📚 Guidance on Handling Freedom of Information Requests

Understanding Valid FOI Requests

• Definition of a Valid Request: Schools must respond to written requests that clearly state the requester’s real name and provide a contact address (which could be a postal or email address). The request should also specify the information sought. As the ICO state, this is not a hard test to satisfy and “almost anything in writing which asks for information will count as a request under the Act.”
  (What should we do when we receive a request for information? | ICO)
• No Requirement for a Reason: Schools should remember that the reason for the request is not required and should not influence their response.
• Only Provide Recorded Information: ​The FOI Act covers recorded information that is held by the school including printed documents, computer files, letters, emails, photographs, and sound or video recordings. This means that schools do not need to provide information they do not collect and hold as part of their regular routines.

Cybersecurity and Online Surveys

• Concerns with Online Forms: A number of recent FOI requests have included links to online surveys, Google Forms, or similar. However, for cybersecurity reasons, we would advise schools to avoid using these methods to provide information.
• Alternative Methods: Schools are advised to use established communication channels to respond to FOI requests, ensuring data protection and cybersecurity. This could be as simple as requesting the questions are sent directly by email which can then be responded to without needing to click on unknown links.

Best Practice for Schools

• Timely Response: Schools have 20 school days or 60 working days (whichever is shorter) from the receipt of the request to respond.
• Data Protection: Ensure that no personal or sensitive data is inadvertently shared while responding to FOI requests. There are some limited exceptions to this but it is best to consult your DPO prior to sending the data if you have questions or concerns.
• Transparency and Accountability: Maintain a transparent process while ensuring the accountability of the information provided.

Refusal of Requests

• Grounds for Refusal: Requests can be refused if they exceed cost limits, are considered vexatious, or are repetitive.
• Use of Exemptions: Apply exemptions judiciously, considering the public interest in both disclosing and withholding information. There is generally quite a high bar for the use of exemptions in a Freedom of Information request and the exemption has to be fully explained to the requester in a ‘refusal notice’.

Final Notes

• Documentation and Record-Keeping: Keep records of all FOI requests and responses for accountability and training purposes. Most of our schools will log FOI requests on the portal either within the SAR log or the Data Decision log.
• Consultation with Experts: When in doubt, consult with information governance experts or legal advisors to ensure compliance. We are happy to provide guidance as the DPO although FOI does generally sit outside the role of a Data Protection Officer.