The Freedom of Information Act 2000 (FoIA) was enacted as part of a package of measures introduced by the Labour government aimed at improving the operation of the UK government by making it more accountable to the electorate through increased transparency. It directly affects ‘public authorities’ which are defined in a list contained in Schedule 1 of the Act. Some private sector companies are also affected by FoIA and from 1st May 2018 the Housing Ombudsman was listed as a public authority for these purposes.
There have been moves afoot for some time to bring housing providers under the scope of the FoIA including calls from MPs, the Information Commissioner’s Office (ICO) and public pressure groups. So far these have been fought off by the housing sector and the National Housing Federation, fearful of an apparent loss of independence and increased costs. The latest attempt, the Freedom of Information (Extension) Bill seeks to bring providers of social housing under the scope of the FoIA.
The ICO recently estimated that there is a transparency gap of more than £10 billion per year caused, in the main, by the government purchasing public services from private companies, charities and not-for-profit agencies who are not caught by the provisions of the FoIA . The drive to bring this spending under the scope of the FoIA to improve governmental accountability seems well founded.
What is the FoIA?
The FoIA provides a general right of access to information held by public authorities in England and Wales and Northern Ireland. There is similar legislation in Scotland under the Freedom of Information (Scotland) Act 2002. The law is based on domestic statute: there is no specific EU directive which has required the introduction of the law. The ICO is responsible for enforcing the FoIA.
Since the Act came fully into force at the start of 2005, it has given access to a vast number of documents which has enhanced openness and transparency in decision taking by public authorities and has generated much controversy, giving access to various information individuals within public authorities (including MPs) would probably wish had been kept secret.
How does it affect organisations?
The FoIA broadly affects public authorities in two ways:
- Certain documents and other recorded information held by a public authority must be published into the public domain via a publications scheme;
- Anybody (individuals and organisations) can make requests for information under the FoIA which must be responded to within 20 working days.
One of the effects of this is that organisations caught by the Act need more control over the information they are holding such as: a data classification scheme, detailed information asset registers, effective information and document retention schedules and data destruction arrangements; a method (usually a web site) for managing the publications scheme; and a mechanism for handling FoIA requests including appropriate data-search functionality, as well as a team of people who understand the FoIA including its exemptions, case law and so on.
In many organisations’ experience, most FoIA requests are made by journalists on the hunt for stories or for research purposes and the Act has been criticised by politicians for allowing this. However, these are valid requests for information and must be responded to within the statutory period.
What should social housing providers do now?
The FoIA Extension Bill is a bill before parliament that aims to, among other things, make providers of social housing, and information held by contractors to public authorities subject to the FoIA. The Bill’s passage may arguably have become derailed by the parliamentary time committed to Brexit but if it becomes law, it will have a significant impact on housing providers, who are generally not geared up either to identify information for proactive publication or for handling information requests made under the Act.
The Bill currently states that it would come into effect three months after the day on which it is passed by Parliament, giving a very short lead-in time compared to the lead-in time of over four years provided for when the FoIA came into force.
However, given the work that housing providers and their contractors will have already undertaken in preparation for last year’s introduction of GDPR (including data audits, compilation of asset registers and an overhaul of information rights request) combined with the huge advances in data-management technologies in the past decade or so, this doesn’t seem to be an unrealistic timetable but nevertheless, it is short.
Social housing providers should brief senior management about the FoIA and the Bill, review their current capabilities to comply with the Act, and define the actions that would be required to comply. They should assess the scope of information they are holding, determine what a publications scheme would look like, evaluate likely modifications to their data classification policy, and detail what information would fall under the scope of FoIA requests, which exemptions might be applicable and how they could modify their existing information request handling processes to accommodate FoIA requests. They should assess the likely impact on their supply chain and discuss the implications with relevant contractors.
What should contractors do now?
The extension bill states: “Any contract made by a public authority with any person (‘the contractor’) for the provision of services to or on behalf of the public authority shall be deemed to include the specified disclosure provision… a provision stipulating that all information held in connection with the performance or proposed performance of the contract by the contractor, a sub-contractor, and any other person acting on behalf of the contractor or subcontractor is, notwithstanding any provision to the contrary in the contract, deemed to be held on behalf of the public authority for the purpose of this Act or the Environmental Information Regulations 2004.”
Contractors to housing providers should: review the contracts they have with their housing customers; assess the information they are holding in relation to their contracts with them; explore and document how this information is managed and catalogued; and detail the work required to ensure information handling complies with the FoIA. They need to assess their ability to respond to information disclosure requests made under the FoIA and bear in mind that the Bill empowers the ICO to have powers of entry and inspection over contractors. It also extends the offence of altering records with the intent to prevent disclosure to include contractors.
Fortunately, much work should already be in place to regulate, control and monitor the processing of personal data by housing providers and their suppliers on the back of their GDPR work. The trick will be to extend some of these measures to cover FoIA information and the starting point is to undertake a FoIA impact review which, for a few days’ work is likely to be time well spent if the Bill passes into law.
Philip Brining is the consulting director for Data Protection People.
