Written evidence from The Information Commissioner’s Office (FOI 46)

 

Public Administration and Constitutional Affairs Committee

The Cabinet Office Freedom of Information Clearing House inquiry

 

Summary

The Cabinet Office FOI Clearing House (the Clearing House) has been in operation, and has been public knowledge, since the implementation of the Freedom of Information Act 2000 (FOIA) in 2005. More recently, the Clearing House has been the subject of regulatory action by the Information Commissioner’s Office (ICO) and an associated Information Tribunal ruling, as well as attracting significant media interest.

In May 2021, the Commissioner recommended to the Cabinet Office that an audit using her statutory powers under FOIA could provide an independent view of compliance with the legislation and statutory codes. She believes that this audit, by the regulator responsible, would provide public assurance about the role of the Clearing House. The Cabinet Office declined this recommendation and instead opted for an internal assessment as set out in the Cabinet Office Minister’s recent letter to the Committee.

The Commissioner can only conduct an audit under FOIA with the consent of the public authority. She considers this at odds with her parallel provisions in the data protection legislation and would welcome support from the Committee for her powers of audit under FOIA to be strengthened by aligning them with her data protection remit.

More generally, the Commissioner considers that more than 20 years after the passing of FOI legislation it would be timely to undertake a comprehensive review of its operation in the context of modern government operations and decision making.

The Cabinet Office’s handling of information requests is mixed. It is the most complained about public authority to the ICO with respect to FOIA, with a significantly higher number of complaints than other central government departments. Furthermore, the ICO has previously identified unacceptable delays in the Cabinet Office’s handling of requests in some cases.

There has, however, been considerable improvement in Cabinet Office engagement with the ICO and in its overall performance over the past 12 months, despite the challenges posed by the COVID-19 pandemic. The Commissioner has been reassured in some respects by the Cabinet Office’s more proactive approach to engagement with her office as well as the improving response rate and its stated commitment to further performance improvement.

About the Information Commissioner

The Information Commissioner has responsibility in the UK for promoting and enforcing FOIA, the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), the Environmental Information Regulations 2004 (EIR) and the Privacy and Electronic Communications Regulations 2003 (PECR), amongst others.

The Commissioner is independent from government and upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals. The Commissioner does this via her office, the ICO, by providing guidance to individuals and organisations and taking appropriate action where the law is broken. The ICO is funded for its FOIA and EIR work via Grant-in-Aid from the Department for Digital, Culture, Media and Sport (DCMS).[1]

The Information Commissioner delivers her duties under FOIA and EIR in a number of ways, including by: issuing guidance on how to apply the legislation correctly; considering complaints under the legislation and issuing decision notices about whether the request has been dealt with in accordance with it by the public authority; and by auditing compliance with the provisions of the legislation.

In the last year[2] for which figures are available the ICO received 4853 FOIA and EIR complaints, resolved 1155 of these informally (often by agreeing disclosure with the authority) and issued 1062 decision notices of which 730 did not find in favour of the public authority, either in whole or part, including decisions which required provision of the information to the applicant.

Introduction

The ICO welcomes the opportunity to respond to this House of Commons Public Administration and Constitutional Affairs Committee call for evidence on the Cabinet Office’s compliance with and implementation of FOIA and the role and operation of the Clearing House.

The ICO is well-placed to contribute to this inquiry given its role as the independent body regulating FOIA compliance and the regulatory action it has been engaged in regarding the Clearing House to date.

The Clearing House

The Clearing House is not a recent development but has been in existence since the implementation of FOIA in 2005.[3] Its role has been public knowledge since its inception and was, for example, considered by Parliament in the then House of Commons Constitutional Affairs Committee report ‘Freedom of Information – One Year On’.[4] From time to time since its introduction, however, concerns have been raised, including in the media, about the Clearing House arrangements.

Some of the most recent reporting about the Clearing House has centred around a recent ICO Decision Notice[5] and associated Tribunal ruling[6] about its operation. In this case a request was made, in August 2018, to the Cabinet Office to obtain a copy of the “Round Robin” lists circulated by the Clearing House between June and August 2018.

The Cabinet Office refused to disclose, citing FOIA exemptions, and maintained this position following an internal review. The requestor subsequently appealed the outcome to the ICO, which issued a Decision Notice and concluded that the Round Robin lists should be disclosed.

The Cabinet Office initially appealed this decisions, before later releasing 145 of 159 entries of advice a month before the appeal hearing and conceding that this information should have been released at the time of the internal review. The Tribunal allowed the appeal in relation to only certain items from the remaining 14 entries and the Commissioner did not contest this decision.

Auditing the role of the Clearing House

Following recent reporting about the role of the Clearing House and the case outlined above, the ICO recommended to Cabinet Office officials an audit using statutory powers to assess compliance with FOIA and its Codes of Practice.

An audit would allow for a more comprehensive assessment than would be possible under the Commissioner’s other investigatory tools. This would help identify improvements that could be made and provide public assurance about the role of the Clearing House.

Unlike its statutory powers under the DPA 2018 where the ICO has compulsory audit powers, the ICO can only undertake voluntary audits under FOIA. Despite raising this option in May and following up subsequently with formal correspondence and further meetings to outline how an audit could work in practice, the Cabinet Office instead informed the Commissioner on 14 September that it had opted for an internal assessment of the Clearing House as set out in the Minister’s recent letter to the Committee.[7]

In the Commissioner’s view, the voluntary FOI audit arrangement is at odds with her powers under the DPA 2018 and provides weaker oversight for access to information arrangements than are enjoyed by other information rights. As a result, the Cabinet Office is free to self-regulate despite major public concerns about its compliance with FOIA. The ICO would therefore welcome consideration by the Committee of its powers of audit under FOIA being brought into line with its powers under the DPA 2018.

Cabinet Office performance

Before the current FOI team at the Cabinet Office was put in place around a year ago, the ICO experienced persistent compliance and engagement issues with the Cabinet Office. These shortcomings manifested themselves in additional delays in the handling of requests at various stages, and it was essential these issues were addressed.

The consequent impact on the progress and length of Cabinet Office investigations was identified by complainants, particularly journalists, who expressed concern that delays in complaint resolution can mean the public interest currency of information requested can be diminished or lost.

We have summarised a ‘deep dive’ that the ICO conducted into Cabinet Office’s performance in 2019 following the concerns noted above. Performance is assessed on the basis of: the volume and proportion of complaints escalated to the ICO; the timeliness of responses to requests; the degree of compliance with ICO correspondence about complaints; and the degree of compliance with the legislation evidenced in the handling of original requests.

2019 ‘Deep Dive’

This work was conducted in August 2019 and examined Cabinet Office cases referred to the ICO between January 2018 and July 2019. 

Of the 127 Cabinet Office cases accepted by the Commissioner for investigation, 57 included section 10 (or EIR Regulation 5) breaches, i.e. the Cabinet Office had failed to provide a response to the request within the statutory timeframe[8].  Where required to do so, the Commissioner issues section 10 decision notices in non-response cases.

95 of the 127 cases included requests for internal reviews. The Commissioner’s guidance to public authorities states that a maximum response time of 40 working days is permissible for such reviews in exceptional cases (e.g. where the public interest arguments are particularly complex or where third parties need to be consulted). Of the applicable 95 cases, 49 were completed in 40 working days or less, and 46 took longer than 40 working days.

Once the Commissioner begins a substantive investigation into a Section 50 (FOIA) complaint, her standard and well-established practice, where written representations are required, is to provide a public authority with 20 working days in which to respond.

Of the 127 Cabinet Office cases for the relevant period, 70 proceeded to substantive ICO investigation. These are valid cases which are not simply procedural breach cases (e.g. non-response complaints) but cases involving consideration of one or more FOIA exemptions/EIR exceptions or determining whether the requested information is held by the Cabinet Office

Of those cases, the Commissioner received 15 submissions within the 20 working days period allotted, whereas 55 submissions took longer than 20 working days to be provided. Of the 70 substantive investigation cases, 15 required the Commissioner to issue a formal Information Notice due to the Cabinet Office failing to provide a response at all. Of the 15 Information Notices, only eight were complied with in time.

41 formal Decision Notices were issued by the Commissioner in the 127 cases (including those cases involving procedural breaches of section 10 of the Act) of which 26 required the Cabinet Office to take steps. The Cabinet Office was late complying with 10 of the 26 cases.

The Commissioner recognises and appreciates that in cases involving sensitive or security related matters, or complex/voluminous cases and those requiring extensive consultation, it may sometimes be difficult for the Cabinet Office to provide the ICO with submissions within the standard 20 working days timescale. Many Cabinet Office cases are of this nature. 

However, until relatively recently (late 2020) in those cases and even more straightforward ones, the Cabinet Office routinely failed to inform the allocated ICO case officer in good time of any delay and/or failed to provide the case officer with a realistic timescale for responding in full.

More recent complaints to ICO

In respect of FOIA and EIR casework, the Cabinet Office is presently the most complained about public authority to the ICO, with a significantly higher number of complaints than other central government departments despite receiving comparably lower levels of requests (see Annex One). It has been in the top five bodies complained about for the last three years. In 2020/2021, the ICO received 181 complaints about the Cabinet Office, with the second highest number being 130 for the Department of Health and Social Care (DHSC) and third highest 111 for the Home Office. 

This pattern has continued into 2021/2022, with (as at the end of July) the ICO having received 78 complaints about the Cabinet Office, with the joint second highest being 49 complaints for the Ministry of Justice and DHSC. 

These figures need to be understood in context however. To some extent they reflect the nature of the information which the Cabinet Office holds and is requested, in terms of breadth, sensitivity, topicality and high public profile, and the greater likelihood of such information (legitimately) attracting exemptions within the legislation which requestors then choose to challenge. It is the Commissioner’s view that the high number of Cabinet Office complaints to the ICO are not directly attributable simply to performance issues. 

It is also important to emphasise that the ICO is aware that it only sees a small percentage of the total number of FOI requests made to the Cabinet Office (i.e. those which have been subject of complaint to the ICO), which may suggest that the majority of requestors are satisfied with the handling of their requests.

Timeliness of response to original request

The Cabinet Office’s overall FOIA timeliness performance, as set out in the quarterly Central Government FOI statistics (published by the Cabinet Office)[9], compares favourably with other central government departments, consistently recording timeliness compliance statistics above 90%. 

Responsiveness to ICO

There has been a considerable and sustained improvement in Cabinet Office engagement with the ICO over the last 12 months, at a time when it has faced the unprecedented resource and staffing challenges posed by the COVID-19 pandemic. 

In contrast to the general situation prevailing in 2019, the Cabinet Office now has in place an FOI team who are readily accessible and responsive to ICO case officers. Where extensions of time are required in order to respond to an investigation, better quality submissions are now received and these are now almost always requested in good time, with the Cabinet Office explaining the reason for the extension and providing a generally reliable estimate for a response.

Where supplemental submissions or information are needed to consider a case, these are now almost always provided by the Cabinet Office without the need for chasing by ICO case officers or formal steps such as the issuing of an Information Notice[10].

The Cabinet Office has also demonstrated increased and proactive engagement in procedural cases (generally, where a request for information has not been responded to), requesting only short extensions from the ICO and then meeting those extensions, avoiding the need for a formal Decision Notice.

The Cabinet Office’s increasing willingness to consider informal resolution of complaints has also been a welcome change in approach. This is where a public authority agrees to take action on the basis of the ICO’s views without being formally required to do so. The effective communication channels that now exist between the Cabinet Office FOI Team and ICO case officers have provided scope for more flexibility and pragmatism in the resolution of such complaints.

Compliance with the legislation

Whilst the improvements in ICO engagement by the Cabinet Office have been considerable, the Commissioner has yet to see satisfactory and sustained improvement in some aspects of the Cabinet Office’s FOI request handling.

