Freedom of Information Requests

You are only required to provide recorded information that you hold for the purposes of the practice business at the time of the request which includes documents, emails, notes, and/or any drafts, telephone or CCTV recordings or information stored in off-site servers or cloud storage.  If  the practice does not hold the information requested, you will still need to respond in writing stating that the practice does not hold it.  If you know where the information is held, you could transfer the request, or ask the applicant to redirect the request.

GP’s, dentists and other health practitioners only have to provide information about their NHS work.

An FOI request does not give an applicant access to their own personal data. If a person wants to see information you hold about them, the request should be treated as a subject access request (SAR).

Requests must be in writing (this can be in a letter or digital format including social media) and addressed to the Practice (and does not need to specify that it is a request under the Act).  The application must  include:

• the applicant’s real name (a request can be made in the name of an organisation, or by one person on behalf of another, such as a solicitor on behalf of a client but in that case you should check that the applicant has given that person authority to act on their behalf);

• an address for correspondence which can be a postal address, email address or a unique name or identifier on a social media platform;

• a description of the information being requested (the Act covers information, not documents, so an applicant does not have to ask for a specific document). The application must clearly set out the information being asked for, and if it is not, you may ask for clarification.

If an applicant makes an oral request, they should be asked to make their request in writing, but you should bear in mind that if the applicant has a disability, you should provide  the necessary assistance to enable that applicant to make the request. This may include referring them to a third party i.e. Citizens Advice Bureau or in exceptional circumstances, taking a note of the request over the telephone and sending it to the applicant for confirmation.

You must respond within 20 working days from the date when the request is received, if it is a working day or the first working day after its arrival. The response should be to either:

• provide the information; or

• deny that you hold the information;

• confirm that you hold the information but send a refusal notice explaining the provisions of the Act you are relying on for that refusal and why;

• a combination of the above so that some information is provided, you deny that you hold some information and/or you refuse to provide some information and the reasons for that.

​​​​​​​You will also need to give details of your internal complaints procedure and inform the applicant of their right to complain to the ICO and how to do that. Make sure you keep a record of your reply.

There are limited reasons which will allow you to refuse an FOI request. These include the following:

• You do not hold the information. The Information Commissioner’s Office (ICO) expects you to have made an adequate documented search, and to have advised the applicant if the information is held by another authority.

• The information is exempt. You will need to establish which parts of the information are exempt and why (for example because of confidentiality), and then in most cases determine if it is in the public interest to withhold the information.

• It would cost too much or take too much staff time to deal with the request. This will be discussed in more detail below.

• Information already reasonably accessible (the applicant has it already or it is in the public domain). You will need to take the applicant’s personal circumstances into account and you should consider any obligations under the Equality Act 2010.  You should inform the applicant why you are refusing the request and advise them where they can find the information.

• The request is vexatious. Take care, as you cannot label a request as vexatious because you believe it has little value or you do not like the way it has been made. However, you can take into account the context and history of a request, including the identity of the applicant and your previous contact with them. The ICO says: 'The key question to ask yourself is whether the request is likely to cause a disproportionate or unjustifiable level of distress, disruption or irritation.' You must also remember that it is the request that will be deemed vexatious, not the applicant.

• It is a repeat request from the same person. You can only refuse the request if it is identical or substantially similar, but not if it is a request for information on a related topic to a previous request, or if a reasonable period of time has passed since the previous request.

• Exceptions are also made for information which is still in draft form or archived/difficult to access, or is intended for imminent publication.

If the information required is going to be costly and you can establish that the staff time involved will exceed the cost limit, then you may consider sending a refusal notice. If this is the outcome, you  will need to respond to the applicant to provide your reasoning under Section 12.

The ICO Website provides detailed information on this; the key points are summarised below, and should be read alongside the guidance:

• Under section 12 of FOIA, you can refuse a request if you estimate the time it would take to either determine if you hold the information or to provide it would exceed the ‘cost limit’. The refusal notice must state that you are refusing the request under Section 12, and give the applicant reasonable advice and assistance on how to refine their request. A refined request will become a new request.

• The cost limit is calculated at a flat rate of £25 per hour of work. For public authorities the cost limit is £450 (18 hours of work).

Calculating the cost limit

In order to estimate whether complying with a request will exceed the cost limit or not, you can only take into account time taken for the following:

• Determining whether you hold the information;

• Locating that information or a document which may contain the information’

• Retrieving the information or a document containing it; and

• Extracting the information from a document containing it.

You cannot take account of the time involved in considering whether any of the information is protected by an exemption.  However whether the potential costs in complying with a request would impose a grossly oppressive burden, that burden may make the request vexatious and can be refused under Section 14 .

You are not required to make a precise calculation, but estimates should be sensible and realistic.

If you receive two or more requests, made by the same person or different people who appear to be working together, for the same or similar information within a period of 60 consecutive working days, the cost calculation can include the costs of complying with all the requests.

Where the practice intends to charge for the cost of providing information, the practice should send a fees notice to the applicant stating the amount to be paid, including how this has been calculated as soon as possible within the 20 working day response period.  The fees notice should also inform the applicant:

• That the 20 working day period will be paused until payment is received;

• How the fee can be paid; and,

• Their rights of complaint via your internal review procedure and to the ICO.

Unless there are exceptional circumstances where the applicant requires assistance to make an FOI request, it is advisable to communicate with the applicant in writing.