Preparing for extension of the Freedom of Information Act to social housing providers

In 1878, Thomas Edison founded the General Electric Company, Everton football club was formed, and details of a secret deal between Britain and Russia over the carving up of the Eastern Balkans (the Anglo Russian Convention of 30th May 1878) was sold to a newspaper by Charles Marvin, a copying clerk employed to make copies of the official Convention documents.

The then Foreign Secretary Lord Salisbury responsible for negotiating the deal was astonished that Marvin had committed no crime and was forced to lie to the House of Lords that the reports about the Convention were wholly unauthentic. Marvin later claimed that he had leaked the Convention to the Globe newspaper in the interests of open government. In 1887 Terry Young, a British draftsman, suspected of selling warship designs to France[1] and was again found to have committed no crime and two years later the Official Secrets Act[2] was passed, strengthened in 1911 with the prospect of war in Europe to contain strong provisions which protected virtually everything including the menu in the House of Commons!

Fast forward 121 years to the Blair administration which published a paper entitled Your Right to Know[3] in December 1997 – a paper setting out Freedom of Information legislation in its bid to reform British politics and government decision making. Just short of three years later the Freedom of Information Act 2000 (FoIA) received Royal Ascent and was implemented over a five-year period becoming law on 1st January 2005.

What is the FoIA?

The FoIA was enacted as part of a package of measures introduced by the Blair Labour government aimed at improving the operation of the UK government by making it more accountable to the electorate through increased transparency. It directly affects “public authorities” which are defined in a list contained in Schedule 1 of the Act. Some private sector companies are also affected by FoIA.

FoIA provides a general right of access to information held by public authorities in England and Wales and Northern Ireland. There is similar legislation in Scotland under the Freedom of Information (Scotland) Act 2002. The law is based on domestic statute: there is no specific EU directive which has required the introduction of the law. The ICO is responsible for enforcing the FoIA.

Since the Act came fully into force on 1 January 2005, it has given access to a vast number of documents which has enhanced openness and transparency in decision taking by public authorities and has generated much controversy, giving access to various information individuals within public authorities (including MPs), would probably wish had been kept secret.

How does it affect organisations?

FoIA broadly affects public authorities in two ways:

certain documents and other recorded information held by a public authority must be published into the public domain via a publications scheme;

anybody (individuals and organisations) can make requests for information under the FoIA which must be responded to within 20 working days.

The effect of this is that organisations caught by the Act need more control over information they are holding such as: a data classification scheme, detailed information asset registers, effective information and document retention schedules, effective data destruction arrangements; appropriate data search functionality; a mechanism (usually a web site) for managing the publications scheme; as well as a team of people who understand the FoIA including its exemptions, case law etc. and a mechanism for handling FoIA requests.

In many organisations’ experience most FoIA requests are made by journalists on the hunt for stories or for research purposes and the Act has been criticised by politicians for allowing this[4]. However, these are valid requests for information and must be responded to within the statutory time frame.

What is the FoIA Extension Bill?

The FoIA Extension Bill is a bill before parliament:

  1. to make providers of social housing, local safeguarding children boards, Electoral Registration Officers, Returning Officers and the Housing Ombudsman public authorities for the purposes of the Freedom of Information Act 2000;
  2. to make information held by persons contracting with public authorities subject to the Freedom of Information Act 2000;
  3. to extend the powers of the Information Commissioner; and for connected purposes.

The bill will have its second reading in the House of Commons on 23rd November 2018. It may not become law but much of the drive for the FoIA to be extended in this way follows criticism of Kensington and Chelsea Tenant Management Organisation Association (social housing provider) over the way that it handled requests for information following the disaster at Grenfell Tower, a property which it managed.

What should social housing providers do now?

The bill currently states that it would come into effect 3 months after the day on which it is passed by parliament giving a very short lead-in time compared to the 4+ year lead in time provided for when the FoIA came into effect, but this is likely to be a realistic timetable given the work that all data controllers and processors will have undertaken in preparation for the GDPR including data audits, compilation of asset registers and an over-haul of information rights request processes to accommodate data subject rights requests made under the GPDR, and the huge advance in data management technology since the noughties.

Social housing providers should brief senior management about the FoIA and the bill, review their current capability to comply with the Act; and define the actions that would be required to comply. They should assess the scope of information they are holding, determine what a publications scheme would look like, evaluate likely modifications to their data classification policy, and detail what information would fall under the scope of FoIA requests, which exemptions might be applicable and how they could modify their existing information request handling processes to accommodate FoIA requests.

What should contractors do now?

The extension bill states that “any contract made by a public authority with any person (“the contractor”) for the provision of services to or on behalf of the public authority shall be deemed to include the specified disclosure provision …. a provision stipulating that all information held in connection with the performance or proposed performance of the contract by the contractor, a sub-contractor, and any other person acting on behalf of the contractor or subcontractor is, notwithstanding any provision to the contrary in the contract, deemed to be held on behalf of the public authority for the purpose of this Act or the Environmental Information Regulations 2004”

Contractors to social housing providers should: review the contracts they have with social housing providers, assess the information they are holding in relation to their contracts with social housing providers; explore and document how this information is managed and catalogued; and detail the work required to ensure information handling complies with the FoIA. They need to assess their ability to respond to information disclosure requests made under the FoIA and bear in mind that the bill empowers the Information Commissioner to have powers of entry and inspection over contractors and extends the offence of altering records with the intent to prevent disclosure to include any contractors.

Fortunately, much work will already be in place to regulate, control and monitor the processing of personal data in housing providers and their suppliers – the trick will be to extend some of these measures to cover FoIA information. For a couple of days work, such an assessment is likely to be time well spent if the bill passes into law.

Philip Brining

How can DPP help?

DPP can provide the following:

  • Management briefing about the FoIA and its effects (2 hours);
  • Assessment of information handling arrangements and advice on creating a publication scheme (2 days);
  • Assessment of information rights request handling arrangements and advice on modifying to handle FoIA and EIR requests (2 days);
  • Project to prepare organisation for FoIA (quote on application c20 days.)

Longer term DPP can:

  • Combine FoIA responsibilities in to our outsourced Data Protection Officer and Privacy Officer services;
  • Provide an outsourced FoIA handling and response service;
  • Provide a FoIA support desk to provide advice about FoIA;
  • Undertake FoIA compliance audits;
  • Assist in the development of a FoIA compliance action plan.

** UPDATE 11/10/2019 **

The prorogation of Parliament earlier this week by Prime Minister Johnson has killed off the FoIA extension bill for now.  It will make no further progress unless re-introduced to parliament in a future parliamentary session.

[1] Britain – a secret history BBC News 24th July 2003

[2] Official Secrets Act (1889)

[3] Your Right to Know Freedom of Information Cm3818 London The Stationary Office Limited 1997 (“The White Paper”)

[4] Chris Grayling, was critical of the “misuse” of the FoIA in October 2016 saying that it was wrong that the Freedom of Information Act was being used as a research tool to generate stories for the media.