Ethics England Northern Ireland Wales GP practices

Last updated:

Freedom of Information Act FAQ

Read our answers to frequently asked questions about the Freedom of Information Act for England, Northern Ireland and Wales. Separate guidance relating to the law in Scotland is also available.

Important: In the absence of a legal precedent, this opinion is based on the advice available from the Information Commissioner and other legal analyses, rather than case law.

  • The basics

    1. What is the Freedom of Information Act?

    The Freedom of Information Act 2000, created new rights of public access to information held by public authorities, as defined under the Act. The Act only applies to England, Wales and Northern Ireland. A separate Freedom of Information Act applies to Scotland.

    The Act specifically defines general practice contractors providing general or personal medical services as public authorities in respect of information relating to the provision of those services; APMS practices are not designated as public authorities. The Information Commissioner, who regulates the Act, has ruled that Practices may act co-operatively within their practice structure to discharge their obligations under the Act.


    2. What does this mean for practices?

    The Act obliges each practice to respond to requests about the information that they hold and have recorded in any form and creates a right of access to that information.

    Practices must: (i) have a publication scheme in place (ii) respond to individuals’ requests for information.


    3. What is the publication scheme?

    The Model publication scheme is available on the ICO website. It must be adopted in full, unedited and promoted alongside the guide to information. Public authorities are not required to inform the ICO that they have adopted the scheme; it will be assumed that they have done so.

    A publication scheme commits an authority to make information available to the public as part of its normal business activities.

    This is a very general scheme based on the principal that all public authorities need to recognise the public interest in the transparency of the services provided for and paid for by the general public. It is a commitment to make information easily available to the public.

    The scheme lists information under seven broad classes, which are:

    • who we are and what we do
    • what we spend and how we spend it
    • what our priorities are and how we are doing
    • how we make decisions
    • our policies and procedures
    • lists and registers
    • the services we offer.

    The ICO has provided a template guide for general practitioners.


  • Procedures

    4. Who can request information?

    Under the Act, any individual, anywhere in the world, is able to make a request to a practice for information. An applicant is entitled to be informed in writing, by the practice, whether the practice holds information of the description specified in the request and if that is the case, have the information communicated to him. An individual can request information, regardless of whether he/she is the subject of the information or affected by its use.


    5. How should requests be made?

    Requests must:

    (i) be made in writing (this can be electronically e.g. email/fax)

    (ii) state the name of the applicant and an address for correspondence

    (iii) describe the information requested.

    A practice must comply with a request within 20 working days. Where a fee is required (see below), the deadline will be extended until the fee is paid.

    If the practice transfers the request to another public authority, for example, NHS England or the Area Team, then they also have 20 working days from receipt of the request to respond.

    The applicant can request a copy of the information, ask to inspect the information or request a summary of the information. The Act requires practices to try and provide the information in the requested format. A practice is not obliged to comply with repeated or vexatious requests for information. Therefore a practice can refuse to supply identical or substantially similar information to any one person if a reasonable time has not passed since the previous request.


    6. If a member of the public requests information, but their request is unclear and the Practice has to contact the applicant to clarify the information requested, does this affect the 20 day rule?

    Yes. If a practice subsequently has to contact an applicant to gain further information regarding the content of the request, then the 20 day response period is deemed to have started when the practice are quite clear of the information they are being asked to provide, not from the time of the original request. If the practice does not receive further information from the applicant, which is reasonably required, then the practice is not obliged to comply with the request.


    7. What is the process if practices do not want to disclose information?

    Practices can only refuse to comply with the Act if one of the exemptions applies (see question 11).

    GPs must issue a refusal notice to the person requesting the information. This refusal notice must deal with each request for information, stating clearly upon what grounds the GP is refusing to disclose. NOTE: This is important because the Information Commissioner will rely on the grounds stated in the refusal notice when making a decision, if approached.

    The refusal notice should state clearly what the appeals procedure is for a requestor, should he/she wish to contest the decision.

    Practices should have an internal appeals procedure in place as requestors will not be able to approach the Information Commissioner for a decision unless internal appeals procedures have been exhausted. This effectively gives both parties time to reconsider before the matter is elevated to the Information Commissioner.

