ICO freedom of information backlog

The Information Commissioner’s Office (ICO) is taking a year before it starts investigating some freedom of information complaints.

An email from the ICO to one FOI requester dated 19th October 2021 states:

“The Commissioner is currently allocating cases from the end of November 2020 and we should be in a position to start the investigation into your complaint within the next 1-2 months.” [emphasis added].

Delays at the ICO are now so severe as to again be undermining the operation of the FOI Act. In a 2009 report the Campaign revealed it was taking on average 19.7 months from the date of a complaint till the ICO issued a decision notice. A quarter of decision notices took between 2 and 3 years and one took nearly 4 years.

We highlighted the consequences:

  1. By the time information is received, it may be too late to be of any use to the requester.
  2. Requesters who have to wait for such extended periods may be so frustrated by the experience that they do not use the Act again or to complain to the Commissioner about refusals.
  3. The delays mean authorities which have made mistakes in their handling of requests may carry on doing so for long periods before the Commissioner’s decision puts them right.
  4. Even where the Commissioner ultimately upholds the authority’s approach, the delayed decision increases the chance of more challenges from other requesters, more time-consuming internal reviews and more complaints to the ICO.
  5. If authorities calculate that they can safely withhold information for several years before the Commissioner compels disclosure, a minority may deliberately do so just to ‘buy time’.

This prompted the then new Information Commissioner, Christopher Graham who took office in 2009 to prioritise tackling the backlog (see here and here).

Currently, the ICO deals with some cases more quickly than others. It says:

“Generally we deal with complaints in the order we receive them, except where we have identified a complaint that can be resolved quickly or there is a compelling reason for a case to be accelerated. More complex complaints may involve a delay whilst waiting to be allocated to a case officer.”

Decision notices published in the first week of October 2021 showed some were issued within 3-11 weeks.[1] However, these dealt with requests which had gone completely unanswered. They would have required minimal investigation. Cases where the ICO has to decide whether information was wrongly withheld may wait up to a year before an investigation even starts.

We need far greater transparency from the ICO about its FOI complaint handling performance. The public should be able to see the size of the backlog, the delays that are occurring and the progress made in addressing these.

The ICO should publish on a monthly or quarterly basis:

1) A dataset of its open FOI/EIR casework
This should show how many complaints the ICO is dealing with, how many are being investigated and how many are waiting for an investigation to start.

The Scottish Information Commissioner (SIC) publishes a list of its current complaints which it updates every month. The ICO only releases its current caseload in response to individual FOI requests (see here and here).

2) A dataset of its completed FOI/EIR casework

Some years ago, the ICO committed itself to publishing this data “every three months with information relating to work completed in the previous quarter” but had not done so since March 2019. Following an FOI request by the Campaign it has now published data up to September 2019, but that is still 2 years out of date. It should start by publishing data for the most recent quarter, in line with its commitment. Those figures should not be held up until the earlier material has been published, though that data – showing the effect of the pandemic – is also needed.

3) Quarterly casework statistics

The SIC publishes quarterly statistics on the time it takes to decide on complaints. This includes separate statistics on the time taken (i) to decide if complaints are valid [2] (ii) to deal with complaints about failures to respond to requests and (iii) to reach other decisions such as those about the use of exemptions, cost refusals and vexatious requests. The ICO publishes no similar breakdown.

The substantial underfunding of the ICO’s FOI work by government is likely to contribute to the ICO’s difficulty in addressing these problems.

OpenDemocracy has reported that:

‘The ICO’s FOI budget was cut from £5.2 million in 2010–11 to £3.7 million in 2014–15 and has remained at roughly this level. This amounts to a 41% budget cut over a decade after adjustment for inflation’

The Campaign has compared the ICO’s funding in relation to the number of complaints it receives to that of the SIC. [3]

  • In 2019/20 the ICO received 6,367 FOI complaints and had a budget for FOI work of £3.75m. That works out at £589 per case.
  • In the same year the SIC received 494 FOI complaints, funded by a budget of £1,796,988, which comes to £3,638 per case.

This suggests that the SIC enjoys six times the UK’s Commissioner’s budget, per case, an indication of how underfunded by comparison the latter is. [4]

In 2020/21 the average closure time of all complaints by the SIC was 4.37 months, up from 3.37 months in 2019-20. [5]

We do not know the ICO’s average closure time – an indication how limited its published statistics are – but it plainly takes much longer than the SIC. In 2020/21 only 43% of complaints were closed in 90 days or less and 73% in 180 days or less. 96% were closed within 1 year. [6]

Even these figures should be treated with caution. The 43% closed by the ICO within 3 months largely involve cases dealt with without investigation such as complaints about delay.

It is right that the ICO should deal with these complaints quickly. But combining these figures with those on the delays in carrying out substantive investigations obscures the underlying problem. How long do requesters challenging unjustified refusals wait before an ICO investigation even begins – and how long does the case then take to decide?

Unless the backlog is reduced quickly, both the operation of the Act and the public’s confidence in it will be severely damaged. Regular reporting on the real size of the problem and the time it is taking to carry out substantive investigations is essential to an effective right to know.


[1] Decision notices IC-125991-S3S2, IC-125924-Z9J0, IC-119017-M2X7, IC-129637-T6W7.

[2] The Commissioner can only investigate “valid” appeals that meet specific legal criteria. Common reasons for appeals being invalid include the appeal not providing the legally required details (e.g. the full name of the requester), a request for review not being made or the timescales for appeals not being met.

[3] The SIC enforces the Freedom of Information (Scotland) Act. Unlike the UK Commissioner, the Scottish Commissioner has no responsibility for data protection legislation.

[4] The SIC’s FOI budget must fund the whole of their office accommodation, while the UK Commissioner’s office costs are presumably be shared between the ICO’s data protection income and its FOI income.  On the other hand, the ICO has a vastly larger staff (720.3 full time equivalents) than the SIC (23.8 FTEs), and its accommodation costs exceed those of SIC’s by a factor of ten (£879,000 compared to £87,000 for SIC in 2019/20).

[5] SIC Annual Report and Accounts 2020-21, page 19.

[6] ICO Annual Report and Financial Statements 2020-21, page 45.

Scroll to Top