The ICO exists to empower you through information.

Determining whether we hold information

Share

About this detailed guidance

This guidance discusses when information falls within the scope of an information request and is written for use by public authorities. Read it if you have questions not answered in the Canllaw i Ryddid Gwybodaeth, or if you need a deeper understanding to help you determine what information you should consider for disclosure.

In detail

What does this guidance cover?

The guidance covers what the legislation requires you to do. It also sets out actions which, whilst not required by the legislation, the ICO considers to be good practice. Following good practice helps requesters exercise their rights effectively. It can also reduce the demands they make on you and the likelihood of them requesting a review or making a complaint to the ICO.

The ICO has produced separate guidance for determining whether you hold environmental information for the purposes of the EIR. You should consult that guidance if you believe the requester is seeking environmental information. Whilst most of the basic principles are the same, there are some important differences.

There are two main scenarios where this guidance is likely to useful:

  • When you believe that you do not hold any information within the scope of the request (or any more information) and want to explain why.
  • When you know that particular information physically exists but you are unsure whether you “hold” that information for the purposes of the legislation.

In most circumstances, your first step when you receive an information request should be to determine what information you hold.

Remember that you usually still have to tell a requester whether or not you hold information relevant to their request, even if you are withholding it.

Read the ICO’s guidance on when to refuse to confirm or deny to find out more about when to tell a requester what information you hold.

What does the legislation say?

Section 1(1) of the Freedom of Information Act (FOIA) states:

“Any person making a request for information to a public authority is entitled—

(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and

(b) if that is the case, to have that information communicated to him.”

Section 1(4) of FOIA states that information a requester is entitled to under section 1(1) is:

“the information in question held at the time when the request is received, except that account may be taken of any amendment or deletion made between that time and the time when the information is to be communicated under subsection (1)(b), being an amendment or deletion that would have been made regardless of the receipt of the request.”

Section 84 of FOIA defines “information” as:

“information recorded in any form”.

You must carry out appropriate searches to determine what information you hold, regardless of whether the request falls under FOIA or the Environmental Information Regulations (EIR). However, when you are satisfied that you do not hold any relevant information, the way you communicate this to the requester depends on the legislation.

Under FOIA, if you decide that the information (if it existed) would not be environmental, you need to tell the requester that you do not hold information within the scope of the request. This applies unless an exemption enables you to neither confirm nor deny holding the information.

It is good practice to explain, if you can, why you consider that you do not hold the requested information. Clearly demonstrating why you do not hold a particular piece of information means the requester is less likely to ask for an internal review or complain to the ICO.

Example

In decision notice FS50735763, the Foreign & Commonwealth Office was asked for a copy of a former Foreign Secretary’s letter to the European Commission. The complainant believed such a letter existed, because the Commission had issued a “response” addressed to the Foreign Secretary. It was only once the matter reached the Commissioner that the FCO explained that it was convention that all letters from the Commission were addressed to the Foreign Minister of the relevant state – regardless of the matters involved or the part of the national government it was responding to. The Commissioner concluded that it was extremely unlikely that the FCO would have responded because the original letter probably went to a different government department for a response. Had this been explained earlier it may well have avoided a complaint to the Commissioner.

How do we show that we have provided all the information we hold?

There will be occasions where a requester disputes that:

  • you don’t hold particular information; or
  • you have provided all the information you hold.

In these circumstances, it is important to demonstrate that you have carried out reasonable searches to identify all the relevant information that you hold.

Before you begin your search, you should make sure you understand exactly what it is you are searching for. You should ask the requester to clarify exactly what they are seeking, if:

  • you don’t understand the request;
  • the request could have more than one meaning; or
  • the request is so broad you don’t know where to begin searching.

Our guidance on interpreting and clarifying requests may help you decide when this is necessary.

The search

How much searching you need to do depends on the nature of the request and how you hold your records.

