Freedom of Information

Appeal a FOI Refusal: Internal Review and ICO Complaint

Q: What if the authority doesn't respond to my internal review?

You can complain to the ICO immediately. Failure to respond is a breach and the ICO will investigate in your favor.

Q: How long does an ICO investigation take?

Typically 3-6 months. The ICO will request evidence from both you and the authority before issuing a Decision Notice.

Q: What if the ICO agrees with the authority?

Appeal to the First-tier Tribunal within one month of the ICO Decision Notice. The tribunal can overturn the decision.

Q: Is there a time limit for ICO complaints?

One year from the original refusal date. After that, the ICO will reject your complaint unless you have a good reason for the delay.

Q: Can I challenge a vague refusal?

Yes. A vague refusal that doesn't explain the exemption is a breach of s.17 and grounds for successful appeal.

Full guide: Complete FOI Requests Guide

Your Freedom of Information request was refused under a vague exemption. You have the right to challenge the refusal through internal review, the Information Commissioner's Office, and if necessary, the First-tier Tribunal. Learn the process and deadlines.

Quick Answer

If a public authority refuses your FOI request with a Section 17 refusal notice, you can appeal in two stages: (1) request an internal review within 20 working days of the refusal, (2) if the internal review fails, complain to the Information Commissioner's Office (ICO) within one year. If the ICO decides against you, you can appeal to the First-tier Tribunal. Most vague exemptions (confidentiality, costs) are overturned on review.

Get Help Now

What Is a Section 17 Refusal Notice?

A Section 17 notice is a formal refusal of your FOI request by a public authority (council, police, NHS, HMRC, ministry, etc.). It must explain which exemption they are claiming (e.g., "confidential information," "cost of processing," "legal privilege") and why the exemption applies. A vague or poorly reasoned refusal is grounds for appeal.

You have the right to challenge any refusal that you believe is wrong, unreasonable, or based on a misapplication of the law. Most authorities reject valid requests using broad exemptions. Appealing through internal review and the ICO overturns approximately 40% of refusals.

Your Legal Rights

Freedom of Information Act 2000 s.17

Requires public authorities to issue a refusal notice within 20 working days of your FOI request, explaining which exemption applies and why.

FOI Act 2000 s.19 - Internal Review

You have the right to request an internal review within 20 working days of the refusal notice. The authority must assign a new decision-maker to reconsider the refusal. Internal review is mandatory before you can appeal to the ICO.

Environmental Information Regulations 2004 & Information Commissioner Powers

The ICO is independent and can issue Decision Notices overturning refusals, awarding costs, and ordering re-release of information. The ICO's decisions are binding unless appealed to First-tier Tribunal.

Step-by-Step: How to Appeal a FOI Refusal

Get the refusal notice: Find the Section 17 letter. It should state the exemption (e.g., Section 40, 41, 43) and the reason. Save it.
Identify the weakness: Is the exemption vague? Did they claim confidentiality without evidence? Did they estimate cost incorrectly? Write down the specific reasons why the refusal is wrong.
Request internal review within 20 working days: Send an email to the authority stating: "I request an internal review of the Section 17 refusal notice dated [date] under FOIA 2000 s.19. The refusal incorrectly applied [exemption] because [your reason]. Please review with a fresh decision-maker."
Wait up to 40 working days: The authority must complete the internal review within 20 working days. Many take the full 40. If they do not respond, escalate to the ICO.
If internal review fails: Complain to the ICO at www.ico.org.uk within one year of the original refusal. Include the Section 17 notice, your internal review request, and their response.
ICO investigation: The ICO will review both the original refusal and the internal review. They often overturn on grounds of poor reasoning or incorrect exemption application.
If ICO decides against you: Appeal to the First-tier Tribunal (Information Rights) within one month of the ICO Decision Notice.

Critical Deadlines

20 working days from the Section 17 refusal to request internal review. 20 working days (or 40 at longest) for internal review to complete. One year from the original refusal to file an ICO complaint. One month from ICO Decision Notice to appeal to tribunal.

Common Weak Refusal Reasons and How to Challenge Them

Cost exemption: Authority claims processing would cost over GBP 600 but hasn't calculated properly. Argue they did not estimate correctly or they can release a narrowed version under GBP 600. Confidentiality: Authority claims disclosing harms ongoing relationships. Argue public interest in transparency outweighs harm. Legal privilege: Authority claims legal advice is privileged. Argue if the information is factual (not advice), it is not privileged.

Do You Need Help?

Many people appeal FOI refusals without legal help. However, complex cases (especially national security, legal proceedings) may benefit from advice. The ICO process is free. Tribunal appeals may require representation.

What the Law Says

Primary Law

FOIA 2000 s.17 & 19

Section 17 requires refusal notices. Section 19 grants you the right to request internal review within 20 working days.

Regulator

Information Commissioner

Independent regulator with power to overturn refusals, issue Decision Notices, and order disclosure of information.

Appeal

First-tier Tribunal (Info Rights)

Can review ICO Decision Notice on merits and law. Can award costs against authorities using vexatious exemptions.

Public Interest

FOIA 2000 s.2

Even exempt information must be released if the public interest in disclosure outweighs the harm from disclosure.

Frequently Asked Questions

How long do I have to request an internal review? +

20 working days from the date of the Section 17 refusal notice. If the authority dated it 1 April, your deadline is 25 April (excluding weekends and bank holidays). Send your internal review request by email so you have proof of the date.

What if the authority doesn't respond to my internal review request? +

If they do not respond within 20 (or 40) working days, you can complain to the ICO immediately. The ICO treats failure to respond as a breach and will investigate in your favor.

How long does an ICO investigation take? +

Typically 3-6 months for standard cases. Complex cases take longer. The ICO will ask for your evidence and the authority's written response before issuing a Decision Notice.

What if the ICO agrees with the authority's refusal? +

You can appeal to the First-tier Tribunal (Information Rights) within one month of the ICO Decision Notice. The tribunal reviews both fact and law and can overturn the ICO's decision.

Is there a time limit for ICO complaints? +

One year from the original refusal (the date of the Section 17 notice). After one year, the ICO will usually reject your complaint unless you have a good reason for the delay.

Can I challenge a vague refusal that doesn't explain why? +

Yes. A refusal notice must explain the exemption and the reason. A vague refusal is a breach of s.17 and grounds for successful internal review or ICO complaint.

Appeal Your FOI Refusal Today

Use FOIRequest to draft your internal review request and ICO complaint. Don't let authorities hide information behind vague exemptions.

Start Your Appeal