In the last couple of years the approach by the Information Commissioner’s Office (ICO) to Freedom of Information Act 2000 (FOIA) regulation and enforcement has greatly improved. Kudos to the Commissioner, John Edwards, Warren Seddon, Director of Freedom of Information and Transparency and all the other people who’ve contributed to the improvement.
But what the increased focus on public authorities’ performance is showing is how poor, in many cases, it is: in particular, many public authorities are failing – whether through lack of resource, or lack of concern (or a combination of both) – to comply with statutory and guideline timescales for compliance. It’s evident that more could (and should) be done.
Parts 8.5 and 8.6 of the 2018 Code of Practice, issued by the Cabinet Office under section 45 of FOIA, says that public authorities with over 100 Full Time Equivalent (FTE) employees should, as a matter of best practice, publish on a quarterly basis, details of their FOIA compliance. The information should include:
The number of requests received during the period;
The number of the received requests that have not yet been processed;
The number of the received requests that were processed in full (including numbers for those that were met within the statutory deadline, those where the deadline was extended and those where the processing took longer than the statutory deadline);
The number of requests where the information was granted in full;
The number of requests where the information was refused in full; The number of requests where the information was granted in part and refused in part;
The number of requests received that have been referred for internal review (this needs only reporting annually).
Such statistics were meant to extend to the wider the public sector the performance data reporting by central government.
However, six years on, in my experience and to my knowledge, very few public authorities who are meant to be doing this are in fact doing so – including, as far as I can ascertain, the ICO itself.
I have three suggestions.
- The ICO should start to compile and publish this information (if it doesn’t lead by example, it can hardly criticise other public authorities for failing to publish).
- The ICO should write an open letter to all public authorities with more than 100 FTE staff, asking them to write to the ICO advising whether they are complying with parts 8.5 and 8.6 of the Code, and if they are not, whether they are taking steps to. (I bear in mind that the ICO will not know which public authorities have not than 100 FTE staff, which is why it might need to be an open letter). In the event of future FOI complaints about performance, the ICO could then have regard to whether or not (or how) a public authority had responded to the open letter.
- If – as I suspect – there is, or comes to be, a widely held view that the requirements of parts 8.5 and 8.6 of the Code are too onerous for many public authorities, then consideration should be given by the Cabinet Office, in consultation with the ICO, to issuing a new/revised Code (section 45 empowers the Minister for the Cabinet office to issue, or revise, the Code “from time to time”).
It can be in no one’s interests – not public authorities’, not the ICO’s and not the public’s – to have a Code of recommended good practice which is simply ignored by many. If it’s ignored because its requirements, if followed would impose too great a burden, then get the thing changed. But – also – make sure that any revisions still address the need for better data on performance than currently exists.
The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.