Example

In Bromley and others v Information Commissioner EA/2006/0072, the First-tier Tribunal considered how far the Environment Agency should be expected to search for information before concluding it had located all the information it held. The Tribunal commented that:

“There can seldom be absolute certainty that information relevant to a request does not remain undiscovered somewhere within a public authority's records. This is particularly the case with a large national organisation like the Environment Agency, whose records are inevitably spread across a number of departments in different locations. We think that [the balance of probabilities] requires us to consider a number of factors including the quality of the public authority's initial analysis of the request, the scope of the search that it decided to make on the basis of that analysis and the rigour and efficiency with which the search was then conducted. Other matters may affect our assessment at each stage, including, for example, the discovery of materials elsewhere whose existence or content point to the existence of further information within the public authority which had not been brought to light. Our task is to decide, on the basis of our review of all of these factors, whether the public authority is likely to be holding relevant information beyond that which has already been disclosed.”

The Bromley case determined that it was acceptable for the Commissioner to rely on the results of a public authority’s searches – providing that those searches were appropriate and thorough. This principle has been consistently applied in Tribunal judgements since then and informs our approach to such cases.

We don’t expect you to search all of your filing cabinets or computers before determining that you don’t hold information. However, you should search those areas where it is reasonable to expect that you would find the information (if it existed). The broader the request, the more areas you are likely to need to search.

Example

If you receive a request for correspondence about a cleaning contract, it would be reasonable for you to search your finance and procurement records. It is likely to be unreasonable for you to be expected to search your patient or customer records.

Good records management is important because it makes your searches quicker. If your records are well organised, you are less likely to miss important information. It is then more likely that the requester accepts the outcome if you determine that you do not hold some or all of the requested information.

You may find the section 46 code of practice on records management helpful in improving your records management practices.

If the requester disputes that you located all the relevant information, they may take their complaint to the ICO, following an internal review.

How does the ICO determine such complaints?

If the ICO receives a complaint disputing the amount of information you hold, we will expect you to provide a reasoned and detailed account of how you determined that you do not hold further information.

The ICO is not required to prove beyond doubt that you do or do not hold further information. When determining a complaint, the ICO makes a decision based on the civil standard of the “balance of probabilities” - that is, more likely than not.

Example

In O’Grady v Information Commissioner EA/2019/0318/P, Mr O’Grady argued that the Commissioner should have based a decision on the criminal, not the civil, standard of proof. The Tribunal rejected this approach saying that:

“The normal burden of proof applied by the information rights tribunal (and the Commissioner) is the civil standard, i.e. the balance of probabilities. There is no binding authority which has directly considered the issue of the appropriate standard of proof in the Information Rights Tribunal. However, I conclude that the tribunal, and for the same reasons the Commissioner, is right to apply the civil standard of proof.”

When deciding whether it is more likely than not that you have located all relevant information, the ICO looks at whether your search is a reasonable one. As well as considering the circumstances of the case, the ICO also takes into account the following:

  • Have you correctly identified the scope of the request?
  • What searches have you undertaken? Are they reasonable, and why?
  • Are there any business reasons why you should hold the information? Or any evidence suggesting that you do hold it?
  • Is there a legal requirement for you to hold this information?
  • What does your records management policy say about information of the type specified in the request?
  • Are there any other reasons why you should or should not hold further information?
  • Have you reviewed how reasonable your search was, in light of what has or has not been located or in view of new information?
  • Have you considered if anyone else does or could hold any of the information within scope of the request on your behalf? If so, have you asked them and are you satisfied with their response?

The ICO will ask for this information during the investigation. If you are unable to evidence the searches and enquiries conducted, you may be asked to carry out further searches and enquiries. It is therefore good practice to keep a record of any searches that you have carried out, particularly if the requester thinks you hold more information. You should record the areas of the organisation that you searched and the staff you consulted. If you conduct electronic searches, you should keep a record of the keywords, accounts and time parameters used. 

The ICO’s role is to reach a decision as to whether, on the balance of probabilities, you do or do not hold the particular requested information. We do not decide whether you should hold that information. The ICO recognises that there may be specific circumstances which mean that you do not hold a particular piece of information, even though you should.

However, the stronger the indications that you should hold a particular piece of information, the better explanations you will need to provide as to how you determined that you do not hold it.

Example

In decision notice FS50813877, the complainant requested the make and model of the tape measure used on a planning enforcement visit. The Commissioner accepted the complainant’s argument that the council would be able to examine the tape measures that it had.

However, the Commissioner still concluded that the council did not hold information within the scope of the request because it was unable to identify which of its tape measures had been used on that particular site visit – and it had no business need to record such information.

