Freedom of Information - Commercial Implications and Strategy

How might my organisation be affected?

The Freedom of Information Act 2000 (the FOIA) came fully into force on 1 January 2005, giving any person the right to ask for and receive information held by a public authority.¹ The FOIA is a source of both opportunity and risk. Companies and other organisations dealing with, or otherwise providing information to, public authorities may be affected by the FOIA in two ways. First, they themselves can exercise information access rights under the FOIA. Second, other people may request from public authorities information originally supplied by, or otherwise affecting, those companies. The latter may include information which is commercially sensitive.

What is a public authority?

A very broad range of organisations are deemed to be "public authorities" for the purposes of the FOIA, including some publicly-owned companies:

• government departments (this includes non-departmental government bodies);
• Parliament, the Northern Ireland Assembly and the National Assembly for Wales;
• the armed forces (but not Special Forces or units working with Government Communications Headquarters);
• local authorities;
• NHS bodies;
• the police;
• other bodies and offices such as regulators and advisory committees;
• private companies wholly owned by a public authority; and
• some bodies with respect of certain sorts of information such as the BBC and Channel 4.

Other bodies not listed in the FOIA can be brought under it by an order laid by the Ministry of Justice. 

What information is covered?

"Information" is defined as "information recorded in any form". The only limitation is that the information must be "recorded", whether on paper, tape, CD, hard drive or otherwise. If requested information is known to a public authority but not recorded in any form, it is not subject to a disclosure obligation. Information held by another person on behalf of the relevant public authority is considered to be information held by the public authority for the purposes of the FOIA. Conversely, information held by the public authority not on its own account but on behalf of a third party is not caught by the FOIA.

Seeking information from a public authority

The right to request information is exercisable by individuals and companies alike. Subject to certain exemptions set out in the FOIA, a public authority is statutorily obliged to inform the applicant in writing whether or not it holds information of the description specified in the request (known as the authority's "duty to confirm or deny") and, if it does, to disclose it.

What are the timing and formalities for a request?

Ordinarily, a public authority must comply with a request for information promptly and in any event within 20 working days. The timescale may be longer for requests involving difficult public interest issues under one or more of the exemptions which we will consider below. Public authorities are under a duty to provide advice and assistance in relation to reasonable requests for information. Compliance with the FOI Code of Practice² (discussed below) is deemed to constitute compliance with this duty.

Requests for information must be in writing and must comply with the formalities set out in the FOIA. Applicants may state a preference for the form of response, i.e. by provision of hard copies or in another form, an opportunity for inspection, and/or a digest or summary. The public authority must comply with this preference if reasonably practicable. This is worth bearing in mind because, if a preference is not stated, a public authority may comply with a request by any means reasonable in the circumstances.

Can the public authority charge for the information?

A public authority may charge a fee for complying with an information request to reflect its disbursement costs (such as printing, photocopying, postage, and converting data into the requested format, but not for staff time spent searching for information). Where it chooses to do so, it issues a fee notice stating how much it intends to charge. Fee notices can delay the provision of information because the period for complying stops running until payment is received. The public authority is not obliged to comply with an information request if it estimates that the cost of compliance would exceed the "appropriate limit", which is £600 for central government and £450 for other public authorities.³

Are there any exemptions?

The main principle behind the FOIA is that the public has a right to know about the activities of public authorities, unless there is good reason for it not to. In other words, there is a presumption in favour of disclosure. There are two categories of exemptions to disclosure, "absolute" and "qualified":

• If an absolute exemption applies, the information need not be disclosed and there is no duty on the public authority to consider the public interest test set out in the FOIA. In many cases the authority does not even have to confirm or deny whether it holds the information in question.

• In the case of qualified exemptions, the authority must consider the public interest test: i.e. does the public interest in non-disclosure of the information which has been sought outweigh the public interest in disclosure? If so, then the duty to disclose does not apply. Similarly, if the public interest in excluding the duty to confirm or deny outweighs the public interest in disclosing whether the public authority holds the information, that duty does not apply.

All the exemptions are set out in Part II of the FOIA and are summarised in the tables set out below.

If the public authority considers that an exemption applies it must notify the applicant of this. Where the authority is relying on a qualified exemption and, at the time of notification, has not yet reached a decision on whether the public interest favours retention or disclosure, its notice must also indicate that it has not yet decided and must provide an estimated date by which it expects to reach a decision. If the authority decides that the public interest favours exclusion of the duty to confirm or deny, or favours retention of the information requested, it must notify the applicant why it has so decided.

