FOI/EIR: Frequently Asked Questions

Who can request information?

Since 1st January 2005, anyone can request information under freedom of information, regardless of age, nationality or location.

What information will be available?

Any information held by the University, or by bodies on behalf of the University, is eligible for release, although there are a number of exemptions which may be applied, where it is not appropriate to disclose information. Where, for example, personal privacy, confidentiality or commercial interests may be breached. (See also What happens if my request is refused?

Disclosure of personal data is governed by the Data Protection Act 2018.

Disclosure of environmental information is governed by the Environmental Information Regulations 2004.

What are the obligations of the University under FOI?

• to make available a " publication scheme"
• "provide advice and assistance" to people who have or propose to make requests for information
• to provide individuals with a "general right of access", on written request, to information held by the University and to do this "promptly and in any event not later than the twentieth working day following the date of receipt" of the request
• to operate good records management according to the Lord Chancellor's Code of Practice.

Unless an exemption applies under the terms of the FOI Act there are two aspects to the general right of access:

• the right to be told whether or not the University holds the information; and
• if that is the case, to have the information communicated to them.

Where an exemption does apply, there is usually a right to know what exemption has been applied, and a right to complain.

What is a publication scheme?

A publication scheme is a document which describes the information the authority publishes, or intends to publish. In this context, 'publish' means to make information available, routinely.

These descriptions are called 'classes of information'. And the scheme represents the authority's commitment to make available the information described.

A publication scheme must set out the classes, or categories, of information published. It must also make clear how the information described is available and whether or not charges will be made.

What happens when I make a request?

When the University receives a request for information, we will respond as soon as possible, and not later than 20 working days after receiving your initial request. The reply will usually confirm whether or not we hold the information, and, if held, either provide the information you requested, or explain why it has not been provided, quoting an appropriate exemption under the Act.

The reply will also outline how to complain if you are not satisfied with the response.

What happens if the University doesn't understand my request?

Under the Freedom of Information Act, public authorities have a duty to advise and assist requestors.

If the University doesn't understand your request, we will contact you to clarify exactly what it is that you want.

If the reply you receive indicates that there has been a misunderstanding, follow the initial complaints procedure, which provides an opportunity for clarification between requestors and the University.

What does it cost?

If you are requesting information contained in the University's Publication Scheme, the Scheme will give details of whether (and how much) you will be charged for the information.

If you are requesting information not contained within the publication scheme, the University may charge you a fee, as laid down in the Freedom of Information and Data Protection Regulations 2000.

These Regulations allow public authorities to charge for photocopying and postage etc. If such a charge is to be made, because of the amount of information that needs to be copied and posted, you will be informed of the amount before the information is prepared.

The Regulations also govern charging in relation to the costs of recovering the requested information - if these costs are estimated to be £450 or less, the University is obliged to retrieve and provide the information with no charge, other than photocopying and postage etc.

If your request will cost more than this to answer, the University may refuse to answer your request, answer it for free, or charge up to and including the full cost of answering.

Where a charge is made, you will be informed before the information is retrieved. If you choose not to pay the fee, the University can refuse to supply the information.

What happens if my request is refused?

A request for information may only be refused by a public authority if it falls under one of the 24 exemptions within the Act, and for most of these exemptions, it must also apply a "public interest test".

If your request is refused, the reply from the University must identify which exemption it is applying, where appropriate how the public interest test applies, and give you details of how to complain.

If, after the initial complaints procedure, you are still not satisfied, you can ask the University to follow a second phase complaint. If this still fails to satisfy, you may ask the Office of the Information Commissioner to review the decision.

How can I complain about handling of a request?

Write (by post or e-mail) to the IMPS Office outlining your complaint.

IMPS will initiate a phase 1 complaint, and review the request, information collection, decision-making about disclosure and communication with the applicant. Where there appear to have been misunderstandings of the information sought, IMPS will seek to clarify. The reply will outline the findings, including any additional information discovered or to be additionally disclosed, and any further explanation regarding the decision-making.

If this doesn't satisfy, you should write again to the IMPS Office, asking us to initiate a phase 2 complaint. In this case the review will be carried out by a lay member of the University's Council.

Should the reply to a phase 2 complaint not satisfy, you can write to the Information Commissioner and ask him to review the decision on your behalf. Details can be found on the website of the Office of the Information Commissioner. The Commissioner will attempt to resolve the complaint informally. Failing that, a "Decision Notice" may be issued, outlining a final assessment of the case and indicating if and what the University should disclose. There are rights of appeal to such a notice, for both requestor and University.

How many requests can I make?

The Act does not specifically limit the number of requests you can make, however, section 14 of the Act states that a University can refuse any vexatious or repeated requests. This may include repeated requests from the same person for the same information, from a number of sources which appear to be in concert, or requests which are intended to disrupt the University's work.

How can I use the information I get?

The Freedom of Information Act does not place restrictions on how the information supplied under it may be used, although provision will not override limitations and obligations under the Copyright, Designs and Patents Act 1988.

Can I ask for the information in a different format?