    If referred to the Information Commissioner, the Information Commissioner will make a decision and inform the practice.

    If the Information Commissioner requires further information before making a decision, the Practice will be issued with an information notice detailing what further information is required.

    If a practice fails to respond to a decision notice, an enforcement notice will be served and noncompliance could be regarded as contempt of court, for which a judge may impose an unlimited fine or imprisonment. An appeals process is included in the Act.


    8. Are practices required to forward information to NHS England in order to fulfil requests made to NHS England under the Freedom of Information Act?

    On receiving a request for information any public authority must first ask whether or not it holds that information. If the authority has reason to believe that it does not hold the information, but that it is held by another public authority (e.g. the practice) then it is not obliged to obtain the information from the practice for the applicant. NHS England should forward contact details to the applicant for the relevant authority.

    In some cases the authority may consider it appropriate to transfer the request to the relevant public authority. For further information please refer to Section 45, Part III, transferring requests, paragraph 19. If this is the case, then the receiving authority has another 20 working days from receipt to respond to the request.


    9. If we publish certain data annually, can we refer requests to this, rather than respond to the individual request?

    If the request matches the information already published, then the authority can refer the applicant to the material already published.

  • The information – should it be disclosed or is it exempt?

    10. Do I need to disclose information that is already available in the practice publication scheme or published elsewhere?

    The majority of the information requested should be covered in the practice publication scheme. Information which can be obtained elsewhere does not need to be disclosed. The practice can then refer the requestor to the appropriate website or publication scheme, for example information which is on the Department of Health website. Also if an individual makes a request for information that is included on the practice publication scheme, the request can be declined. Practices will therefore save themselves time by ensuring arrangements are in place to ensure that their publication schemes are up to date.


    11. What information can practices withhold?

    Some types of information are exempt from the requirement to make them available. These include:

    Absolute exemptions – this includes but is not limited to:

    • personal information, the handling and disclosure of which is regulated by the Data Protection Act 1998.

    Qualified exemptions – this includes but is not limited to:

    • information whose disclosure would harm the commercial interests of the public body or of a third party.

    If a qualified exemption applies, the next step is to decide whether the disclosure satisfies the public interest test:

    The public interest test

    • Information whose disclosure would harm the public good to an extent that is greater than the presumed public good of releasing it.

    It generally appears that the public interest will outweigh non-disclosure where there is a question as to:

    (i) the transparency in the accountability of public funds

    (ii) whether there is proper scrutiny of government actions in accordance with published policy, and;

    (iii) whether public money is being used effectively.

    However, only the exempt part of the document can be withheld.The rest of the document must be released when requested.

    Any use of the exemptions under the Freedom of Information Act should be properly communicated to the applicant in a refusal notice. This should state whether the information is held and why it is believed to be exempt from disclosure under the Act.

    It is important to note that in all instances where exemption is used and information is not disclosed, the applicant will be able to challenge this decision primarily through the complaints procedure of the public authority and then via the Information Commissioner.

    If a practice needs time to consider whether a public interest test applies, then the 20 day rule is extended for a reasonable period.


    12. What is a vexatious or repeated request?

    The Freedom of Information Act also allows practices to refuse to fulfil a request for information in cases where it is deemed to be ‘vexatious’ or ‘repeated’. It is necessary to apply this exemption fairly and consistently as practices may need to defend their decisions. The term ‘vexatious’ is not clearly defined in the Act, but the Information Commissioner has published guidance on the Information Commissioner website, and in Awareness Guidance No. 22, on which the following is based.

    A request may be vexatious if:

    • The applicant makes clear his or her intention is for the purpose of annoying the practice in retaliation/annoyance then this would be grounds for refusal.
    • The request does not have any serious purpose or value. If a patient was making a complaint about a doctor’s treatment, and asked for information regarding similar complaints, this could be a valid request. If said patient sought information regarding every complaint levied at the practice, including other doctors, the cleanliness of the cloakroom etc., such information may be seen to have no serious purpose or value in relation to the initial complaint, and hence may be seen as vexatious.
    • The request can fairly be characterised as obsessive or manifestly unreasonable. This is a very difficult category to define, but it is possible that practices will get repeat perpetrators of vexatious requests, and it is possible that the practice will have had continued contact with the applicant. This is not to say that the request is for the same information each time, (which could be refused as a repeated request), however, over a period of time a practice may decide that the number of requests from one person is designed to be a nuisance and so choose to refuse information for this reason.

    These are by no means exhaustive, but a rather designed to aid practices in the interpretation of Section 14.


    13. Who decides if a request is vexatious?

    It is to be decided within the practice whether or not a request is vexatious, however, the GPC would recommend that even when a competent staff member has decided that a request is most likely vexatious, it is advisable to refer the decision to a senior staff member/partner, given that the judgement may be contentious and have to be defended.


    14. We have been asked to provide information on the number of cases of mumps, measles and rubella, and also on the uptake of the MMR jab by a local newspaper. We only hold this information in individual records. We could find out this information, but are we required to extract it under the Act?

    If a practice holds raw data and receives a query for analysis it is not required to extract this information in order to provide it to the applicant. In the above scenario, the Data Protection Act would prevent all of the personal records from being disclosable. The time it would take to anonymise all of the records in order to provide the information in the format in which it is held would almost certainly take the cost over the appropriate limit, which means that the practice could refuse to provide this information.


    15. What is the difference between disclosures under the Data Protection Act and the Freedom of Information Act?

    Put simply, the Data Protection Act covers personal data, the Freedom of Information Act covers any other information held by the practice e.g. procedures, governance etc. On the whole, if an applicant asks to see personal data this would be exempt under the Freedom of Information Act. The applicant would need to submit a subject access request under the Data Protection Act. The Information Commissioner has advised that personal information can be released under the Act, in so far as the personal information is related to that person’s role in the public authority and where disclosure does not breach any of the Data Protection Principles. An example would be NHS Salary pay bands. Further information can be found on the Information Commissioner’s website.


    16. Do individuals have a right to access information held about themselves under the Freedom of Information Act?

    If the applicant is requesting personal information about themselves or another person then there is no right to know under the Freedom of Information Act. However, such requests may become requests under the Data Protection Act and should be treated accordingly.


    17. Do internal emails need to be disclosed under FOIA?

    The Information Commissioner has advised that the Freedom of Information Act provides a general right of access to information held by Public Authorities, regardless of the form in which the information is held. Internal emails may therefore need to be disclosed under the Act. Do not forget that some of the information contained in the emails may be exempt, and other information may be supplementary to the boundaries of the request. Such information does not need to be disclosed. Emails can be deleted during the normal course of business, however, emails must not be deleted with the intention of evading disclosure. It is good practice for practices to have a retention and disposal of documents, including emails, policy.


    18. If a member of the public requests information regarding a work in progress, do we need to disclose this information eg draft documents/meeting notes if a decision is yet to be made?

    As outlined in question 17, the advice from the Information Commissioner states that information must be disclosed regardless of the form in which it is held. Draft documents/meeting notes may therefore need to be disclosed unless otherwise subject to an absolute or qualified exemption (see question 11). Information intended for future publication is usually exempt.  

  • Financial questions

    19. Does this mean that practices will have to make their income public information?

    There is a particular expectation that public authorities will account for how they spend public funds. There can be no argument about the fact that a practice’s NHS funding represents public money, as does the expenditure on drugs prescribed by the clinicians in the practice. Only if a practice can make a cogent case that its commercial interests would be harmed by disclosing details of the public money it is responsible for spending would it be justified in not disclosing that information.

    It should be noted that the level of disclosure agreed for the publication scheme would not allow an individual GP’s personal income to be calculated. When completing the model scheme practices may prefer to use the phrase “total practice funding”, rather than “total practice income”. Clearly the more information that appears in the publication scheme the fewer requests for specific pieces of information the practice may have to respond to.

    It is not necessary for practices to disclose information personal about themselves, for example, their private income or pension contributions. Such information is exempt under the Data Protection Act. Personal information about someone other than the applicant is referred to as third party data.