Sometimes the cost of searching for information may exceed the cost limit. If that is the case, you may wish to consult the ICO’s guidance on requests where the cost of compliance exceeds the appropriate limit.

If the ICO considers that there are gaps in the account you provide, we may ask you to carry out further searches before we can conclude that you do not hold further information.

Do we need to create information to satisfy an information request?

No. FOIA only applies to information that a public authority already holds in recorded form at the time of a request.

If you don’t hold a particular piece of information that someone has asked for, you don’t have to create it. Nor are you required to ask a third party for the information, unless they hold it on your behalf.

Example

“What did Ms X mean when she wrote…?”

“I know that another organisation holds a copy of this report – so why don’t you just ask them for a copy?”

These are examples of information that the public authority in question is unlikely to hold. Information contained in someone’s mind is not recorded information and a public authority is not required to obtain information it doesn’t already hold in recorded form.

There are some circumstances where you may still “hold” information, even though you do not have it immediately to hand when a request is made.

Extracting and compiling information

Sometimes a requester wants a list of documents, schedule of correspondence or a document summary rather than a particular document itself. Whilst you may not physically possess such a document, you would probably still hold the information, because you could compile or extract it from raw data that you possess.

If you have the “building blocks” necessary to produce a particular type of information, it is likely that you would hold that information unless it requires particular skills or expertise to put the building blocks together.

Example

Decision notice FS50070854 concerned a request for information about discussions between the UK and the US on energy policy and oil production. The initial request was for the information on the actual discussions. This was followed up with a request for a schedule of documents falling within the scope of the original request. In respect of the schedule, the Commissioner stated that:

“The information already exists: the public authority cannot be said to be creating it. And, while producing a list of the documents in which the relevant information is contained may be a new task, it is not creating new information; it is simply a re-presentation of existing information…”

Summarising information

Section 11 of FOIA allows a requester to ask specifically for a summary or a digest of particular information. This is not information that you could directly lift from documents in the same way as dates or the document’s author.

You must provide a summary or digest if the requester expresses this preference from the outset and it is reasonably practicable for you to do so.

If you already hold a summary, and it is not covered by an exemption, you should check whether the requester is happy to receive this document or whether they would prefer something more bespoke.

If you are unsure as to exactly what information the requester is seeking, you should ask for clarification. You can also take account of any costs you may incur in providing the information in this particular format.

You may find the ICO’s guidance on the means of communicating information helpful if you receive such a request.

Exercising skill and judgement to compile information

Creating lists and schedules is usually a relatively simple – if time-consuming – task. However, there are some circumstances where you cannot compile information without exercising a degree of skill or judgement.

When you hold information in electronic files and can retrieve and manipulate it using query tools or language within the software, that information is held for the purposes of FOIA. The use of query tools or languages does not involve the creation of new information. Such tools are only a means of filtering existing information.

When deciding whether or not you hold information which has to be derived from raw data, you should consider whether anyone with similar skills or experience would reach the same result if presented with the same set of raw data.

For example, if someone asked you to present a dataset in a graph with a logarithmic scale, you may need to find someone with more advanced mathematical skills to derive the information. However, it should not matter who you ask to carry out the exercise, as anyone with similar knowledge of mathematics should arrive at the same result if presented with the same raw data.

Example

In Michael Leo Johnson v Information Commissioner and the Ministry of Justice EA/2006/0085, the Tribunal considered a request relating to the number of cases dismissed in the High Court. In particular, the applicant sought the number of claims that were struck out by each of the Queen’s Bench Masters for the years 2001, 2002, 2003 and 2004.

The Ministry of Justice (MoJ) had not collated this information at the time of the request. After establishing that the electronic database used by the MoJ did not contain all the building blocks needed, the question of whether it held the information focused on the contents of the MoJ’s manual records. In particular, the Tribunal considered whether the work needed to identify, retrieve and then manipulate the raw data constituted the creation of new information.

To find out how many cases each Queen’s Bench Master had struck out, the MoJ would have needed to go through thousands of files and identify those where a case had been struck out. To complicate matters, there was no consistent way of recording a strike out. For example, some files may simply have referred to a case being struck out whereas others could have referred to there being ‘no arguable case’. In all, four means of recording a strike out were commonly used.

