ICO Enforcement Action Log (partially) disclosed

The Information Commissioner's Office has released a version of its 'Enforcement Action Log' (aka the 'Watch List') which records cases where the ICO's Enforcement Team is engaged with a public authority because of systemic, repeated or serious non-compliance with the FOI Act or EIRs. The request for the log was made via the whatdotheyknow site.

The released version does not contain details of open enforcement cases - the ICO has cited s.31(1)(g) and s.31(2)(c) to withhold these.

The ICO's response to the request states:

Typical issues which may make such engagement necessary are:

- serious or repeated failures to meet the requirements of section 10 (1)

- regular and / or unwarranted extensions to the time for compliance (e.g. Public Interest Test), with particular emphasis on those which exceed the Commissioner’s guidance

- serious or repeated failures to issue refusals notices which comply with section 17

- regular and / or unwarranted extensions to the timeframe for internal reviews, with particular emphasis on those which exceed the Commissioner’s guidance

- failure to have an internal review procedure in place, or the failure to operate that procedure in accordance with the recommendations of the section 45 Code of Practice

- internal review procedures of more than one stage

- repeated or serious application of blanket, or obviously inappropriate exemptions (or exceptions)

- repeated failure to engage with the ICO’s investigations, or repeated delays in that engagement

- repeated failure to explain why exemptions (or exceptions) apply

- repeated failures to explain the balance of public interest when qualified exemptions (or exceptions) have been applied

- evidence that the authority is failing to take its responsibilities seriously

- record management failures (section 46 Code of Practice)

- evidence that an authority does not have a sufficient understanding of the Act, the EIR or the Codes of Practice

When patterns of repeated or systemic incidences of poor practice are identified, the Enforcement Team consider whether intervention is appropriate. The team may also intervene in a single case, provided the issues are sufficiently serious. Such intervention is recorded in the
enforcement action log.

Hat tip to Matt Davis who covered this on FOI News.