You may request that the information be supplied in any form, however, the University may take into account the cost of supplying the information in any given form before complying with your request. In particular, you may ask for information in permanent form, in summary form, or for permission to inspect records containing the information. However, the University is not obliged to supply specific documents; the Act specifies rights to information held rather than documents. You may also request information in e- or paper-format.

What difference will FOI make to me?

As an individual you will be entitled to request information from the University, and any other public authority as defined by the Act.

As an employee of the University you need to be aware of the Act and be prepared to act quickly if you receive a request for information. Staff should also be aware that all University records, including the records they keep, are potentially now open to scrutiny by the public. See the leaflet FOIA: Essential Information (PDF-146KB) and the FOI/EIR FAQs for Staff for further details.

As a member of staff, what do I need to know if someone requests information from me?

• The person requesting the information does not need to tell you it is an FOI (or Environmental Information) request; all they need to do is request the information
• you are not entitled to know why they want the information or to check whether the person requesting it is "genuine"
• a request for information may come to any part of the University from anywhere in the world
• by law the request for information must be answered within 20 working days
• if you would usually provide the information, you should continue to do so
• if you would NOT, or are unable to, provide the information, you should refer the request to the IMPS Office immediately

Refer to the FOI/EIR FAQs for Staff page for more information.

As a researcher, what do I need to know if someone requests my research data from me?

In addition to the points raised in the previous FAQ for all members of staff, as a researcher you need to know that information requested in a FOI or EIR request could include your research data. If requested, the information must be provided unless an exemption or exception allows the University not to disclose it.

Some useful guidance to researchers can be found in the JISC document FOI & Research Data: Researchers' Questions and Answers.

As with all requests for information, unless they are "business as usual" type requests, you should inform the IMPS Office about the request as soon as possible to ensure that the necessary procedures are followed.

What is 'personal data'?

Personal data means any information relating to an identifiable person ('data subject') who can be directly or indirectly identified in particular by reference to an identifier.

This definition provides for a wide range of personal identifiers to constitute personal data, including name, identification number, location data or online identifiers. Personal data can include any of the below:

Name

Data of Birth

Postal Address(es) (to include postcodes)

Contact telephone(s)

Email address(es

Unique Identifiers (to include: Student ID numbers, Staff ID numbers, Passport numbers, NHS numbers, National Insurance numbers, ORCID's, unique research participant ID numbers, Unique applicant ID numbers, vehicle registration, driving licence numbers)

Images of individuals, including CCTV, photos

Location Data (to include any GPS tracking data)

Online Identifiers (to include IP address data)

Economic/financial data (relating to an identifiable individual)

Educational records including but not limited to records held by the University and other education providers

Counselling records

Pastoral records, including Extenuating Circumstances Forms

Disciplinary records

Training records

Employment records to include CV's, references

Nationality/Domicile

Ethnicity

Mental Health (status, medical records conditions, to include disability)

Physical Health (status, medical records conditions, to include disability)

Dietary requirements

Sexual Orientation/Sexual life

Genetic Data (to include DNA data)

Biometric data (such as facial image or fingerprint data)

Political opinions

Trade Union membership

Religious or philosophical beliefs

Criminal Convictions and offences (to include alleged offences and convictions)

The GDPR applies to both automated personal data and to manual filing systems where personal data are accessible according to specific criteria. This could include chronologically ordered sets of manual records containing personal data.

Personal data that has been pseudonymised - eg key-coded - can also fall within the scope of the definition of personal data.

Disclosure of personal data continues to be governed by the Data Protection Act 2018.

Disclosure by the University under the FOI Act should not breach its own or a third party's copyright and the recipient must still respect the copyright owner's rights. For further information please see the Copyright pages.

See the Information Management and Policy Services website.

The Information Commissioner (IC) has advised that universities should be prepared to receive and respond to freedom of information (FOI) requests made through official University-managed Twitter accounts in the same way as they would an email or letter.

University staff using Twitter as an official communications tool should be aware that FOI requests can be received by this channel. Valid requests could be received by direct messages or by the @mentions facility whereby the owner can check for references to the University.

The position of personal Twitter accounts, ie staff with individual accounts registered under a University email address, is unclear. It is possible that requests to these accounts could be considered valid. Until we have further guidance from the Information Commissioner staff are advised to err on the side of caution and simply follow the procedure set out below.

Using Twitter to submit valid FOI requests does pose challenges. Firstly, Twitter messages only have a standard 140 character limit which can make both framing a request and responses difficult. Secondly, to be a valid FOI request there should be a name and address for correspondence, which arguably if rigidly enforced could invalidate some requests as individuals often do not use their real names. Thirdly, official Twitter accounts may not be regularly monitored for requests making them an unreliable method of asking for information under FOI.

However despite the challenges that this medium poses, colleagues should simply follow the established procedures when dealing with requests for information received via any medium:

• if the request specifically mentions any of the access to information regimes, such as FOI, Environmental Information Regulations (EIR) or Data Protection, OR
• if the request asks for information that the University 'holds', OR
• if the request asks for non-routine or sensitive information,

then refer the message to the IMPS Office.