The MoJ argued that there was a need to exercise some judgement as to what files recorded a strike out. Furthermore, even after this raw data had been extracted, it had to be further manipulated; ie, the strike outs had to be allocated to the different Masters, then added up to give a total for each Master. The MoJ argued that this was the creation of new information.

The Tribunal said that:

“… we accept …that the degree of skill and judgement that must be applied to the building blocks may well have a bearing on whether the information is held or whether what is being sought is more properly construed as being new information …”

However, the Tribunal found that identifying references to a strike out was not difficult. It would be easy to brief someone on the four terms commonly used. Nor did the Tribunal consider that the need to perform some simple mathematical calculation involved the creation of new information. The Tribunal therefore found that the MoJ held the information.

Example

In decision notice FS50757134, the requester asked a hospital trust for data on surgical outcomes and whether particular types of surgery had been “successful” or not. The Commissioner accepted that the Trust did not record this type of information and could not compile it without exercising judgement. Compiling the information was not a simple matter of going through every patient’s file to locate particular information. It required specific medical expertise to examine the notes and to decide whether a particular surgical intervention had been “successful” or not. The Commissioner therefore found that the Trust did not hold the information.

Each case is decided on its own specific facts. However, the examples above demonstrate that the level of skill and judgement required to compile particular information determines whether you hold that information. The more you need to manipulate the building blocks and the more subjective the terms of the request, the more likely it is that you will not hold the information.

Example

In Common Services Agency v Scottish Information Commissioner [2008] UKHL 47, the House of Lords found that a public authority would still hold data, even if those data had been “barnardised” (a method of anonymising statistics) for the purposes of the Freedom of Information (Scotland) Act 2002. The relevant provision in Scottish legislation is very similar to that in the FOIA.

Lord Hope of Craighead’s judgement rejected the Agency’s argument that barnardisation amounted to the creation of new information:

“It seems to me that the position that the Agency has adopted to the request in this case is an unduly strict response to what [the legislation] requires. This part of the statutory regime should, as Lord Marnoch said, be construed in as liberal a manner as possible. The effect of barnardisation would be to apply a form of disguise, or camouflage, to information that was undoubtedly held by the Agency at the time of the request. It would amount to the provision of that information in a form that concealed those parts of it that have to be withheld but which would nevertheless, to some degree, convey to the recipient information that was undoubtedly held by the Agency at the time of the request...It would not amount to the creation of new information, nor would it involve the carrying out of any research. It would be to do no more than was reasonable in the circumstances, having regard to the need for the form in which the information was disclosed to comply with the data protection principles.”

There is also an Upper Tribunal decision under the EIR. In Higham v Information Commissioner, the Upper Tribunal ruled that Cornwall Council held figures for the combined cost of three projects. The Council claimed it only held individual figures for each project.

What if the information we have is incomplete or inaccurate?

You still hold relevant information even if you do not hold the complete set of requested data. You also still hold information which contains inaccuracies.

Although you still hold information that may be inaccurate or incomplete, the completeness and the accuracy of the requested information may affect the exemptions which might apply or the balance of the public interest. For example, if a particular piece of information is part of a broader project which you are intending to publish at a later date, it is more likely that the public interest will favour withholding the information until it can be considered in context.

If you are concerned that disclosing the information you hold would provide an incomplete or an inaccurate picture, you should explain this to the requester as soon as possible.

Example

In Home Office v The Information Commissioner EA/2008/0027, the requester wanted to know the total number of work permits obtained in 2005 and 2006 by nine named employers in the IT sector.

The Home Office argued that it could not create the requested information from the raw data that it held. It said it had concerns about the accuracy and consistency with which some of the relevant data fields had been recorded.

The Tribunal rejected this argument, noting that:

“…if the records are faulty or inadequate and the information

turns out therefore to be inaccurate that is irrelevant: the right under the Act is to information which is held, not information which is accurate.”

There will also be occasions where your staff may record information on a discretionary basis, even though there is no business need for them to do so. You would still hold this information, even if it is not collected on a consistent basis.

Example

A council has a number of maintenance teams responsible for the town centre’s street furniture. The role involves planned maintenance as well as identifying other jobs through inspections and responding to reports from the public. On occasions, senior management or finance staff may need to be consulted.

