Bodies Not Covered by FOI: The Gaps and the Workarounds

There are only four ways into FOIA

Section 3(1) of the Freedom of Information Act 2000 defines a public authority as any body, person or office-holder listed in Schedule 1, or designated by order under section 5, or a publicly-owned company as defined by section 6. The Information Commissioner's Office breaks the same definition into four practical routes. If an organisation does not arrive by one of them it has no duty to answer you at all, and no exemption ever has to be argued.

Schedule 1 has seven Parts: I — General; II — Local government; III — The National Health Service; IV — Maintained schools and other educational institutions; V — Police; VI — Other public bodies and offices: general; and VII — Other public bodies and offices: Northern Ireland. Section 4(4) matters for a stale entry: a body listed in Part VI or VII that stops satisfying the section 4 conditions ceases to be a public authority whether or not the Schedule has been tidied up. A surviving name is not conclusive.

Who FOIA does not reach

These refusals are legally correct and cannot be appealed on their merits, because there is no request to refuse. Each has a workaround further down the page.

Partly covered: entries that are half a wall

A body can be a public authority and still be outside the Act for the information you want. Section 7 allows a listing to bite only on information of a specified description, and a section 5 order must specify the functions it covers. Read the entry, not the name.

• ›BBC, Channel 4 and S4C — all three are listed in Part VI only "in respect of information held for purposes other than those of journalism, art or literature". In Sugar v BBC [2012] UKSC 4 the Supreme Court held that information held to any significant extent for those purposes is outside the Act, with no dominant-purpose balancing. Aim at corporate and administrative material instead.
• ›Bank of England — listed "in respect of information held for purposes other than those of its functions with respect to — (a) monetary policy, (b) financial operations intended to support financial institutions for the purposes of maintaining stability, and (c) the provision of private banking services and related services".
• ›The House of Commons and House of Lords — both listed "in respect of information other than" specified categories, beginning with information relating to any residential address of a member of either House; the ICO summarises the excluded material as certain information concerning members’ expenses.
• ›Bodies designated under section 5 — UCAS, the Financial Ombudsman Service and the National Police Chiefs’ Council are public authorities only for the functions their order lists. In UCAS v Information Commissioner and Lord Lucas [2014] UKUT 0557 (AAC) the Upper Tribunal nevertheless read a designation liberally, and expressly distinguished it from the BBC’s position.
• ›NHS primary care contractors — GPs, dentists, pharmacists and opticians are covered in relation to the specific NHS services they provide under the relevant health legislation, not their businesses at large, a boundary the ICO tested in its Pharmacy2U decision on the Electronic Prescription Service.

Once you have established that a body is covered for your information, the fight moves to the exemptions — see our guide to FOI exemptions.

Covered, despite what you have been told

The other half of the problem is bodies that wrongly believe — or say — they are outside the Act. Each of these is a public authority, and a refusal on status grounds is challengeable at internal review with the entry quoted back.

• ›Academy trusts, free schools, UTCs and studio schools — Schedule 1 Part IV para 52A covers "the proprietor of an Academy, in respect of information held for the purposes of the proprietor’s functions under Academy arrangements", inserted by the Academies Act 2010.
• ›Universities and colleges — para 53 covers the governing bodies of further education institutions and registered higher education providers, amended by the Higher Education and Research Act 2017 from 1 August 2019.
• ›Council-owned and publicly-owned companies — an ALMO or a wholly council-owned trading company is a public authority in its own right under s.6, and so are second-tier subsidiaries; the ICO gives Transport for London’s subsidiary chain as the worked example.
• ›Network Rail Limited, Network Rail Infrastructure Limited and Network Rail Holdco Limited — designated under s.5 from 24 March 2015 for network and station functions.
• ›The Regulator of Social Housing, the Housing Ombudsman, and housing action trusts established under Part III of the Housing Act 1988 — all listed in Schedule 1 Part VI.
• ›Executive agencies — the DVLA, the Planning Inspectorate and the Crown Commercial Service have no separate FOIA status; the parent department is the public authority, so an agency’s refusal is the department’s refusal.

Workaround 1: information held on the authority's behalf

This is the single most useful provision in the Act for reaching a contractor. Section 3(2) provides that information is held by a public authority if “(a) it is held by the authority, otherwise than on behalf of another person, or (b) it is held by another person on behalf of the authority”. Paragraph (b) means a company with no FOI duties of its own can still be holding disclosable information — and the request goes to the authority, not the company.

Chapter 9 of the section 45 Code of Practice is the text to quote. It says that where a contractor holds information relating to the contract on an authority's behalf that information “should be considered in the same way as information held by a public authority”; that the parties should agree at contract stage what falls into that category and record it in the contract or a schedule; that contractors “must comply with requests by a public authority for access to such information”; and that such requests “should be answered by the public authority”. Paragraph 9.11 adds that confidentiality clauses must be tested against the Act and the public interest in accountability.

The threshold is low: in University of Newcastle upon Tyne v Information Commissioner and BUAV [2011] UKUT 185 (AAC) the Upper Tribunal endorsed the finding that if information is held to any extent on behalf of the authority, the authority holds it. What the ICO does require is an “appropriate connection” between the information and the authority's functions — mere physical storage is not enough — so frame the request around the contract, its delivery and its monitoring, not the contractor's wider business.

