House of Commons - Post-legislative scrutiny of the Freedom of Information Act 2000

Post-legislative scrutiny of the Freedom of Information Act 2000 - Justice Committee Contents

4 Delays (section 10) and enforcement (section 77)

Time limits

91. Section 10(1) requires that a response is made to requests "promptly and in any event" within 20 working days. There are no immediate penalties for non-compliance. Section 10(3) allows for an extension of time "as is reasonable in the circumstances."[204] This is generally referred to as the 'public interest' extension as it is used when qualified exemptions are being considered. The Information Commissioner's Office guidance states that this should only apply where the inquiry is "exceptionally complex" and should not be longer than an additional 20 working days.[205] Under section 50, a requester whose application is refused has to wait for the public body to carry out an internal review before the refusal can be appealed to the Information Commissioner.[206] There is no statutory time limit on internal reviews. Guidance in the Code of Practice issued by the Secretary of State under section 45 of the Act states that 20 days is a reasonable time for an internal review.[207] Graham Smith, Deputy Information Commissioner, told that: "We would expect internal reviews to be done within 20 working days; there might be exceptional grounds for extension, but never more than 40 days."[208]

Compliance with time limits

92. Overall users of the Act thought that the 20 day response time was about right "if it were adhered to"[209] although it was somewhat slow for journalism purposes.[210] Sophie Barnes, a journalism student and user of the Act, thought that the 20 day limit was being treated as a "minimum" rather than requests being responded to 'promptly' as the Act requires.[211] Complaints about delays generally occurred in connection with extensions to the 20 day limit and when internal reviews were undertaken. Alex Skene, of WhatDoTheyKnow, told us "one of the biggest complaints that we get from users of our website is about delays to requests."[212] The British Union for the Abolition of Vivisection described delays as "endemic".[213] Media witnesses agreed. The Society of Editors, however, also highlighted the wide variation in responses from different public authorities: "the Act suffers from inconsistency, with a wide spectrum of approaches applied by information controllers. In practice this highlights the intransigence of some set against the good example of others."[214]

93. Public authorities are not required to keep statistics on compliance but they are available for certain sectors. Ministry of Justice statistics show that in 2010 17% of requests to Government departments (4,696 out of 27,290) took more than 20 working days. 12% notified the requester there were grounds for an extension of time, 5% did not.[215] Of the cases to which an extension was applied, 53% were resolved within the ICO 20 day time limit.[216] The remaining 47% took up to 6 months. A few requests appear to have taken longer but records are not kept of requests that take longer than 6 months. The Campaign for Freedom of Information noted that the MoJ described these requests as being answered "in time" simply because the requester was told the request would take longer than 20 days, not because the delay was judged "reasonable in the circumstances".[217]

94. We were pleased to hear relatively few complaints about compliance with the 20 day response time. We believe that the 20 day response time is reasonable and should be maintained.

THE 20 DAY 'PUBLIC INTEREST EXTENSION'

95. Maurice Frankel, of the Campaign for Freedom of Information, told us:

From the start, the public interest extension was misguided. We said so to the Government at the time. I remember an official saying to me, "We have had such a job getting agreement from the Cabinet Committee that we don't dare go back, however good the case for changing anything, because the whole thing will be unstitched. Every agreement we have will be unstitched." That is how it was put in place, and that is how the final Act took its form.[218]

Mr Frankel thought the power to extend the 20 day response time should be limited to "permitting extensions where the request is voluminous and complex, and in particular where the authority has to consult a third party outside—not another public authority but an individual or business that has provided the information—in order to know whether an exemption applies."[219] Graham Smith, Deputy Information Commissioner, told us:

In the original proposals for the Bill there was no suggestion of public interest extensions. They were introduced in debate, primarily because of concerns about the need for third-party consultation in some cases. Reading between the lines, as far as I can judge it, the fact that you were dependent on the responses of the consultees would make it difficult to put a time limit on it. It was recognised that the backstop—this does happen in practice—is that somebody can make a complaint to the Commissioner, saying, "This is all taking too long. Can you hurry it along, please?" If needs be, we can then issue a decision notice; a phone call and a fairly stiff letter to the public authority is usually sufficient, saying, "This is not good enough; please turn this round in the next 20 working days."[220]