For each job the team manager records the type of street furniture worked on (ie, a bench) the cost and the time taken. It is down to the discretion of the team manager what additional information they record, such as their liaison with other members of the council. Although many jobs involve some interaction with other officers, particularly engineers, most managers only record what they consider to be significant meetings.

The council then receives a request for the number of times maintenance staff consulted with engineers for the last two financial years when installing bollards. The council has recorded information on the number of jobs involving the installation of bollards. However, only a limited number of files record that engineers were consulted. Whilst this is unlikely to present the whole picture, the council must provide the requested statistics based on those records – although it may well wish to add some context when it discloses the information.

What if someone asks for information we can only access online or have read-only access to?

Many public authorities subscribe, or have access to, online resources to aid and inform their work. Whether or not you hold such information depends on the nature of the subscription or access you have to the information.

Example

In Glen Marlow v the Information Commissioner EA/2005/0031, the Tribunal considered the extent to which a council held information in an online legal library that it subscribed to. The Tribunal differentiated between the information that the public authority had selected for use and all the other information held within the database.

It found that information selected, downloaded and saved to the public authority’s own computer was held, as was information printed off from the database. However, the remainder of the information on the database was not held by the public authority.

In reaching its decision in the above case, the Tribunal took account of the council’s subscription to the database. In this case, the terms of the council’s licence were quite restrictive. The Tribunal did not rule out the possibility that a public authority would hold the entire database it  subscribed to, if it had a completely unrestricted right to use and exploit the contents. However, in practice this is unlikely to occur. Generally, you would not hold information from a third party’s database or other online resources, unless you have downloaded, saved or printed it out.

Example

In Alan Dransfield v the Information Commissioner and Devon County Council EA/2010/0152, the applicant sought information held in the maintenance manual for a school constructed under a private finance initiative. The developer was responsible for building and then maintaining the school. The manual was held remotely and the public authority only had access to the manual to check that the developer was honouring its contract by updating it and maintaining the school properly. The public authority had no other right of access and could not download or copy the manual.

The Tribunal found that the public authority did not hold the manual and that it was held by the developer for their own purposes.

Similarly, you may be one of a number of public authorities contributing information to a central electronic repository. You can access each other’s information, but on a read-only basis. For the purposes of FOIA and the EIR, you would only hold the information that you had put into the repository yourself.

If you receive a request for the contents of an entire repository, you should, as a matter of good practice, inform the requester that other public authorities would hold some of the information. You should then explain how the requester could contact those public authorities.

There is no FOIA requirement to transfer the request to the other public authorities involved (as you may do under the EIR). Therefore we would not recommend doing so without the explicit consent of the requester.

If you are considering establishing a shared electronic repository with other public authorities (or joining an existing one), it would be advisable for you to reach an agreement about how to deal with information requests for the repository’s contents.

Example

In decision notices FER0701278 and FS50701559, the Commissioner considered whether two parish councils held information stored in an electronic repository.

A group of four parish councils along with a district council and a planning consultant were collaborating on a neighbourhood plan. As part of this project, the consultant created a document repository using Dropbox to share documents with the four parish councils.

The Commissioner found that the two parish councils concerned did not hold the information stored in the Dropbox folder. This was because they had not uploaded any information to the Dropbox folder themselves and had not downloaded the information already stored there.

Can someone ask for information on the properties or metadata of an electronic document?

Documents created electronically contain information about the life of the document.

Details are recorded and stored with a file, such as:

  • the author;
  • dates;
  • editing history;
  • size;
  • file paths;
  • security settings; and
  • any email routing history.

This information is known as “metadata” and is accessed via the file properties.

Metadata is recorded for the business purposes of the public authority and can be used in records management. The code of practice on the management of records issued under section 46 of FOIA promotes the recording of metadata at paragraph 2.3.3. You will hold this metadata for the purposes of FOIA.

In addition, when you produce an electronic document, information on its formatting is automatically recorded. This includes information such as the fonts used, headings and other style settings. You can view this information in the relevant format menus of the software program. As with metadata, you would hold this information for the purposes of FOIA.

If a requester asks for this type of information specifically, you must disclose it – unless you believe that an exemption allows you to withhold it. However, you are not required to supply this information unless it is specifically requested.

Example

“Please provide the final Word version of the letter that your Chairman sent to Organisation A. I want to see the date that this letter was created so please make sure you include the electronic properties of the original document.”

If you received the above request you would need to consider disclosing the metadata. There might be an exemption which would allow you to withhold this information but, if there isn’t, you would need to disclose it. However, if the requester only asked “please provide me with a copy of the letter your Chairman sent to Organisation A” you would not be obliged to provide the original metadata.

What if we have amended or deleted some of the requested information since we received the request?

Section 1(4) of FOIA states that the information you must provide to the requester (or confirm whether or not you hold) is:

“the information in question held at the time when the request is received, except that account may be taken of any amendment or deletion made between that time and the time when the information is to be communicated under subsection (1)(b), being an amendment or deletion that would have been made regardless of the receipt of the request.”

The way the legislation is worded means that you don’t need to stop your normal processes of amending, updating or deleting records until you have responded.

Criminal offence

Section 77(1) of the FOIA states that:

“Where –

(a) a request for information has been made to a public authority, and

(b) under section 1 of this Act or section 7 of the Data Protection Act 1998, the applicant would have been entitled (subject to payment of any fee) to communication of any information in accordance with that section,

any person to whom this subsection applies is guilty of an offence if he alters, defaces, blocks, erases, destroys or conceals any record held by the public authority, with the intention of preventing the disclosure by that authority of all, or any part, of the information to the communication of which the applicant would have been entitled.”

Section 77(3) of the FOIA states that:

“A person guilty of an offence under this section is liable on summary conviction to a fine not exceeding level 5 on the standard scale.”

Do not delete or amend requested records so that you don’t have to disclose them. It is a criminal offence under section 77 of the FOIA to deliberately do any of the following to information to prevent disclosure of information that has been requested:

  • destroy;
  • deface;
  • alter;
  • conceal; or
  • block,

Having good records management policies and following them consistently helps you to show that your actions were reasonable, should there be a dispute about what information you should provide.

You may also find the ICO’s guidance on the retention and destruction of information useful.

Example

The Department for Works and Pension (DWP) receives a request for the number of people claiming a particular benefit. The request is received on Friday 20 January. The total is regularly updated on the first of every month. Eight working days after receipt of the request, on Wednesday 1 February, the public authority would produce the new total for those claiming the benefit.

If the DWP does not respond to the request until Friday 3 February it can provide the new updated statistics.

In this example the public authority’s normal course of business is not interrupted and the applicant receives the most recent figures available.

Generally, the starting point when determining whether you hold information is to consider what you held at the time of the request. However, the ICO is aware that, in reality, it is seldom possible for you to deal with requests on the day that you receive them. Section 1(4) enables you to consider the information you hold at the point you actually start to deal with the request – providing that this is within the statutory time for compliance.

This is sometimes advantageous to requesters because you would consider the updated information as part of your response. However, there will be occasions when a requester is disadvantaged by a routine amendment. For example, it may be that the requested information is about to be deleted completely in accordance with your records management policy.

In many cases, you would still hold both the original and the updated version of the information at the time you answer the request. In the example above, the DWP may retain a copy of the benefit figures from previous months. Even if it deleted the previous totals, the information may still be held in a recycle bin.

If you know that you are due to update some of the information, it is good practice to clarify with the requester what information they wish to have. For example, if someone asks for your complaints policy and you know it is due to be updated very soon, you may wish to clarify whether the requester wants to receive the old version, the new version or both.

There will be other situations where a requester wants to verify what information you held at a particular time. Information you have amended since then would not meet their needs. A requester can always specify a particular date; in the DWP example above, the applicant could have requested the figure for those claiming benefit as of 20 January. This would not prevent the DWP from carrying out its planned amendment, but the amended figure would no longer meet the description of the information requested. Therefore, the DWP would need to look at whether it still held the previous total or whether it had been deleted.

Example

In Paul Harper v the Information Commissioner and Royal Mail Group Limited EA/2005/0001, the Tribunal pointed out that whilst section 1(4) provides that a public authority may take account of any routine amendment, it does not state that a public authority must take account of such an amendment. This means that a public authority will comply with FOIA whether it provides the original or the updated version of the information.  