What are publication schemes?

The FOIA requires every public authority to adopt and maintain a publication scheme specifying the classes of information published or to be published by the authority, the manner of publication and whether the information is available to the public free of charge or upon payment. Publication schemes can be helpful in providing an overview of the categories of information that public authorities either do, or expect to, make routinely available. They are usually available on public authorities' websites. The Information Commissioner's Office has produced a model publication scheme which all public sector organisations must use (see www.ico.org.uk).

Litigation issues

The FOIA gives rise to a number of litigation-specific issues. In particular:

• litigants may be able to utilise the FOIA as an alternative means of pre-action disclosure in cases against public authorities;

• litigants may seek to utilise the FOIA to obtain documents from public authorities exceeding the bounds of standard disclosure under the Civil Procedure Rules; and

• potential litigants, whether competitors, pressure groups or consumers, may seek to obtain corporate documents held by public authorities relevant to potential claims against those companies.

Protecting/limiting company information from disclosure

Any document supplied by a company to a public authority,⁴ for example, as part of contractual arrangements, or documents relating to a company otherwise held by a public authority, could be the subject of an information request under the FOIA. Companies, therefore, may wish to consider the following measures to protect against or limit disclosure:

• contracts with public authorities should spell out the parties' obligations in relation to the FOIA;

• to the greatest extent possible, all sensitive information provided to a public authority should be subject to a clear confidentiality obligation before, during and after the contract, or, where there is no contract, sensitive documents should be clearly marked as confidential. Standard confidentiality undertakings should be reviewed to reflect the FOIA;
• companies should ensure that public authority counterparties are obliged to consult the company before disclosing commercially sensitive information under the FOIA; and
• a copyright notice should be added to documents supplied to public authorities and/or the authority should be reminded of copyright in the event of disclosure.

For further details on this, see the flow chart at the end of this guide – Freedom of Information Act: Is disclosure obligatory?

Must the public authority consult before disclosing information?

The FOI Code⁶

When an authority has received a request for information the disclosure of which is likely to affect the interests of third parties, the FOI Code state that the authority should consult the affected party "in order to consider whether information is suitable for disclosure".

The FOI Code goes on to say that "public authorities may want to directly consult third parties in these circumstances particularly if, for example, there are contractual obligations which require consultation before information is released". It also states that, in other circumstances, it may be "good practice" to do so: "for example, where a public authority proposes to disclose information relating to third parties, or information which is likely to affect their business or private interests". The Code further states that "Consultation will often be necessary because third parties who have created or provided the information may have a better understanding of its sensitivity than the public authority.  On this basis it is important the public authority understands the views provided by the third party and gives them appropriate weight. The expert view of a third party may, as long as it is reasonable, be helpful if the applicant appeals against any refusal. The views of third parties will be especially relevant in cases where it is necessary to consider the prejudice and public interest tests. …  Public authorities are not required to accept views provided to them from third parties about whether or not information should be released. It is ultimately for the public authority handling the request to take the final decision on release following any consultation it undertakes." 

The FOI Code's expectation that authorities "may" want to consult affected third parties (and that it "may" be good practice in other circumstances) is clearly neither precisely defined nor statutory in nature. Many public authorities appear to be consulting as a matter of good administrative practice, but if a particular authority is not, what can be done to persuade them to consult?

Public law arguments

One might argue on public law grounds, based on, for example, past practice or representation, that consultation is mandatory where confidential or commercially sensitive information is at stake. These arguments, although strong, are not necessarily robust. 

Contractual right to be consulted

Companies transacting with public authorities, or otherwise providing confidential information to them, may wish to consider contractual or non-contractual means of at least temporarily protecting their confidential information from disclosure, by stipulating a mandatory obligation to consult. The desired end will be to enable the company to protect its commercial position as best it can prior to the proposed disclosure. Such means have been employed in other jurisdictions where freedom of information legislation exists.

Challenging a decision to disclose

It may be possible to contest a disclosure decision by resorting to internal complaints procedures or applying to the Information Commissioner (and, if necessary, to the courts on questions of law), together with an application for injunctive relief if required. See below for more information about complaints procedures.

Making voluntary disclosure

Depending on the nature of the specific applicant and the prospect of the same request being made by others, it may be preferable to disclose certain material to the applicant voluntarily, but (if this can be agreed with the applicant) under strict conditions of confidentiality.