ICO Takes Action Against Two Government Departments

Earlier this year the ICO put together a strategic plan titled “ICO25” documenting its objectives for the next three years. This was made available to the public on 14 July 2022. One of the objectives set out within ICO25 is to promote openness and transparency specifically in relation to how public authorities use our data.

The ICO confirmed that they would do the following to ensure that this objective is met:

On 8 September 2022, the ICO published on their website details of enforcement action taken against two Government departments following a freedom of information complaint. This is the first freedom of information enforcement notice issued in 7 years. The ICO is therefore clearly determined to implement what is set out within ICO25.

Department for International Trade Enforcement notice

The ICO has issued an enforcement notice to the Department for International Trade (DIT). The notice confirms that from January to March 2022 DIT issued late responses to over 50% of requests under the Freedom of Information Act 2000 (FOIA). This is a breach of both Section 1(1) and Section 10(1) of the FOIA which set out that a public authority must comply with a request promptly and no later than the 20^th working day following receipt.

Upon investigation, the ICO found that DIT actually had the worst response figure for the whole central Government. It was also found that DIT’s response times had started to decline in 2021 despite there being no significant increase in requests or known issues with resources.

As a result of the above, the ICO issued an enforcement notice. The enforcement notice requires DIT to respond to any outstanding requests (that are older than 20 working days) within 35 calendar days of the enforcement notice. The notice also requires DIT to devise and publish an action plan formalising measures to mitigate any further delays. If DIT fails to comply with the enforcement notice it could be found to be in contempt of Court.

Department for Business, Energy and Industrial Strategy practice recommendation

The ICO has issued a practice recommendation to the Department for Business, Energy and Industrial Strategy (BEIS). The ICO found that BEIS had consistently failed to respond to a significant number of information access requests within the statutory time limit. Unlike DIT, BEIS had received a 55% increase in requests since 2020 which could explain the drop in response time.

Following a discussion with BEIS, the ICO found that the drop in response time was down to BEIS’s own internal procedures in addition to an increase in requests. Although the ICO concluded that BEIS practices did not conform with the FOIA, it took into account the mitigations highlighted by BEIS and the positive engagement it had with the ICO. As a result, the ICO issued a practice recommendation rather than an enforcement notice.

The practice recommendation sets out the steps that should be taken by BEIS, which include preparing an action plan detailing how it will improve its performance. It is important to note that a practice recommendation is not enforceable. It is issued under Section 48(1) of the FOIA. If performance does not improve following the issue of a practice recommendation, the ICO can then issue an enforcement notice.

Comment

The issuing of the enforcement notice and practice recommendation (and publishing these on their website) is one of the first steps the ICO has taken to implement ICO25. I suspect over the next three years we will see many more public authorities issued with enforcement notices and/or practice recommendations.

The UK Information Commission, John Edwards has published a statement following the above which sheds some light on the ICO’s thinking behind the issuing of the enforcement notice and practice recommendation. John Edwards has commented as follows: