The Department of Health (DoH) has failed to offer people seeking information the correct advice and assistance and has delayed vital processes beyond a reasonable time frame, the ICO said.
The ICO said in its formal reprimand, its Practice Recommendation, that some of the problems are the result of not enough staff being trained in how to deal with FOI requests.
"Whilst the Commissioner has no doubt that pockets of expertise in the area of freedom of information exist within the Department, he is concerned that current levels of resource may not support the volume of requests and reviews received," said the Recommendation. "He therefore recommends that the Department review existing levels of resource for FOI and the deployment of that resource."
The ICO said that the DoH was taking too long to process information requests and was not helping people to make their requests as recommended by the Code of Practice of the FOI Act.
"The Department of Health has failed on numerous occasions to offer appropriate advice and assistance to people making requests under the Act and is delaying the conduct of internal reviews beyond a reasonable timescale," said an ICO statement.
"Existing guidance highlights that public authorities should conduct internal reviews within 20 working days (40 days in exceptional circumstances) yet the Department took 90 days in one case and 80 days in two other cases," it said.
The ICO also criticised the DoH for issuing "blanket exemptions" from the requirement to publish, meaning that it said that whole documents were outside the scope of the FOI Act.
The ICO's Practice Recommendation is based on the results of an audit of 40 complained-about requests made to the DoH. It conducted the audit because it had concerns about the DoH's practices after it breached the Act several times in relation to a single request.
A Practice Recommendation is a first step in the enforcement of the FOI Act. A breach of the Recommendation could lead to a breach of the Act itself, which could lead to the ICO issuing an Enforcement Notice. A court can treat a breach of that notice as a criminal offence.
The ICO is continuing its investigations into the DoH on issues not directly covered by this Practice Recommendation, it said. "Other complaints made to the Commissioner suggest that the authority may be failing to meet the expected standards of good practice in relation to records management," it said. "The Commissioner is exploring these issues further."