96. Mr Smith told us that when the ICO investigated failures to respond it took into account all the circumstances of the case and would hold that a delay was reasonable where, for example, there had been difficulties contacting the third party. He gave the example of a "Government Department where there needed to be consultation with an overseas Government, and they just did not respond. It was a highly sensitive international issue, and the consequence was that the request just did not get dealt with for about a year and a half." Mr Smith thought a framework on the use of the 20 day extension would be helpful because "public authorities were clear as to their obligations [...][and][...] requesters would have a clear expectation of the time that would be taken." Alex Skene noted that there was no power to extend the response time in Scotland which appeared to cause few problems, although fewer public authorities are subject to the Scottish equivalent of the Act.[221]

97. In February 2012, Lord Wills moved an amendment to the Protection of Freedoms Bill which would have permitted one 20 day extension.[222] Lord Wills told the House of Lords that the proposal:

[...] aims to cut down on delays in responding to freedom of information requests, which can often defeat the intent of the legislation. Such delays can be of more than a year. It is in line with the Information Commissioner's guidance that normally an extension should not be needed but where it is, it should not exceed a further 20 working days. Too often, the guidance is ignored. The amendment will make it more difficult to do so.[223]

98. Central Government officials were all opposed to amending the Act by controlling the use of the 20 day time limit. Roger Smethurst, of the Cabinet Office, told us:

Everybody who works on freedom of information in the Cabinet Office—both in my team and across the Department where they are processing the information and doing the public interest test—works on the basis of trying to release what they can and protecting only what needs to be protected. My fear is that, in certain circumstances, if we were to put a time limit on this, then they might err on the side of caution rather than do the job properly.[224]

99. Glenn Preston, of the Ministry of Justice, said that the public interest extension was only used in around 5% of cases: "Of that 5%, I think you are looking at about half that are always dealt with in the additional 20 working days that we apply, which is the good practice guidance that the Ministry of Justice and the ICO publish. If you were to apply a time limit to public interest tests like you describe, then you are talking about that affecting only a really quite small proportion of the total number of requests that Government receive."[225] Marion Furr, of the Department of Health, suggested that changing the regime might mean requests took longer: "Human beings being what human beings are, putting a deadline of 20, 30 or 40 days on something could lead some people to think, "Oh, I've got 40 days to do it", whereas at the moment we say, "You have to do it as quickly as possible." It could become a target rather than a limit."[226]

100. Tracey Phillips, of Lambeth Council, told us that applying the public interest test was rarely problematic: "applying the public interest test is quite bog standard. You use a templated response [...]. It is not used very often, but when it is used, it is the same response."[227]

INTERNAL REVIEWS

101. Mr Frankel supported the introduction of a statutory time limit on internal reviews, as in the Environmental Information Regulations.[228] The Telegraph Media Group told us that the use of internal reviews as an obstacle to delay the publication of information made some journalists feel that they were entering "a war of attrition" with the public body concerned.[229] It also supported the introduction of time limits for internal reviews. The Information Commissioner said that the lack of a statutory time limit for internal reviews was a "weakness" of the Act and made effective enforcement difficult. Noting that "The position under FOIA contrasts with that under the Freedom of Information (Scotland) Act 2002 and under the EIR, both of which provide for mandatory internal reviews with enforceable time limits" the Commissioner said he would "welcome an amendment to FOIA along the same lines to strengthen the current regime."[230]

102. Concerns regarding the imposition of a mandatory time limit for internal reviews were similar to those regarding the public interest extension.[231]

103. It is not acceptable that public authorities are able to kick requests into the long grass by holding interminable internal reviews. Such reviews should not generally require information to be sought from third parties, and so we see no reason why there should not be a statutory time limit—20 days would seem reasonable—in which they must take place. An extension could be acceptable where there is a need to consult a third party.

THE IMPACT OF NON-STATUTORY TIME LIMITS

104. On compliance with the different time limits, Mr Smith told us that performance by authorities was poorer when there was no statutory provision:

When there are quite challenging time limits under the Act, we have found that public authorities will put their efforts into meeting those, and their performance might slip somewhat when it comes to issues that do not have the same direct repercussions because there are no statutory time limits.[232]

105. The Constitution Unit told us its research on central Government suggested that the power to delay together with the fact it holds the information means that: "Despite its evident discomfort at the continuing pinpricks of FOI, the government remains in a very strong position. It holds the information. It can resist disclosure for years if it wants to play the system and fight appeals." Equally, "as in any field of legal regulation, there is scope to game the system. Officials and ministers will play things long if they want to delay disclosure, and they face few penalties for doing so."[233]