However, the Tribunal also commented that:

“…where the deleted or unamended information is still readily accessible and this is the information that the applicant wants, then the deleted or original version of the information should be recovered and that is what should be communicated to the applicant, with perhaps an explanation of what has happened to the information since the request was received.”

What happens if someone requests information that we have already deleted?

The ICO recognises that it is neither practical nor desirable for you to indefinitely retain every piece of information you create or acquire. Good records management requires you to delete information that no longer serves a useful purpose.

However, there will be occasions where a requester asks you for information which you once held, but deleted prior to receiving the request.

The ICO accepts that it would be reasonable for you to interpret most requests as relating to your ‘live’ records or those held in archives. However, if a requester refers to an old or previous version of a document or otherwise makes it clear that they expect you to provide ‘deleted’ information, you will then need to address this issue in your response.

When is deleted information not held?

The process of deleting paper records is usually straightforward: you can shred or incinerate files and the information is permanently destroyed. It is not as easy with electronic information. Deletion is usually a three-stage process:

  1. Move information to a recycle bin or wastebasket.
  2. Delete it from the recycle bin.
  3. The space it occupies on the computer is now designated as free which means you can overwrite it with new information.

The information is only completely erased and therefore not held once it has actually been overwritten.

Example

The basis for this approach is to be found in the case of Catherine Whitehead v the Information Commissioner EA/2013/0262. This case concerned a request for specific correspondence which the public authority, in the Tribunal’s view, accepted was likely to be held on a backup tape or recoverable from its server. The Tribunal said that “if requested information is in (or on) back-up tapes which are themselves held by the public authority or is in some other way still stored on the public authority’s server, we consider that it is clearly “held” by the public authority.”

In this way, the Tribunal was stating that the test to be undertaken is whether the information is held “as a matter of fact”.

The Upper Tribunal has not (to date) considered a case involving the deletion of information. However, in University of Newcastle upon Tyne v Information Commissioner and British Union for the Abolition of Vivisection [2011] UKUT 185 (AAC), the Upper Tribunal found that, when considering whether information was held, in the context of the FOIA, the word “‘hold’….is an ordinary English word and is not used in some technical sense in the Act.”

In other words, whether you hold information is determined as an issue of fact.

Should we always search for information that may have been deleted?

The ICO considers that it would be unreasonable for you to restore your system from backup every time you receive an information request, just in case you may hold some information. Taking such an approach would be likely to result in requests unnecessarily exceeding the cost limit.

If your initial search identifies that you may have deleted relevant information, you need to consider this matter as part of your overall response to the request.

However, if there is no indication that you deleted significant information , searches of your ‘live’ systems and any records held in relevant archives that you maintain are likely to be sufficient.

You should also consider your own IT policies. Some organisations have policies in place which govern how long they retain backup tapes for or when they permanently wipe disk space. If you can demonstrate that such policies are in place and that any relevant information that had existed would have been permanently deleted, you are unlikely to be expected to carry out further searches.

However, whilst it is likely that you would “hold” information if it is retained in backup files, you can take account of the cost of recovering deleted information, if you believe that it is reasonable for you to search for such information.

Clarifying exactly what the requester wants also helps you avoid unnecessary work. Advising and assisting a requester about what information you can identify easily would usually be preferable to refusing the request. Many requesters are happy not to receive deleted information, particularly if this prevents their request from exceeding the cost limit.

Can we take account of costs when deciding whether we hold information?

If you hold information, you hold information – regardless of how long you have to spend compiling or searching for it. Whether or not you hold information is a matter of fact.

However, there are situations where the process of compiling information or determining whether you hold the information would be lengthy or costly. In those situations, you may wish to consider if section 12 of the FOIA applies.

For more detailed guidance on what costs you can consider when applying the cost limit, you should consult the ICO’s guidance on requests where the cost of compliance exceeds the appropriate limit.

If you are considering relying on section 12, you must also consider what advice and assistance you can offer the requester to help them refine their request within the cost limit.

Other considerations

This guidance is designed to help you understand the issues that the ICO considers when determining a complaint, to help you decide whether or not you hold particular information when first responding to a request. It cannot cover every possible set of circumstances and the ICO determines each complaint on its own individual merits.

You can read examples of decision notices that the ICO has previously issued, to see how we apply our approach in practice, by visiting our decision notice page.

Further reading

The following pieces of guidance may also be useful to you: