ICO updates guidance on dealing with vexatious FOI requests following Tribunal criticism

The UK's information watchdog made the recommendation in new guidance it has issued to public bodies on how to deal with vexatious FOI requests. (37-page / 413KB PDF)

Under UK FOI laws anyone of any nationality living anywhere in the world can make a written request for information and expect a response within 20 working days. The public authority is obliged to meet that request unless exemptions apply or unless meeting it will be too costly or difficult. Public bodies can decide not to provide information requested if they deem the request to be vexatious.

Previous guidance the ICO had issued on dealing with vexatious requests had been criticised as being of limited use to public bodies by a judge in a case ruled on by an Information Rights Tribunal earlier this year. The judge, Nicholas Wikeley, therefore suggested public bodies should consider "four broad issues or themes" when considering whether FOI requests are vexatious or not.

Wikeley said that public bodies should consider the burden complying with the request would bring on it and its staff; the motive of the requester; the value or serious purpose of the request and if dealing with the request would cause any harassment of or distress to staff.

The ICO has now expanded on the proposals laid out by the judge in new guidance on dealing with vexatious requests.

"The Tribunal concluded that ‘vexatious’ could be defined as the “…manifestly unjustified, inappropriate or improper use of a formal procedure'," the guidance said. "The Tribunal’s decision clearly establishes that the concepts of ‘proportionality’ and ‘justification’ are central to any consideration of whether a request is vexatious. This being the case, we would suggest that the key question the public authority must ask itself is whether the request is likely to cause a disproportionate or unjustified level of disruption, irritation or distress."

The ICO said that public authorities are "free to refuse a request as vexatious based on their own assessment of all the relevant circumstances" but it suggested some "indicators" that the bodies could look for when making their determinations.

Indicators that requests are vexatious are if they include abusive or aggressive language, if requesters can be said to bear a personal grudge or make "completely unsubstantiated accusations against the public authority or specific employees", or if requests from individuals are unreasonably persistent, frequent or overlapping, the ICO said.

The watchdog also said that another indicator – that dealing with a request would be overly burdensome – can be characterised as meaning that "the effort required to meet the request will be so grossly oppressive in terms of the strain on time and resources, that the authority cannot reasonably be expected to comply, no matter how legitimate the subject matter or valid the intentions of the requester".

Public authorities cannot, though, determine that an FOI request is vexatious on the basis that the requester is vexatious, the ICO said.

The watchdog has separately issued guidance on how public bodies can determine whether requests for environmental information are manifestly unreasonable under the Environmental Information Regulations. (14-page / 319KB PDF) In his ruling Wikeley said that he could "see no material difference" between what is meant by 'vexatious' and 'manifestly unreasonable' in the context of the FOI and EIR regimes.

The ICO has also issued guidance on how public bodies should deal with repeat requests under the FOI framework. (14-page / 298KB PDF) The FOI Act allows public authorities to refuse to disclose information sought by requesters if the request "is identical, or substantially similar to a previous request submitted by the same individual, unless a reasonable period has elapsed between those requests".

The ICO said that a FOI request can be deemed "substantially similar" to one that has been submitted previously if "the wording is different but the scope of the request is the same; or the scope does not differ significantly from that of the previous request".