FOI/EIR: Frequently Asked Questions
- Who can request information?
- What information will be available?
- What are the obligations of the University under FOI?
- What is a publication scheme?
- How do I make a request?
- What happens when I make a request?
- What happens if the University doesn't understand my request?
- What does it cost?
- What happens if my request is refused?
- How can I complain about handling of a request?
- How many requests can I make?
- How can I use the information I get?
- Can I ask for the information in a different format?
- What difference will FOI make to me?
- As a member of staff, what do I need to know?
- As a researcher, what do I need to know?
- What is 'personal data'?
- What about copyright?
- Where can I find out about other forms of information compliance, such as data protection, intellectual property rights and copyright?
- Can a request be made via Twitter?
Since 1st January 2005, anyone can request information under freedom of information, regardless of age, nationality or location.
Any information held by the University, or by bodies on behalf of the University, is eligible for release, although there are a number of exemptions which may be applied, where it is not appropriate to disclose information. Where, for example, personal privacy, confidentiality or commercial interests may be breached. (See also What happens if my request is refused?
Disclosure of personal data is governed by the Data Protection Act 2018.
Disclosure of environmental information is governed by the Environmental Information Regulations 2004.
Unless an exemption applies under the terms of the FOI Act there are two aspects to the general right of access:
Where an exemption does apply, there is usually a right to know what exemption has been applied, and a right to complain.
A publication scheme is a document which describes the information the authority publishes, or intends to publish. In this context, 'publish' means to make information available, routinely.
These descriptions are called 'classes of information'. And the scheme represents the authority's commitment to make available the information described.
A publication scheme must set out the classes, or categories, of information published. It must also make clear how the information described is available and whether or not charges will be made.
When the University receives a request for information, we will respond as soon as possible, and not later than 20 working days after receiving your initial request. The reply will usually confirm whether or not we hold the information, and, if held, either provide the information you requested, or explain why it has not been provided, quoting an appropriate exemption under the Act.
The reply will also outline how to complain if you are not satisfied with the response.
Under the Freedom of Information Act, public authorities have a duty to advise and assist requestors.
If the University doesn't understand your request, we will contact you to clarify exactly what it is that you want.
If the reply you receive indicates that there has been a misunderstanding, follow the initial complaints procedure, which provides an opportunity for clarification between requestors and the University.
If you are requesting information contained in the University's Publication Scheme, the Scheme will give details of whether (and how much) you will be charged for the information.
If you are requesting information not contained within the publication scheme, the University may charge you a fee, as laid down in the Freedom of Information and Data Protection Regulations 2000.
These Regulations allow public authorities to charge for photocopying and postage etc. If such a charge is to be made, because of the amount of information that needs to be copied and posted, you will be informed of the amount before the information is prepared.
The Regulations also govern charging in relation to the costs of recovering the requested information - if these costs are estimated to be £450 or less, the University is obliged to retrieve and provide the information with no charge, other than photocopying and postage etc.
If your request will cost more than this to answer, the University may refuse to answer your request, answer it for free, or charge up to and including the full cost of answering.
Where a charge is made, you will be informed before the information is retrieved. If you choose not to pay the fee, the University can refuse to supply the information.
A request for information may only be refused by a public authority if it falls under one of the 24 exemptions within the Act, and for most of these exemptions, it must also apply a "public interest test".
If your request is refused, the reply from the University must identify which exemption it is applying, where appropriate how the public interest test applies, and give you details of how to complain.
If, after the initial complaints procedure, you are still not satisfied, you can ask the University to follow a second phase complaint. If this still fails to satisfy, you may ask the Office of the Information Commissioner to review the decision.
Write (by post or e-mail) to the IMPS Office outlining your complaint.
IMPS will initiate a phase 1 complaint, and review the request, information collection, decision-making about disclosure and communication with the applicant. Where there appear to have been misunderstandings of the information sought, IMPS will seek to clarify. The reply will outline the findings, including any additional information discovered or to be additionally disclosed, and any further explanation regarding the decision-making.
If this doesn't satisfy, you should write again to the IMPS Office, asking us to initiate a phase 2 complaint. In this case the review will be carried out by a lay member of the University's Council.
Should the reply to a phase 2 complaint not satisfy, you can write to the Information Commissioner and ask him to review the decision on your behalf. Details can be found on the website of the Office of the Information Commissioner. The Commissioner will attempt to resolve the complaint informally. Failing that, a "Decision Notice" may be issued, outlining a final assessment of the case and indicating if and what the University should disclose. There are rights of appeal to such a notice, for both requestor and University.
