ICO hits city council with enforcement notice over “systemic non-compliance” with Freedom of Information Act

The Commissioner became aware of concerns regarding the council's compliance with the Freedom of Information Act (FOIA) following information provided about the council's timeliness in responding to FOI requests and the scale of its outstanding caseload.

The council provided information about its performance for FOI requests due between 1 January 2026 and 24 July 2026.

Of those requests, 226 were completed on time, representing 29% of the total; 90 were completed outside the statutory timeframe, representing 11%; and 463 were open and overdue, representing 59%.

The council also provided a spreadsheet setting out individual outstanding FOI requests.

The Commissioner found the oldest recorded request was received on 24 October 2022 and had a request deadline of 21 November 2022.

Outlining its reasons for the enforcement notice, the ICO said: “FOIA requires a public authority to inform applicants whether it holds requested information and, if it does, to communicate that information within 20 working days of receipt, unless a valid exemption or other FOIA provision applies.

“The Commissioner is satisfied that the council has failed to consistently comply with these obligations. The information provided by the council demonstrates a substantial and sustained backlog of open and overdue FOI requests.”

The ICO considered that the figures indicated “more than isolated instances of delay”.

It said: “The number and age of outstanding requests demonstrate systemic weaknesses in the council's request-handling arrangements. Those weaknesses have resulted in persistent non-compliance with the statutory timescales imposed by FOIA and have the potential to undermine the rights conferred on applicants by section 1(1).”

The ICO warned that while operational pressures, staffing constraints, service dependencies or clearance arrangements may explain how a backlog has arisen, they do not remove a council's statutory obligations.

As a result of the investigation, Derby City Council was issued with an Enforcement Notice requiring it to comply with section 1(1) FOIA in respect of the “substantial backlog” of overdue requests, and to ensure that future requests are handled in accordance with the council's obligations under sections 1(1) and 10(1) FOIA.

The council was also ordered to devise and publish an action plan, supported by a “lessons learned exercise”.

The ICO said: “The action plan should examine the root cause of delay from receipt and validation through allocation, service input, drafting, approval and issue, with specific mitigations for recurring problems addressed in the plan.”

A spokesperson for Derby City Council said: “The Council acknowledges the Information Commissioner’s Office (ICO) decision to take enforcement action because of delays in responding to Freedom of Information (FOI) requests. We accept that our performance has fallen below the required standards and we apologise to those affected.

“This issue stems from a shortfall in capacity alongside rising demand and a growing backlog of requests. Prior to the ICO’s intervention, we had already identified these challenges and begun taking action to resolve them.

“A comprehensive Improvement Action Plan is now in place – we have secured extra resources to increase capacity, senior leadership is actively involved and tracking progress, and our governance and performance monitoring arrangements have been strengthened.

“Building on our past track record of strong performance, we are taking all necessary steps to restore performance and secure sustainable compliance moving forward.”

Lottie Winson