was sent after 5pm, in which case it will be deemed to have been sent the following day).

In exceptional circumstances and where we think it would be fair to do so, we will accept requests for a decision to be reconsidered outside the 3 month time limit. We would need to understand the reason for the delay and consider any compelling reasons why we should accept requests outside of the time limit. Examples of reasons include:

  • there may be a proven delay in the customer receiving writen notice, for example as a result of a postal strike;
  • the applicant may not have had access to legal advice within the timeframe;
  • the customer or a close relative may have been seriously ill in hospital; or 
  • religious celebrations or festivals mean that the customer is unable to respond within the time limit.

The Litigation & Review Case Officer is responsible for deciding whether or not to accept an application for a Decision Review outside of the time limit, taking legal advice as appropriate.

B1.5 Our approach to dealing with FOI/SAR reviews

Fairness will usually require that the review process set out in this OG should be followed carefully. However, on occasion, it may be appropriate  to adopt a different approach. For example, where a request for review is supported by significant relevant material and argument that was not provided to the original decision maker, it may be more expedient in the circumstances of that case for the original decision maker to consider the new information afresh.

Our published guidance for service users gives the Commission flexibility to consider first whether a review is the appropriate course of action in the circumstances. The Litigation & Review Case Officer will consider whether an alternative course of action is fairer in the circumstances of the case. Relevant considerations should include:

the extent of any additional evidence or arguments not previously considered;

  • the extent of any additional evidence or arguments not previously considered;
  • whether the request for review is in fact a request for additional information;
  • whether the request for review is a complaint about the service provided rather than the decision made.

A proposal to depart from the procedures set out in this OG must be explained to the applicant and the reasons for doing so must be recorded.

B1.6 Who is responsible for the FOI/SAR review?

The Litigation & Review Team is responsible for the effective management and administration of FOI/SAR reviews and Board level decisions.  Responsibility for conducting the case and ensuring its satisfactory and timely conclusion rests with the decision reviewer, who will usually be a Commission lawyer. 

The timescales for conducting FOI/SAR decision review are very tight. The Information Commissioner’s office expects us  to deal with reviews in the same timescales as for the original request where possible. This means 20 working days for FOI reviews and 40 days for SAR reviews (see below).

If you are asked to participate in an FOI/SAR decision review, it needs to be one of your top priorities. If you know that you are going to be taking leave during the decision review period which will interfere with your ability to carry out your part of the process, you should let the Litigation and Review Team know as soon as possible so that alternative arrangements can be made.

The member of staff who dealt with the original request should have collated all of the information falling within the scope of the request and prepared a schedule detailing the information and any exemptions relied upon to withhold anything. As the number of FOI requests received by the Commission is significant, this is not always possible. Should the collating and scheduling of the information not have been prepared prior to the FOI/SAR decision review, it is still the responsibility of the original decision maker and not the reviewer to carry out this work. The reviewer should liaise with the original decision maker in this regard. A template schedule is available from the Litigation and Review Case Officer.

If you are unsure about any of the steps in the process, you should check with the Litigation and Review Team.

Top of page

 

B2 - Reviews of our response to a request for information made under the Freedom of Information Act 2000

B2.1 Process for handling FOI decision reviews

The Freedom of Information Act 2000 lays down certain obligations in the way in which we must deal with requests for information. There is a Code of Practice issued by the Secretary of State for Constitutional Affairs on the discharge of public authorities’ functions under Part I of the 2000 Act, issued under section 45 of that Act. Reviews of our response to a request for information made under the Freedom of Information Act 2000 should be conducted in accordance with the Code of Practice.

When we receive an application for a review of a response to a request for information made under the Freedom of Information Act 2000, First Contact will assign the request to the Litigation & Review Team. The Litigation & Review Case Officer will make an initial assessment of the request and complete a risk assessment.

The Litigation & Review Case Officer will send a briefing note to the Head of Legal (Liverpool) with recommendations for how the review will be conducted.  In most cases, the Head of Legal will nominate a reviewer (usually a Commission lawyer) to conduct the review.  However, if the review is assessed as high risk, or the circumstances of the case are exceptional, the review may be conducted by a Board member (or panel consisting of a Board member). In such cases the Chief Legal Adviser and Commission Chair will be consulted about the appointment of the reviewer.

The officer or panel nominated to conduct the review should examine the information previously provided to decide:

  • whether we were entitled to withhold any information in the original response;
  • whether our decision to withhold information in our original response was correct in the circumstances; and
  • whether there are any factors that enable us to release the information originally withheld, either in full or in part.

The review should be a fair and thorough review of handling issues and of decisions taken pursuant to the 2000 Act. This includes decisions taken about where the public interest lies in respect of exempt information. It should enable a fresh decision to be taken on a reconsideration of all the factors relevant to the issue.

Once the review is complete, the reviewer or lawyer advising the review panel should write to the applicant to tell them the Commission’s final decision and the reasons for it. If the reviewer or panel decides that additional information can be released to the applicant, this should be included with the final decision. However, if the information is voluminous or further work is needed to collate the information, it may be sent separately, and the applicant advised of the timescale within which it will be sent.

Timeframe to complete a review of a Freedom of Information decision

Although the Code of Practice does not say how quickly reviews must be dealt with, the Information Commissioner considers that a reasonable time for completing reviews is 20 working days, unless there are exceptional circumstances.

We aim to complete all reviews of our response to a request for information made under the Freedom of Information Act within 20 working days, unless there are exceptional circumstances (for example, if we need to consider the public interest test) in which case we will aim to complete the review within 30 working days. In all cases, reviews should take no longer than 40 working days.

The Litigation & Review Team should tell the applicant how long the review is expected to take and update the applicant if the timeframe changes.

Outcomes

The final decision is the end of the decision review process.  If the applicant is not satisfied with the decision reached, their next step will be to approach the Information Commissioner.

 

B2.2 Reviews of our response to a Subject Access Request made under the Data Protection Act 1998

The Data Protection Act 1998 gives individuals a right of access to the personal data which organizations hold about them, subject to certain exemptions. Requests for access to personal data are known as subject access requests.

When we receive an application for a review of a response to a Subject Access Request, First Contact will assign the request to the Litigation & Review Team. The Litigation & Review Case Officer will make an initial assessment of the request and complete a risk assessment.

When considering whether to accept a request for a review of a SAR, the default position is that the review should be accepted unless there is a good reason not to. Reasons to refuse a review may include cases where the request for review:

  • contains substantial additional information which was not included in the original request;
  • is a complaint about a service provided and not a request for a review of our decision (such cases should be referred to Business Assurance to deal with as a Stage 1 complaint);
  • is a request for additional information;
  • is a request for clarification rather than a review of our decision.

The Litigation & Review Case Officer will send a briefing note to the Head of Legal (Liverpool) with recommendations for how the review will be conducted. In most cases, the Head of Legal will nominate a reviewer (usually a Commission lawyer) to conduct the review. 

The officer nominated to conduct the review should examine the information previously provided to decide:

  • whether we were entitled to withhold any information in the original response;
  • whether our decision to withhold information in our original response was correct in the circumstances; and
  • whether there are any factors that enable us to release the information originally withheld, either in full or in part.

 

The review should be a fair and thorough review of handling issues and of decisions. It should enable a fresh decision to be taken on a reconsideration of all the factors relevant to the issue.

Once the review is complete, the reviewer should write to the applicant to tell them the Commission’s final decision and the reasons for it. If the reviewer decides that additional information can be released to the applicant, this should be included with the final decision.  However, if the information is voluminous or further work is needed to collate the information, it may be sent separately, and the applicant advised of the timescale within which it will be sent.

Timeframe to complete a review of a Subject Access Request

We aim to complete all reviews of our response to a Subject Access Request within 40 days, unless there are exceptional circumstances.

The Litigation & Review Team should tell the applicant how long the review is expected to take and update the applicant if the timeframe changes.

Outcomes

The final decision is the end of the decision review process. If the applicant is not satisfied with the decision reached, their next step will be to approach the Information Commissioner.

Top of page  

B3 The Information Commissioner

The Information Commissioner’s Office (ICO) is the independent statutory body which regulates the operation of the Freedom of Information Act (as well as the Data Protection Act). If a service user remains dissatisfied with our decision at the end of an FOI/SAR  Review, they may approach the ICO.

Model wording explaining the option to approach the ICO should be included with the decision following a Freedom of Information Decision Review. Model wording can be found under the Model Letters and Orders tab.

Information Commissioner’s Office

Email: casework@ico.gsi.gov.uk

Website: http://www.ico.org.uk/

Write:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Telephone 0303 123 1113

Top of page

Charts

g736c002 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

g736c002b

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Top of page 

Model Letters and Orders

If you remain unhappy with the decision you may apply to the Information Commissioner for a decision. The Information Commissioner can be contacted at:

 

The Information Commissioner's Office
WycliffeHouse
Water Lane
Wilmsow
Cheshire
SK9 5AF

 

Tel: 01625 545 745

Fax: 01625 524510

email: enquiries@ico.gsi.gov.uk