Last reviewed: Next review due:
Why case studies matter for journalists
Every FOI refusal you challenge benefits from knowing how similar cases have been decided before. ICO Decision Notices are legally binding and create a body of precedent — not in the strict legal sense, but in the practical sense that the ICO applies consistent principles across similar cases. Tribunal decisions go further and can bind the ICO itself.
When an authority refuses your request under s.40 (personal data), s.36 (effective conduct of public affairs), or s.12 (cost limit), the most powerful thing you can do in an internal review or ICO complaint letter is cite a prior Decision Notice where the ICO found against the same exemption on similar facts. Authorities take this seriously.
The ICO publishes all Decision Notices on its website. The First-tier and Upper Tribunal decisions are published on the Judiciary website and BAILII. Building familiarity with these decisions is part of the craft of FOI journalism.
When case law is most useful
- 1When writing an internal review request — cite prior ICO Decision Notices where the same exemption was overturned.
- 2When drafting an ICO complaint — show that the authority's position contradicts established ICO guidance or prior decisions.
- 3When filing a Tribunal appeal — Tribunal decisions from similar cases are directly persuasive.
- 4When assessing whether to bother appealing — if the ICO has consistently sided with authorities on the same exemption, weigh your time accordingly.
- 5When advising a source about whether their information is likely to be disclosed under FOI — prior decisions on the same type of data are highly indicative.
Red flags in FOI refusals
- A s.36 refusal without identifying the qualified person who provided the "reasonable opinion" — procedurally defective.
- A s.40 refusal applied to aggregate statistical data — almost certainly wrong.
- A s.12 refusal without any explanation of what drives the cost — the authority must advise and assist under s.16.
- A s.35 refusal covering financial data or spending information — financial accountability is weighted heavily towards disclosure.
- A refusal that cites multiple exemptions without explaining how each applies — scattergun refusals are a sign of weak grounds.
- A refusal that arrives before the 20-working-day deadline, apparently without proper consideration — challenge the quality of the decision.
Five landmark FOI cases
MPs' Expenses — House of Commons v Information Commissioner
2008 — EA/2007/0060 (First-tier Tribunal)
Facts
In 2007, a journalist requested details of the Additional Costs Allowance (ACA) — the expenses MPs claimed for second homes — including individual addresses and amounts. The House of Commons refused the request, arguing that addresses were personal data (s.40) and that disclosure would prejudice the effective conduct of parliamentary affairs (s.34, parliamentary privilege).
Decision
The First-tier Tribunal ordered disclosure of expense amounts by MP, though it accepted some redaction of home addresses. The ICO had already found against the House of Commons. The subsequent political storm — accelerated by a leaked disc published by the Daily Telegraph in 2009 — resulted in the most significant overhaul of MP expenses in a generation and the creation of IPSA.
Practical lesson
Parliamentary privilege (s.34) is an absolute exemption but it is interpreted narrowly. The expenses case established that financial accountability information held by Parliament is not automatically protected by s.34. Aggregated financial data about public officials is very strongly weighted towards disclosure in the public interest test.
Cabinet Office Ministerial Meetings — Section 35 and Section 36 Challenged
2012–2016 — Multiple ICO Decision Notices; Cabinet Office v IC [2013] UKUT 0526
Facts
Journalists and campaign groups repeatedly requested details of ministers' meetings with lobbyists, business figures, and media organisations. The Cabinet Office routinely cited Section 35 (policy formulation and development) and Section 36 (prejudice to the effective conduct of public affairs), arguing that disclosure would have a chilling effect on frank advice and free discussion.
Decision
A series of ICO Decision Notices and Tribunal decisions held that the public interest in transparency about who ministers are meeting — particularly where those meetings relate to policy decisions — typically outweighs the s.35/s.36 arguments. The Upper Tribunal confirmed that s.36 requires sign-off by a 'reasonable opinion' of a qualified person and that this opinion must be properly documented and explained.
Practical lesson
Section 36 is widely misused. Any s.36 refusal should be challenged by asking: (1) Who is the 'qualified person' who gave the reasonable opinion? (2) When was the opinion given? (3) What specific prejudice is anticipated? If the authority cannot answer these, the refusal is procedurally defective. Ministerial meetings information is now partially published proactively — compare disclosures against your request.
NHS Waiting List Data — Section 40 and Section 41 Refusals Overturned
2014–2019 — Multiple ICO Decision Notices against NHS Trusts
Facts
Journalists requesting hospital-level waiting list data — including numbers of patients waiting more than 52 weeks for treatment by specialty — were repeatedly refused by NHS Trusts on the grounds that specialty-level data could identify individual patients (s.40, personal data) or that it constituted information provided in confidence (s.41).