Other remedies for non-compliance with time limits

106. The Information Commissioner told us in his written submission that:

[...] the ICO now monitors public authorities which come to its attention for unacceptably poor response times to FOI requests. Formal ICO interventions with 52 public authorities have been made, resulting in significant improvements. Key to this success has been the engagement of top managers at the public authority. Sometimes this has been by way of a personal undertaking to improve performance, as with the Ministry of Defence, Cabinet Office, Birmingham and Wolverhampton City Councils.[234]

107. We heard from three of the monitored bodies in evidence. It was clear all three had taken the Information Commissioner's intervention seriously and had spent time and resources in trying to improve their compliance rates. Birmingham City Council told us that it "required more rather than less resource" to maintain the 85-90% compliance rate the council was now achieving.[235] Roger Smethurst, representing the Cabinet Office, which had the worst record of responding to requests in time of the central Government departments, thought the success of monitoring the Department by the Information Commissioner's Office meant that making the 20 day extension statutory was unnecessary.[236] In evidence, Martin Rosenbaum of BBC News suggested that the Cabinet Office had shown some improvement in response times under monitoring but had then regressed.[237] He also noted that monitoring and enforcement required resources to be spent by the Information Commissioner:

[...] it is important that the Commissioner has a level of resources that enables him to process the complaints that he receives sufficiently quickly, efficiently and effectively so that he can then turn round with confidence and address the public authorities that have been slow. Previously, a lot of them would have been very dismissive of any complaint from the Commissioner, saying, "You are worse than us." As well as the law, there is also the question of the resources that the Commissioner has in order to use his powers and to use them with confidence.[238]

Our predecessor Committee expressed concerns about the limited resources available to the Information Commissioner at the time of the appointment of the present incumbent.[239]

108. Kent County Council was concerned that patchy publication of compliance rates meant the public authorities which released them in the interests of openness and transparency were the ones most likely to be monitored while other "less open and honest" authorities could hide their poor response rates by refusing to put such information in the public domain.[240] Paul Gibbons agreed this was unfair:

The Information Commissioner has indicated that he will keep authorities under review that are regularly failing to meet the requirement to answer requests within 20 working days. However, this will not always be evident as reporting is not consistent. I would suggest that all public authorities be required to publish statistics on FOI compliance, perhaps as part of existing annual reporting processes. This would enable the public to see which authorities are meeting their FOI obligations.[241]

109. We recommend that all public bodies subject to the Act should be required to publish data on the timeliness of their response to freedom of information requests. This should include data on extensions and time taken for internal reviews. This will not only inform the wider public of the authority's compliance with its duties under the Act but will allow the Information Commissioner to monitor those organisations with the lowest rate of compliance.

110. While monitoring of poor-performing public authorities by the Information Commissioner appears to work reasonably well, it requires resources from the Information Commissioner's Office. Greater clarity on time limits and the publication of compliance statistics will allow the Commissioner to target the worst performing authorities and make the best use of limited resources.

111. We recommend the 20 day extension be put into statute. A further extension should only be permitted when a third party external to the organisation responding to the request has to be consulted.

112. We recommend that a time limit for internal reviews should be put into statute. The time limit should be 20 days, as at present under the Code of Practice, with a permitted extension of an additional 20 days for exceptionally complex or voluminous requests.

113. We heard arguments that placing limits on the 20 day extension and making the internal review time statutory might mean that officials working on freedom of information might become more cautious in releasing information or work more slowly. It would be highly regrettable if employees working for public authorities failed to take their duties under the Act sufficiently seriously that they would behave in this way and we expect the leaders of bodies subject to the Act to ensure this does not occur.

114. Resources are always problematic for public bodies, and are particularly so in the current economic climate. We will make recommendations in this report that will bring some measure of relief to organisations. The time frames under the Act are not, however, unreasonable and public authorities have been aware that they must comply with them since the right to access information came into force. Enshrining the time limits in statute merely clarifies the position for both requestors and responders and should make little difference to those bodies operating an efficient freedom of information regime.

INFORMATION COMMISSIONER'S OFFICE APPEALS

115. The Information Commissioner's Office previously had a poor record for responding in a timely fashion to appeals. Martin Rosenbaum, of BBC News, told us:

[The Commissioner's] own record in dealing with complaints [...] used to be absolutely terrible; the delays were worse than anything you would experience from a local authority. In one of my cases, the Commissioner was considering the matter for more than four years before I got a decision.[242]

This had, however, "dramatically improved". Mr Rosenbaum said the effect of the improvement was that public authorities could no longer be "dismissive" of any complaint from the Commissioner on the grounds his office had a worse performance than theirs.[243]

116. The Information Commissioner told us that improving response times to complaints had been a recent focus of the Office and agreed that this had a knock-on effect on public bodies.

We have been able to make the system work much better by reorganising our own systems and being much more efficient, and therefore putting a bit of ginger into the system to make sure that public authorities respond in a more timely way.[244]

The Commissioner told us: "With the case load that we have at the moment [...] we can turn round about 47%—that is the last figure that I saw—of the section 50 business that we get within a month, because it is sometimes simply misconceived or has come to the wrong place; and we can get rid of 75% within three months. We have no cases over a year old, despite the fact that we issued 24% more decision notices this year than last."[245]

Destroying records-enforcement of section 77

117. Section 77 makes the destruction or altering of records with intent to prevent disclosure a criminal offence, punishable by a fine of up to £5000. The offence is summary only which means a charge must be laid within six months of the offence being committed.[246] The NHS Business Service Authority told us that "the ICO does not have sufficient powers to enforce public authority compliance with the act" and that powers similar to those under the Data Protection Act would aid this.[247]

118. The Information Commissioner told us that no one had ever been prosecuted under section 77 of the Act.[248] He explained why:

The reason is because you have to get it to prosecution stage within six months. The matter may not get to the Information Commissioner for some time, and it takes time to investigate the circumstances of the case; and you then have to come up with a case that will survive court action. That is the reason. It is not that we have not seen evidence of obstruction or the destruction of material after requests have been made, but we simply cannot get them to court in time.[249]

The Campaign for Freedom of Information agreed: "The delays which often occur in responding to requests and carrying out internal reviews mean that more than 6 months may have passed before the applicant is in a position to complain to the ICO."[250]

119. The time limits for the offence could be extended in two ways. First, section 77 could be made an 'either way' offence, which means the offender is liable in perpetuity. The Information Commissioner supported this approach:

[...] we believe that that would send a very clear signal that obstructing the operation of the Act or simply responding to a freedom of information request by deleting material is a criminal offence and that there is a credible deterrent penalty for dealing with it.[251]

A summary offence is triable only in the Magistrates' Court which means the maximum sentence that can be imposed is £5000. The Information Commissioner noted that making section 77 an either way offence meant that it could be tried in the Crown Court where an unlimited fine could be imposed:

[...] if you want a fine that will stick—to be dissuasive—you really need to go to the Crown Court. That is why it needs to be triable either way. You get the benefit of the extended time but also the ability to levy a [higher] fine. This is one area where I am not seeking to lock people up; a fine would be appropriate, but the Crown Court could impose an unlimited fine.[252]

120. It was also suggested that section 77 remain a summary offence but the limitation period either be extended or start from the discovery of the offence rather than its commission. The Campaign for Freedom of Information said:

We think it should be possible to prosecute for this offence provided proceedings are brought within 6 months of sufficient evidence of it coming to the prosecutor's knowledge - rather than within 6 months of the offence being committed, provided this is done within 3 years of the offence occurring. The time limit for prosecuting a number of other offences has been extended in this way.[253]

It gave the examples of section 31 of the Animal Welfare Act 2006; section 11A of the Employment Agencies Act 1973 (inserted by paragraph 5 of Schedule 7 of the Employment Relations Act 1999); and section 64A of the Public Health (Control of Disease) Act 1984 (inserted by paragraph 22 of Schedule 11 of the Health and Social Care Act 2008) among others.

121. The summary only nature of the section 77 offence means that no one has been prosecuted for destroying or altering disclosable data, despite the Information Commissioner's Office seeing evidence that such an offence has occurred. We recommend that section 77 be made an either way offence which will remove the limitation period from charging. We also recommend that, where such a charge is heard in the Crown Court, a higher fine than the current £5000 be available to the court. We believe these amendments to the Act will send a clear message to public bodies and individuals contemplating criminal action.

204 Section 10(3) Back

205 Information Commissioner's Office, Freedom of Information Good Practice Guidance No. 4. Time limits on considering the public interest following requests for information under the Freedom of Information Act 2000, February 2007. Back

206 Section 50 Back

207 Information Commissioner's Office, Freedom of Information Good Practice Guidance No. 5 Time limits on carrying out internal reviews following requests for information under the Freedom of Information Act 2000, February 2007 Back

208 Q 218 Back

209 Ev w165 Back

210 Q 192 Back

212 Q 25 Back

213 Ev 115 Back

214 Ev w165 Back

215 Ministry of Justice, Freedom of Information Act 2000, Statistics on implementation in central government, 2010 Annual and Q 4: October- December 2010, April 2011 Back

216 Ibid. Back