For example, based on the complaints which we have received, the ICO has identified a succession of FOI responses to requestors which appear to have only met the statutory timeframe at the expense of response quality and accuracy.

This includes responses that have applied qualified exemptions that frequently employ generic arguments, with little, if any, evidence that the public interest attached to the specific requested information has been considered. 

For example, in one case where the information requested was a copy of a Cabinet Office presentation concerning ‘Reasonable Worst Case Scenario Planning Assumptions to support civil contingencies planning for the end of the Transition Period’, the Cabinet Office applied Section 35 to withhold the information but made no reference to the actual information, simply stating that disclosure ‘would weaken Ministers’ ability to discuss controversial and sensitive topics free from premature public scrutiny’

The public interest test was similarly generic, making no reference or acknowledgement of the specific information requested. The subsequent internal review was unsatisfactory and inadequate, as it simply upheld the original decision in less than five lines. 

This is particularly disappointing given The Independent Commission on Freedom of Information has stressed the need for public authorities to identify the specific harms that would occur from disclosure when advancing public interest arguments.[11]

Until very recently, the quality of Cabinet Office internal reviews seen by the ICO were frequently inadequate. Reviews often amounted to no more than a few sentences, with most of this simply repeating the request and the original response. They were cursory, rarely engaged with points made by the requestor, and showed no evidence of being a genuinely independent review of the original response. 

Internal reviews of this nature are counter-productive as they increase the likelihood of a complaint being made to the ICO, resulting in greater expenditure of time and resources by the Cabinet Office. This has, however, been recognised by the Cabinet Office, which has advised the ICO that it is implementing internal process changes to improve the quality of its front-end service, including internal reviews.

The ICO is beginning to see noticeable improvement in some of the most recent internal reviews we have seen, both in terms of detail and quality. This is to be welcomed and the ICO expects this improved approach taken to internal reviews to continue over a sustained period.

The quality and accuracy of some request responses provided by the Cabinet Office remains unsatisfactory. For example, in some cases the Cabinet Office has stated it does not hold the requested information, only for it to subsequently transpire during the ICO’s investigation that it does. 

In other cases, information has been initially withheld under a substantive exemption only for the Cabinet Office to later instead rely on the costs provision (section 12) to refuse the request. Such cases are evidence of insufficient care and attention being taken when processing a request, both upon initial receipt and at internal review.

Inevitably, this erodes complainant trust and confidence in the reliability and integrity of the response. However, the Cabinet Office has indicated it is devoting more attention and resource to its consideration of requests to avoid this.

The ICO remains concerned by the length of time taken by the Cabinet Office to provide a request response in some cases, particularly those involving consideration of the public interest test. In such cases, section 10(3) of the FOIA allows a public authority an extension of time to provide a response which is ‘reasonable in the circumstances’

However, the Commissioner would not consider delays of between three to six months reasonable. These excessive delays are not rare in Cabinet Office cases seen by the ICO.

For example, the ICO’s lead Senior Case Officer for Cabinet Office complaints considered 36 Cabinet Office cases between April and September 2021 (for requests made mainly during 2020). In 9 of those cases, the Cabinet Office took longer than three months to provide a substantive response to the request, and in three of those cases the Cabinet Office took longer than six months to provide the response (one of those cases requiring a formal decision notice from the Commissioner to provide a substantive response). Even making due allowance for the constraints and pressures imposed by the COVID-19 pandemic, these delays were excessive.

It is important to note that the Commissioner does not often find against the Cabinet Office on substantive issues in relation to the use of exemptions. The Cabinet Office has also improved how it engages with the ICO in informal resolution. As a result, it is only a minority of complaints that require the ICO to issue a decision notice[12]

So overall it is fair to say the Cabinet Office do not often ‘get it wrong’ on the substance, although it remains the case that some delays in request handling are so significant – often longer than three months – that they are unacceptable.