Workaround 2: the EIR reach further than FOIA

If the information is environmental you are in a different regime with a wider cast of defendants. Regulation 2(2) of the Environmental Information Regulations 2004 defines a public authority as government departments; FOIA s.3(1) authorities (excluding bodies listed only for information of a specified description, and excluding anyone designated under s.5); “any other body or other person, that carries out functions of public administration”; and any body under the control of one of those that has public environmental responsibilities, exercises environmental functions of a public nature, or provides environmental public services.

Regulation 2(2)(c) is the door FOIA does not have. In Fish Legal v Information Commissioner [2015] UKUT 52 (AAC), following the CJEU in Case C-279/12, the Upper Tribunal held privately owned water companies to be public authorities under it. The test is cumulative: entrustment with functions of public administration under the applicable legal regime, and the vesting of special powers beyond ordinary private law — compulsory purchase, rights of entry onto private land, a statutory advisory role. Where a body does fall within 2(2)(c) it is a public authority for all the environmental information it holds, not only for the entrusted functions.

Two quirks are worth banking. Bodies listed in Schedule 1 only for specified information are not EIR authorities by the s.3(1) route — the BBC is the ICO's own example — but the Houses of Parliament, similarly restricted, are caught instead by regulation 2(2)(c); and the special forces, carved out of FOIA by Schedule 1 paragraph 6, are EIR public authorities because that paragraph is disregarded for EIR purposes. In the other direction, regulation 2(2)(b)(ii) means a section 5 designation does not make a body an EIR authority.

Environmental information is defined broadly — emissions, land, landscape, waste, noise, energy, and the measures, plans, analyses and reports affecting them. Read our guide to the Environmental Information Regulations before concluding a subject is not environmental.

Workaround 3: ask whoever pays, commissions or regulates

Almost every uncovered body sits in a relationship with a covered one, and the contract, the money and the oversight paperwork are on the covered side of that line.

1. 1The commissioning authority: The signed contract and schedules, tender evaluation, variations, KPI returns, service credits and deductions, contract management minutes, and any remedial notices. This is the authority’s own information under s.3(2)(a), before you even reach what the contractor holds on its behalf.
2. 2The funder or grant-maker: Where there is no contract there is often a grant. Grant agreements, funding conditions, monitoring returns and clawback correspondence sit with the department, council or arm’s-length body that made the award.
3. 3The regulator or inspectorate: Ofsted, the Care Quality Commission, the Regulator of Social Housing, the Housing Ombudsman and their equivalents are all covered, and they hold inspection findings, regulatory judgements, notices and complaint outcomes about bodies that are not.
4. 4The public registers: Contracts Finder and Find a Tender for award notices and contract documents, Companies House for accounts, charges, group structure and directorships, and the register of charities for accounts, trustees and income. None of this is FOI, none of it takes 20 working days, and none of it can be refused.
5. 5The publication scheme and disclosure log: Councils and departments publish spend over set thresholds, contract registers and previous FOI responses. Check these first — a request for information already published attracts a section 21 refusal.

For councils the commissioning trail is usually the fastest route into an uncovered provider — see local government reporting and procurement and spending requests.

Scotland closed one of these gaps

Scottish public authorities are governed by the Freedom of Information (Scotland) Act 2002, and Scottish Ministers have used the equivalent designation power where Westminster has not. The Freedom of Information (Scotland) Act 2002 (Designation of Persons as Scottish Public Authorities) Order 2019 designated registered social landlords as defined by section 165 of the Housing (Scotland) Act 2010, and connected bodies under section 164(c), with effect from 11 November 2019.

The designation is function-limited, not general. The Scottish Information Commissioner summarises the covered functions as the prevention and alleviation of homelessness; the management of social housing accommodation let on Scottish secure and short Scottish secure tenancies; the provision and management of sites for gypsies and travellers; and the supply of information to the Scottish Housing Regulator about financial well-being and standards of governance. A request about anything outside those functions is as far outside the law as an English one.

The lesson for a UK-wide story is that the same type of organisation can be covered on one side of the border and not the other. See our guide to FOI in Scotland under FOISA for the wider differences in deadlines, exemptions and appeal routes.

Checklist before you accept “we are not covered”

• I have checked the current text of Schedule 1 on legislation.gov.uk, including the generic descriptions, not just searched for the body by name.
• I have checked whether it is a company wholly owned by the Crown or by Schedule 1 authorities, which makes it a public authority under s.6 with no Schedule 1 entry.
• I have checked whether it has been designated by a section 5 order, and if so which functions the order actually names.
• If it is listed, I have read the qualifying words — "in respect of information held for purposes other than…" — and not just the name.
• I have identified the commissioning, funding or regulating body that is covered, and framed a request to it under s.3(2)(a) and s.3(2)(b).
• I have asked that body what its contract identifies as information held on its behalf, citing Chapter 9 of the section 45 Code of Practice.
• I have considered whether any part of the information is environmental, which brings EIR regulation 2(2)(c) and (d) into play against bodies FOIA cannot reach.
• I have checked Contracts Finder, Find a Tender, Companies House, the register of charities and the relevant regulator before spending 20 working days on a request.

Frequently asked questions