Information Commissioner

2.Main Content

Information Commissioner

This page contains information about the Information Commissioner, including:
What it does
Advantages and disadvantages
Which complaints are eligible?
Cost
Timescale
Procedure and outcomes

What it does
The Information Commissioner has two main areas of responsibility: Freedom of information and Data protection.

Freedom of Information
The Freedom of Information Act 2000 came into effect in January 2005. It requires public bodies to make information available to the public on request. The Information Commissioner publishes good practice guidelines on how to comply with FOI requests. If a request is refused without justification, then the Information Commissioner can investigate complaints. The Information Commissioner covers the whole of the UK, and there is a separate Scottish Information Commissioner covering public bodies within Scotland such as the Scottish Executive.

Data Protection
The Data Protection Act 1998 sets standards for storing and using personal data. If members of the public believe that personal information held about them is wrong, or has been misused, they can complain to the Information Commissioner.
top

Advantages

it is independent of the organisations that are the subjects of the complaints it handles
it is free
it can influence good practice and procedures within organisations

Disadvantages

it can take a long time to get a decision
it is not possible to get compensation through this scheme
the Information Commissioner cannot enforce decisions about data protection

top

Which complaints are eligible?
Data Protection
The Data Protection Act states that anyone who processes personal information must comply with eight principles, which make sure that personal information is:

Fairly and lawfully processed
Processed for limited purposes
Adequate, relevant and not excessive
Accurate and up to date
Not kept for longer than is necessary
Processed in line with your rights
Secure
Not transferred to other countries without adequate protection

The Information Commissioner is responsible for enforcing the Data Protection Act 1998 and for considering complaints from individuals about the use of personal data. The Act gives you:

the right to find out what information is held about you on computers and in some paper records
the right to take steps to prevent personal data being processed if it will result in substantial damage or distress
the right to require organisations not to use personal data to market products, services or ideas
the right to prevent decisions being made that are based solely on automatic processing
the right to have inaccurate information amended or destroyed
the right to claim compensation from the data controller (but not from the Information Commissioner)

The Commissioner can assess whether there has been a breach of the Act but cannot force an organisation to comply with the Act. For this, individual complainants must take the organisation to court. You should always complain direct to the organisation first, to give them a chance to put things right.

Freedom of Information
The Freedom of Information Act 2000 gives individuals a right to ask for any information that public bodies hold. It also requires public authorities to have publication schemes that make it clear what information is publicly available.

If you have requested information from a public body, and are unhappy with their response, you can complain to the Information Commissioner on any of the following grounds:

Failure to provide the information you requested
Failure to respond to your request within 20 working days (or failure to explain why longer than 20 working days is needed)
Failure to give you proper advice and help
Failure to give information in the form in which you requested it
Failure to properly explain any reasons for refusing the request
Failure to correctly apply an exemption under the Act

When complaining about Data Protection or Freedom of Information, you should first take your complaint to the body or organisation concerned, and give them a chance to put things right. If you are not satisfied with their response, or if they fail to respond in a reasonable time, then you can make a complaint to the Information Commissioner.
top

Cost
The scheme is free to complainants.
top

Timescale
Complaints and enquiries about data protection:

70% of casework is dealt with within 30 days
92% is dealt with within 90 days

Complaints and enquiries about Freedom of Information:

58% of casework is dealt with within 30 days
64% of casework is dealt within 90 days
81% of casework is dealt with within 365 days

top

Procedure and outcomes
A complaints form for Data Protection or Freedom of Information can be downloaded from the Information Commissioner’s website. This should be completed, and sent with an explanation of the problem and copies of any relevant correspondence, to the Information Commissioner. You should keep the originals safely, as they may be needed later. Don’t forget that you should always make the complaint to the body or organisation you are complaining about first of all. You can then go to the Commissioner if you are not happy with their response.

Once you have made your complaint to the Information Commissioner’s office, a caseworker will then consider whether they can take on the case, and let you know as soon as possible.

Initially, the Commissioner’s office contacts the organisation concerned to see if the matter can be resolved quickly. If the issue needs a full investigation, this can be quite time-consuming.

Data Protection
If the Commissioner’s office thinks that the organisation has breached the Data Protection Act, they can ask them to take steps to resolve the problem. The Commissioner has no power to punish an organisation, or to award compensation to the complainant. If you want to consider taking legal action against an organisation for unlawful use of personal data, then the opinion of the Commissioner’s office may be helpful in deciding whether or not to go ahead. You can get information about how long a case might take and ask questions about your complaint on the helpline: 01625 545 745.

Freedom of Information
Once a complaint is received, the Case Reception Unit will assess whether or not it can be dealt with. There are three main reasons why complaints cannot be progressed:

There is not enough information or documentary support for the complaint
The complaint has not yet been put to the organisation concerned
The complaint falls within the ‘robust complaint handling criteria’ of the Commissioner’s office – this means that no public interest would be served, even if the complaint were upheld

Once the case is accepted it will be investigated, and then a ‘decision notice’ will be issued both to the body complained about, and to the person complaining. The Commissioner can require the body to take certain steps to comply with his decision within a set timescale.

The Information Commissioner has powers to force the public authority to release any information that is not exempt under the Act. He cannot award compensation. The person requesting the information or the public authority may appeal against a formal decision by the Commissioner to the Information Tribunal.

Undertakings given by organisations in breach of data protection laws, and decision notices issued against public bodies regarding freedom of information, are published on the Information Commissioner’s website (see below for link).
top

September 2007