Drop in ICO enforcement action

A sharp drop in the Information Commissioner’s FOI enforcement action since the pandemic is revealed by an analysis of decision notices.

The Campaign’s analysis looked at decision notices published in the two full months both before and after the lockdown.

  • In January and February 2020 the ICO ordered public authorities to take substantive action in 32% of decisions (67 out of 212) published during this 2-month period.
  • But only 5% of decision notices (6 out of 116) published in April and May 2020 after the lockdown required substantive action.[1] The lockdown started on March 23.

This suggests that the ICO has been holding back decisions that require public authorities to disclose withheld information or reconsider unjustified refusals. This is presumably to shield authorities from the pressure of having to comply with FOI requirements during the health emergency.

We have previously reported that two individual decision notices, involving the Cabinet Office and DWP, have been prepared but not issued – and questioned whether that withholding was necessary. It now seems to have been widespread.

The ICO has previously said that it would not penalise authorities for transferring resources from FOI to other functions during the pandemic, but has not publicly acknowledged deliberately delaying the issue of decision notices or explained its criteria for doing so. There may be a case for this if, for example, FOI compliance would take NHS staff away from dealing with the health emergency. It is questionable whether it is justified for non-front line authorities. Their staff may be working from home, but if they have remote access to the relevant records (and those using electronic case management systems are likely to) they should be able to comply with ICO decisions.

However, there are signs that the proportion of June 2020 decision notices requiring substantive action is beginning to increase. We will update the analysis in July.


  1. In this analysis decision notices are treated as requiring ‘substantive action’ if they require the authority to: (i) disclose previously withheld information (ii) respond to a request which it had ignored (iii) confirm or deny holding information after refusing to do so or (iv) issue a fresh response to a wrongly refused request.Decisions not requiring substantive action are those where the ICO has not ordered any steps to be taken at all because it had found the requested information was exempt or not held or had been belatedly disclosed. Decisions requiring the authority to provide advice and assistance to the requester but not do anything else are not treated as requiring ‘substantive’ action in this analysis.


Scroll to Top