The Freedom of Information Act 2000 provides public access to information held by public authorities. The act does this is two ways: public authorities are obliged to publish certain information about their activities and members of the public are entitled to request information from public authorities.
Public authorities, maintained schools, trusts and academies are required to respond to requests for information they hold under the Freedom of Information Act 2000 (FOIA). This generally covers information that is not the personal data of the person who is making the request (this type of request will be handed under the requirements of GDPR).
What is the difference between the Freedom of Information Act and GDPR?
When someone’s makes a request for their own information, this is a data protection subject access request. However, members of the public wrongly think it is the FOIA that gives them the right to their personal information, so you may need to clarify things when responding to a request.
The UK GDPR protects people’s right to privacy, whereas the Freedom of Information Act is about getting rid of unnecessary secrecy.
Who does the freedom of information act apply to?
The act applies to any public authority, including government departments, local authorities, the NHS, state schools and police forces. It however does not cover every organisation that receives public money. For example, charities that receive grants or certain private sector organisations that perform public functions.
What steps should be taken when receiving a request?
- Check you have received a valid request: The request should be received in writing, which could include printed documents, computer files, letters, emails, photographs and video recordings. It should include the name of the person making the request, and provide a correspondence address, for instance an email address.
- Acknowledging the request: On receiving a request you should indicate you will respond to it under the FOIA and letting the requester know the latest day by which you will provide a response. You will then need to consider how long it will take to respond to the request, you can seek to charge a fee, based on the estimate. You can refuse the request or ask the requestor to refine their request.
- Responding to a request: Once the initial steps have been considered and you have located the information, or established that you do not hold the information, you need to provide a formal response. Letting the requestor know that you don’t have the information or that someone else holds the information they require. There is no requirement to create the information if you do not hold it.
How long should you take to respond to a request and are there any penalties?
The time limit for responding for schools, banks and hospitals is up to 20 working days, counting the first working day after the request is received as the first day. For schools the standard time limit is 20 school days, or 60 working days if this is shorter.
There are no financial or custodial penalties for failure to provide information on request or for failure to publish information. But you could be found in contempt of court for failing to comply, with a decision notice, enforcement notice, or information notice. This could lead to a fine or jail for a senior officer of the authority.
