Information Commissioner’s Office (ICO) enforcement notice and improvement plan

On 13 September 2023 we received an enforcement notice from the Information Commissioner’s Office (ICO) relating to requests made under the Freedom of Information (FOI) Act and Environmental Information Regulations (EIR).

The Enforcement Notice (reference: ENF0988350) required us to:

publish an improvement plan within 35 calendar days
issue valid responses to the backlog of FOIs and EIRs within 6 months

See our details of our improvement plan, which we're working through as a matter of priority:

FOI and EIR Improvement Plan

Alternatively, find out how to request information in a different format.

Our FOI and EIR improvement plan

The main objectives of our improvement plan are to:

address volume of FOI and EIR requests with no responses
improve the rate of responses within statutory timescales

The improvement plan covers the following areas:

governance
processes and procedures
compliance and assurance
training and awareness

Governance

Statement	Actions	Priority	Owner	Start date	Target implementation date	Reviewed target implementation date	Date last reviewed	Status	Comments
Council Management Team renew commitment to FOI/EIR compliance across the council including swift action where there's identified blockers and bottlenecks.	Issue commitment statement. Emails sent by Chief Operating Officer. Council Management Team report.	High	Council Management Team	24/08/2023	13/09/2023	-	Not applicable	Action Completed - solution in place.
There is governance oversight in place to ensure compliance with FOI/EIR.	Governance Risk and Assurance Group (GRAG) 6 weekly meetings. Regular report to Council Management Team starting 25/10/2023.	High	Director of Governance	13/09/2023	Ongoing	-	Not applicable	Action Completed - solution in place.
Responsibility has been assigned to ensure compliance with FOI/EIR.	Corporate Governance Team (CGT) responsibilities will be reviewed. Responsibilities will be reviewed across directorates.	High	Director of Governance	13/09/2023	30/11/2023	31/03/2024	20/12/2023	Solution in place but improvements are required.	Ongoing review alongside council wide restructure
Sufficient resources are assigned to the handling of requests for information to ensure response within the statutory timescales.	Corporate Governance Team structure will be reviewed. Resources will be reviewed across directorates.	High	Director of Governance	13/09/2023	30/11/2023	31/03/2024	20/12/2023	Solution in place but improvements are required.	Ongoing review alongside council wide restructure

Top of page

Processes and procedures

Statement	Actions	Priority	Owner	Start date	Target implementation date	Date last reviewed	Status	Comments
Processes and procedures are in place which explain the council's approach to, and responsibilities for, FOI and EIR.	FOI/EIR handling procedure will be reviewed. This will continue to be monitored and reported to Governance Risk and Assurance Group (GRAG), Council Management Team and Audit and Governance Committee.	High	Director of Governance	13/09/2023	29/09/2023	29/09/2023	Action Completed - solution in place.
Processes and procedures are easily accessible by staff.	Updated and approved procedures will be made available to all staff via the corporate Intranet.	High	Director of Governance	13/09/2023	30/11/2023	-	Action Completed - solution in place	Updated guidance available to all staff on the intranet.
Processes and procedures are easily accessible by customers.	Updated and approved procedures are available to all customers via the council website.	High	Director of Governance	13/09/2023	29/09/2023	29/09/2023	Action Completed - solution in place.
The council ensures that staff are informed of any changes to processes and procedures regarding FOI/EIR.	Communications are cascaded via the 'Leading Together' Group, training and additional communication via other all staff methods.	Medium	Director of Governance	13/09/2023	Ongoing	Not applicable	Action Completed - solution in place.
Staff know who to contact for advice or assistance regarding processes and procedures for FOI/EIR.	Published on the Intranet and Council website. Any changes will be communicated in a timely manner.	Medium	Director of Governance	13/09/2023	Ongoing	Not applicable	Action Completed - solution in place.
Processes and procedures for FOI/EIR account for personal information and how it should be dealt with.	FOI/EIR handling procedure review. This will continue to be monitored.	Medium	Director of Governance	13/09/2023	30/11/2023	-	Action Completed - solution in place.	Guidance available to all staff via updated intranet information and also via advice and support from CGT.