    The Information Commissioner addresses this issue in his Awareness Guidance, No.1 “In thinking about fairness, it is likely to be helpful to ask whether the information relates to the private or public lives of the third party. Information which is about the home or family life of an individual, his or her personal finances, or consists of personal references, is likely to deserve protection…. The exemption should not be used as a means of sparing officials embarrassment over poor administrative decisions”.


    20. Will practices be able to charge fees for access to information?

    Practices will not be able to charge fees for access to information unless it costs more than £450 to retrieve and collate the information. Practices will, however, be able to charge any reasonable costs for copying, printing, postage and other disbursements. If the practice calculates that it will cost more than £450 to determine whether the information is held and to locate, retrieve and extract the information, then the authority can charge up to £25 per hour per staff member. If the costs are less than this £450 limit, then the authority can charge for the photocopying and postage of the information, but not the retrieval.

    The GPC recommends that postage and photocopying should be charged at cost. If the cost of providing the information is estimated to cost over £450 then the authority is not obliged to provide the information, it can refuse to comply or charge the appropriate fee.

    It is the duty of the practice to inform the applicant of the costs before providing the information, and the information can be withheld until the fee is received. If the fee has not been received within three months of notification then the request is seen to have lapsed.

  • Further guidance

    21. What are Sections 45 and 46?

    The Lord Chancellor has produced two additional codes of practice entitled Section 45 and Section 46.

    Section 45 sets out the practices which public authorities should follow when dealing with requests for information. The following five areas are covered:

    • the provision of advice and assistance to persons making requests for information
    • transferring requests for information
    • consultation with third parties
    • freedom of information and confidentiality issues
    • complaints procedures

    Section 46 gives guidance in Part I on good practice in records management. Part II gives guidance on the review and transfer of public records to Public Records Offices and to places of deposit. Sections 45 and 46 can be found online.


    22. Where can I access further information?

    Further information is available online at the following websites:

    Information Commissioners Website

    NHS Freedom of Information Website

    The Freedom of Information Act 2000 Regulations

  • GPC quick reference and flowchart

    1. The Freedom of Information Act creates a right of access to recorded information.
    2. Recorded information is any information that a public authority may hold with the exception of information that has not yet been committed to record i.e. onto paper, tape, electronically. Recollections or opinions, unsupported by documentary evidence would not be considered ‘recorded information’
    3. On the whole, e-mails, correspondence, letters and minutes should therefore be disclosed.
    4. The Lord Chancellor has issued a Code of Practice on the management of records including electronic records, and it is advisable for every public authority to adhere to an effective filing system which creates authentic records and is able to track those records and dispose of those records as a normal course of business. The fact that somebody has not created a proper filing system, whether electronic or not, is not a justification for non-disclosure.

    When a request is received GPC suggest the following procedure is followed:

    1. Consider whether the request covers information which would be disclosable under the Freedom of Information Act.
    2. If the above does not clearly apply, does the information requested fall within one of the absolute exemptions? If so, then it is not disclosable and a refusal notice should be issued stating the reasons for nondisclosure.
    3. If it does not fall within an absolute exemption, is it caught by one of the qualified exemptions? If so, then the public interest test must be considered. When the public authority is considering this test and/or obtaining legal advice as to its application, the public authority may inform the requester and will be allowed “reasonable time” to revert back to the requester outside of the 20 day period. If it is within the public’s interest that the information be disclosed then it is disclosable. This is usually the case where public spending is concerned, although there are other criteria. If it is considered that it is not within the public interest, then it is non-disclosable and a refusal notice giving full reasons must be issued and sent to the requester.
    4. If the request is vexatious i.e. is repeated or is substantially similar to a previous request and/or is designed to inconvenience the recipient or cause annoyance or distress and/or is irrelevant, a refusal notice can be issued on these grounds.
    5. If the information cannot be identified or located without further information, then the public authority must ask for further clarification from the requester and then the 20 day time limit does not begin to run until that information is received.
    6. If you have disposed of the information within the ordinary course of business whilst clearing your papers and emails then this is not disclosable. You will need to have a robust disposal policy. Emails should not be deleted with the intention of evading disclosure. This is a criminal offence carrying a maximum £5000 fine and prosecution in the Magistrate’s Court.