The Act does not specifically limit the number of requests you can make, however, section 14 of the Act states that a University can refuse any vexatious or repeated requests. This may include repeated requests from the same person for the same information, from a number of sources which appear to be in concert, or requests which are intended to disrupt the University's work.
The Freedom of Information Act does not place restrictions on how the information supplied under it may be used, although provision will not override limitations and obligations under the Copyright, Designs and Patents Act 1988.
You may request that the information be supplied in any form, however, the University may take into account the cost of supplying the information in any given form before complying with your request. In particular, you may ask for information in permanent form, in summary form, or for permission to inspect records containing the information. However, the University is not obliged to supply specific documents; the Act specifies rights to information held rather than documents. You may also request information in e- or paper-format.
As an individual you will be entitled to request information from the University, and any other public authority as defined by the Act.
As an employee of the University you need to be aware of the Act and be prepared to act quickly if you receive a request for information. Staff should also be aware that all University records, including the records they keep, are potentially now open to scrutiny by the public. See the leaflet FOIA: Essential Information (PDF-146KB) and the FOI/EIR FAQs for Staff for further details.
Refer to the FOI/EIR FAQs for Staff page for more information.
In addition to the points raised in the previous FAQ for all members of staff, as a researcher you need to know that information requested in a FOI or EIR request could include your research data. If requested, the information must be provided unless an exemption or exception allows the University not to disclose it.
Some useful guidance to researchers can be found in the JISC document FOI & Research Data: Researchers' Questions and Answers.
As with all requests for information, unless they are "business as usual" type requests, you should inform the IMPS Office about the request as soon as possible to ensure that the necessary procedures are followed.
Personal data means any information relating to an identifiable person ('data subject') who can be directly or indirectly identified in particular by reference to an identifier.
This definition provides for a wide range of personal identifiers to constitute personal data, including name, identification number, location data or online identifiers. Personal data can include any of the below:
Data of Birth
Postal Address(es) (to include postcodes)
Unique Identifiers (to include: Student ID numbers, Staff ID numbers, Passport numbers, NHS numbers, National Insurance numbers, ORCID's, unique research participant ID numbers, Unique applicant ID numbers, vehicle registration, driving licence numbers)
Images of individuals, including CCTV, photos
Location Data (to include any GPS tracking data)
Online Identifiers (to include IP address data)
Economic/financial data (relating to an identifiable individual)
Educational records including but not limited to records held by the University and other education providers
Pastoral records, including Extenuating Circumstances Forms
Employment records to include CV's, references
Mental Health (status, medical records conditions, to include disability)
Physical Health (status, medical records conditions, to include disability)
Sexual Orientation/Sexual life
Genetic Data (to include DNA data)
Biometric data (such as facial image or fingerprint data)
Trade Union membership
Religious or philosophical beliefs
Criminal Convictions and offences (to include alleged offences and convictions)
The GDPR applies to both automated personal data and to manual filing systems where personal data are accessible according to specific criteria. This could include chronologically ordered sets of manual records containing personal data.
Personal data that has been pseudonymised - eg key-coded - can also fall within the scope of the definition of personal data.
Disclosure of personal data continues to be governed by the Data Protection Act 2018.
|What about copyright?|
Disclosure by the University under the FOI Act should not breach its own or a third party's copyright and the recipient must still respect the copyright owner's rights. For further information please see the Copyright pages.
|Where can I find out about other forms of information compliance, such as data protection, intellectual property rights and copyright?|
See the Information Management and Policy Services website.
|Can a request be made via Twitter?|
The Information Commissioner (IC) has advised that universities should be prepared to receive and respond to freedom of information (FOI) requests made through official University-managed Twitter accounts in the same way as they would an email or letter.
University staff using Twitter as an official communications tool should be aware that FOI requests can be received by this channel. Valid requests could be received by direct messages or by the @mentions facility whereby the owner can check for references to the University.
The position of personal Twitter accounts, ie staff with individual accounts registered under a University email address, is unclear. It is possible that requests to these accounts could be considered valid. Until we have further guidance from the Information Commissioner staff are advised to err on the side of caution and simply follow the procedure set out below.
Using Twitter to submit valid FOI requests does pose challenges. Firstly, Twitter messages only have a standard 140 character limit which can make both framing a request and responses difficult. Secondly, to be a valid FOI request there should be a name and address for correspondence, which arguably if rigidly enforced could invalidate some requests as individuals often do not use their real names. Thirdly, official Twitter accounts may not be regularly monitored for requests making them an unreliable method of asking for information under FOI.
However despite the challenges that this medium poses, colleagues should simply follow the established procedures when dealing with requests for information received via any medium:
then refer the message to the IMPS Office.