Top of page

Compliance and assurance

Statement	Actions	Priority	Owner	Start date	Target implementation date	Reviewed target implementation date	Date last reviewed	Status	Comments
There are reporting mechanisms in place to provide oversight of requests and ensure that statutory deadlines are met.	Real time compliance reporting is available for monitoring through Key Performance Indicator (KPI) machine. Review of automated reports and distribution to be completed. Ongoing monitoring will be provided through reports to Governance Risk and Assurance Group, Council Management Team and Audit and Governance committee has been completed and will continue to be monitored.	Medium	Director of Governance	13/09/2023	30/11/2023	31/01/2024	20/12/2023	Solution in place but improvements are required.	Reviewing the reporting mechanisms following implementation of case management system and from feedback from regular CMT performance reports.
There are mechanisms to monitor the quality of responses to requests and ensure that any reasons for refusal/application of exemptions or exceptions are valid.	Current quality monitoring process of responses will be reviewed to ensure that exemptions or exceptions valid. This will include review of previous internal audit recommendations.	Medium	Director of Governance	13/09/2023	29/12/2023	31/01/2024	20/12/2023	Solution in place but improvements are required.
Contracts with third parties do not restrict the release of information that should be available to the public and provide for access to information, by the public authority, when needed.	Review and update current contracts and agreements clauses that mean third parties must support the council when responding to requests for information.	Low	Director of Governance	13/09/2023	29/12/2023	31/01/2024	20/12/2023	Solution in place but improvements are required.	Working with legal services and procurement team to review the current contract clauses covering FOI/EIR and also to ensure they are included in all new contracts and review of existing contracts.
Documented governance arrangements exist where the authority works in partnership with other organisations in relation to the handling of requests and/or the management of records.	Information Sharing Arrangements are in place and include relevant clauses about supporting the council when responding to requests for information.	Low	Director of Governance	13/09/2023	29/12/2023	31/03/2024	20/12/2023	Solution in place but improvements are required.	Extending this implementation date to allow any outcomes/input from the regional IG group review of current "protocol" and template ISA/DSA.
The council has cleared the FOI/EIR overdue backlog.	Backlog is being reduced.	High	Council Management Team and/or Director of Governance	24/08/2023	27/10/2023		21/11/2023	Action Completed - solution in place.	31/10/2023
The council is complying with statutory timescales for FOI/EIR.	Corporate priority that time scales are adhered to. Ongoing monitoring will be provided through reports to Governance Risk and Assurance Group, Council Management Team and Audit and Governance committee has been completed and will continue to be monitored. Live monitoring via Key Performance Indicators. Focused targeting at areas continuing to not meet necessary timescales.	High	Council Management Team and/or Director of Governance	24/08/2023	ongoing		21/11/2023	Action Completed - solution in place.	Ongoing 2 weekly reports to CMT on timeliness and performance for FOI/EIR responses.
Internal review procedures comply with the relevant Codes of Practice and ensure that timely responses are provided to complaints.	Procedures for internal review will be reviewed to ensure the council follows best practice. This will continue to be monitored and reported to Governance Risk and Assurance Group, Council Management Team and Audit and Governance Committee.	High	Director of Governance	13/09/2023	30/11/2023	31/01/2024	20/12/2023	Solution in place but improvements are required.
Exemptions/Exceptions should be applied on a case-by-case basis, by appropriately trained staff, with no evidence of the use of blanket exemptions.	Corporate Governance Team undertake refresher training as overall specialists. Continue to keep skills up to date and undertake refresher training where gaps are identified. Service Areas given awareness training to apply exemptions relevant to their information. Obtaining further advice from the Corporate Governance Team when required.	Medium	Director of Governance	13/09/2023	29/12/2023	31/01/2024	20/12/2023	Solution in place but improvements are required.
There is evidence of an oversight or approval process for the use of exemptions or exceptions.	Review of Corporate Governance Team Structure and procedures will address any identified gap. Current quality monitoring process of responses will be reviewed to ensure that exemptions or exceptions valid. This will include review of previous internal audit recommendations.	Low	Director of Governance	13/09/2023	29/12/2023		-	Solution in place but improvements are required.
Redactions should be applied on a case-by-case basis, by appropriately trained staff, and records should be maintained of what has been redacted.	Redaction software and procedures for using it, is available to teams requiring them. Advice and support on what to redact provided by Corporate Governance Team.	Low	Director of Governance	24/08/2023	29/09/2023		29/09/2023	Action Completed - solution in place.

Top of page

Training and awareness

Statement	Actions	Priority	Owner	Start date	Target implementation date	Reviewed target implementation date	Date last reviewed	Status	Comments
There is an induction training programme, with input from Corporate Governance Team, Workforce Development Unit etc which includes general training on how FOI/EIR applies to the council, what they currently do to comply, and how to recognise an FOI/EIR request.	Review training materials and training requirements and ensure this is included in the Induction Package.	Medium	Director of Governance	13/09/2023	29/12/2023	31/03/2024	20/12/2023	Solution in place but improvements are required.	Linking with the council wide structure so that we can target training requirements. CGT are currently completing the ICO training modules
Staff receive refresher training in the requirements of FOI/EIR, including, where appropriate, updates from the relevant decisions of the ICO and the Information Tribunal.	Link to guidance included with all requests sent to service areas. Guidance and specific advice provided by Corporate Governance Team.	Medium	Director of Governance	13/09/2023	Ongoing		20/12/2023	Solution in place but improvements are required.	Linking with the council wide restructure so that we can target training requirements. CGT are currently completing the ICO training modules. From this we will update and refresh training materials for other council staff where required
There is specific training for staff with responsibility for handling requests for information, on FOI, EIR and Codes of Practice.	Corporate Governance Team to complete ICO FOI/EIR online training. Continue to refresh Corporate Governance Team skills where gaps are identified during review of Corporate Governance Team structure and appropriate training provided with ongoing mentoring. Service Areas will be given ongoing awareness training to apply exemptions relevant to their information. Obtaining further advice and guidance will continue to be provided to service areas from the Corporate Governance Team.	Medium	Director of Governance	13/09/2023	Ongoing		20/12/2023	Solution in place but improvements are required.	Linking with the council wide restructure so that we can target training requirements. CGT are currently completing the ICO training modules. From this we will update and refresh training materials for other council staff where required
Records are maintained by Corporate Governance Team and Workforce Development Unit of the FOI/EIR training received by staff. These records are monitored to ensure that all staff receive or attend all relevant training.	Review of training material will include modules on a platform that allows training to be monitored.	Medium	Director of Governance	13/09/2023	Ongoing		20/12/2023	Solution in place but improvements are required.	Working with WDU to ensure that updated and refreshed FOI/EIR training is available through elearning/MyLO and records kept on individuals training records. CGT have updated training log to include where we attend team meetings that includes any training element
Staff receive regular reminders of how to recognise FOI/EIR requests.	Review of procedures includes a requirement for Corporate Governance Team to arrange regular communications about recognising request.	Low	Director of Governance	13/09/2023	Ongoing		Not applicable	Solution in place but improvements are required.

Also see

FOI enforcement notices, information notices and practice recommendations

Corporate Governance Team - Information Governance

West Offices, Station Rise, York, YO1 6GA

Telephone: 01904 554145

Email: information.governance@york.gov.uk

Comment on this page