Conclusion

The Commissioner’s view on the overall compliance picture at the Cabinet Office itself is that its performance has improved significantly over the last 12-18 months. The current team that is in place have clearly worked hard to achieve this. There remain some areas where improvement is relatively recent and needs to be sustained, particularly in relation to internal reviews and the quality of arguments that are submitted on some cases to the ICO. The level of engagement we now see from Cabinet Office, however, suggests this will be the case.

It is more difficult to draw conclusions on the impact the role of the Clearing House has on the handling of requests more broadly across Government, however. Despite some recent improvement in this area following media reports, engagement with the ICO and the recent Tribunal Case, there is a lack of transparency over its role and it is not routinely evident to the ICO where the Clearing House may have been involved in a complaint to help any robust conclusions about its impact to be drawn.

The offer of an audit by the Commissioner would have helped provide independent assurance of the role of the Clearing House. It is unsatisfactory that the regulator must seek permission from those regulated before conducting activity of this nature when there is evidence of clear public concern. This is outdated and is an example of how the legislation as a whole would benefit from a broader review of its operation to ensure it is modernised and brought in line with other information rights legislation.

 

October 2021

 

 

Annex One

FOI/EIR most complained about departments by financial year

Received in 2021/22 (as at 1st August)

Submitted About Account

Number of Complaints

 

Cabinet Office

78

 

Ministry of Justice (MoJ)

49

 

Department Of Health & Social Care (DHSC)

49

 

Secretary of State for the Home Department (Home Office)

47

 

Secretary of State for Defence (Ministry of Defence)

24

 

HM Treasury

19

 

Department for Business, Energy & Industrial Strategy (BEIS)

18

 

Ministry of Housing, Communities and Local government (MHCLG)

14

 

Department for Work and Pensions (DWP)

14

 

HM Revenue and Customs (HMRC)

12

 

Department for Digital Culture, Media and Sport (DCMS)

11

 

Department For Education (DFE)

8

 

Department for International Trade

7

 

Foreign, Commonwealth and Development Office

15

 

Department For Transport

6

 

 

Received in 2020/21

Submitted About Account

Number of Complaints

Cabinet Office

181

Department Of Health & Social Care (DHSC)

130

Secretary of State for the Home Department (Home Office)

111

Ministry of Justice (MoJ)

99

Department for Work and Pensions (DWP)

94

Secretary of State for Defence (Ministry of Defence)

61

HM Revenue and Customs (HMRC)

35

Department for Business, Energy & Industrial Strategy (BEIS)

30

Department For Education (DFE)

28

Foreign, Commonwealth and Development Office (FCDO)

33

Ministry of Housing, Communities and Local government (MHCLG)

19

Department For Transport

18

HM Treasury

18

Department for Digital Culture, Media and Sport (DCMS)

18

Department For Environment, Food And Rural Affairs (DEFRA)

15

Department for International Trade

14

 

 

 

 

Page 10 of 10

 


[1] Commissioner’s annual report 2020/21, page 128: hc-354-information-commissioners-ara-2020-21.pdf (ico.org.uk)

[2] Commissioner’s annual report 2020/21, page 42: hc-354-information-commissioners-ara-2020-21.pdf (ico.org.uk)

[3] Cabinet Office and Freedom of Information - GOV.UK (www.gov.uk)

[4] 991.pdf (parliament.uk)

[5] https://ico.org.uk/media/action-weve-taken/decision-notices/2020/2618028/fs50841228.pdf

[6] EA/2020/0240 Cabinet Office v Information Commissioner and Jenna Corderoy

[7] https://committees.parliament.uk/publications/7145/documents/75490/default/

[8] https://ico.org.uk/media/for-organisations/documents/1165/time-for-compliance-foia-guidance.pdf

[9] https://www.gov.uk/government/collections/government-foi-statistics

[10] https://ico.org.uk/action-weve-taken/information-notices/

[11] https://www.gov.uk/government/publications/independent-commission-on-freedom-of-information-report

[12] The Commissioner’s decision notices can be found at this page; the database can be searched with reference to a particular public authority and case outcome: https://icosearch.ico.org.uk/s/search.html?collection=ico-meta&profile=decisions&query