Decision
The ICO consistently held that aggregated waiting list statistics — the number of patients waiting at a specialty level — do not identify individuals and are not personal data within the meaning of s.40. Section 41 requires information to have been received from a third party in confidence; statistics generated internally by the Trust about its own performance do not meet this test. ICO Decision Notices ordered disclosure in a significant number of cases.
Practical lesson
Section 40 is heavily overused for aggregate statistical data. The test for personal data under UK GDPR is whether an individual is identified or identifiable — aggregate numbers of patients by specialty are not personal data. When an authority cites s.40 for aggregate statistics, challenge it directly, citing the ICO's guidance on statistical anonymisation. Request the data in aggregated form if the authority argues that more granular data is identifiable.
Police Use-of-Force Aggregation — Section 40 and Section 31 Challenges
2018–2022 — Multiple ICO Decision Notices against police forces
Facts
Journalists requested use-of-force data disaggregated by officer, station, or incident type to enable accountability reporting. Police forces argued that such data was personal data about officers (s.40), could prejudice law enforcement (s.31), or — where numbers were very small — could indirectly identify individuals involved.
Decision
ICO Decision Notices distinguished between officer-identifying data (where s.40 arguments carry more weight) and station-level or incident-type aggregated data (where they do not). The ICO found that station-level aggregate statistics — number of use-of-force incidents by type per month — are not officer-identifying and must be disclosed. Section 31 requires the authority to demonstrate a real and substantial risk of prejudice to a specific law enforcement function.
Practical lesson
Framing your request at the right level of aggregation is critical. Request use-of-force data at the station or division level, broken down by type, without individual officer identifiers. The exemption for personal data of officers applies to the officer, not to their official actions — a use-of-force incident is an official act, not personal information about the officer. Use this distinction in internal review and ICO complaint letters.
DfE Schools Performance Data — Section 12 Cost Limit Challenge
2015–2020 — Multiple ICO Decision Notices against Department for Education
Facts
Journalists and researchers sought school-level performance data, pupil premium spending information, and exclusion statistics at a level of granularity not covered by published datasets. The Department for Education and local authorities frequently cited the s.12 cost limit (requests would cost more than £600 to answer), arguing that extracting granular data from their systems required excessive staff time.
Decision
The ICO held that authorities must explain which specific aspects of a request drive the costs, and must advise requesters on how to narrow their request to bring it within the limit (the s.16 duty to advise and assist). Several Decision Notices found against authorities that had applied s.12 without proper cost calculations or had failed to advise on narrowing. Where a dataset was partially within the cost limit, the authority was required to disclose that part.
Practical lesson
When s.12 is applied, always ask: (1) What specifically drives the cost? (2) Can you narrow to bring within the limit? (3) Has the authority complied with s.16 by advising you? Section 12 is not a blanket refusal — it is a cost-limit mechanism. Narrow your date range, reduce the number of institutions, or ask for totals rather than individual-level data. An authority that fails to advise and assist is itself in breach.
Appeal checklist
- I have read the refusal letter carefully and identified which exemption(s) are cited.
- I have searched the ICO Decision Notice database for prior decisions on the same exemption and authority type.
- I have identified at least one prior Decision Notice that supports disclosure on similar facts.
- My internal review letter explains specifically why the exemption is wrong, citing the prior Decision Notice.
- I have confirmed that the authority complied with its s.16 duty to advise and assist (for s.12 refusals).
- For s.36: I have asked who the qualified person is and when the opinion was given.
- If the internal review fails, I have noted the 20-working-day deadline for the ICO complaint.
- I have all original correspondence preserved for the ICO complaint submission.
Draft your appeal or ICO complaint
Use our tools to draft a well-structured internal review request or ICO complaint that cites the right exemption and references prior ICO guidance.
Common mistakes in FOI appeals
- Not requesting an internal review — jumping straight to the ICO without this step is procedurally incorrect.
- Writing an internal review request that repeats the original request rather than challenging the refusal.
- Failing to cite prior ICO Decision Notices that support your position — this is the strongest argument available.
- Missing the ICO complaint window — while there is no hard statutory deadline, the ICO expects complaints reasonably promptly after the internal review.
- Not keeping copies of all correspondence — the ICO will ask for the original request, the refusal, and the internal review exchange.
- Accepting a partial disclosure without asking what has been withheld and why — partial disclosures often conceal the most interesting data.
Related guides
Primary sources
- ICO Decision Notices database
- First-tier Tribunal (Information Rights) decisions — Judiciary.gov.uk
- BAILII — UK FOI and data protection case law
- ICO — appealing against a decision notice
- Freedom of Information Act 2000 — exemptions (legislation.gov.uk)
- ICO — section 36 guidance: effective conduct of public affairs