How to Challenge a FOI Refusal: A Step-by-Step Playbook

Why Authorities Refuse and Which Exemptions Are Most Commonly Misused

Public authorities refuse FOI requests for a range of reasons, some legitimate, many not. Understanding which exemptions are being stretched beyond their intended purpose is the first step in building a successful challenge.

The most commonly invoked exemptions that attract improper use are Section 12 (cost limit), Section 36 (prejudice to the effective conduct of public affairs), Section 40 (personal data), and Section 22 (information intended for future publication). Each has a defined scope, and each is regularly applied more broadly than the law allows.

Section 12 refusals often arrive without any effort by the authority to advise on how to narrow the request to bring it within cost. The FOI Act creates an obligation to provide reasonable advice and assistance. An authority that simply cites the cost limit without offering any guidance may already be in breach. Section 36 requires a qualified person within the authority to hold a reasonable opinion that disclosure would prejudice good governance; a generic statement that disclosure would be harmful is not the same thing. Section 40 is frequently used to block information about named officials exercising public functions, when data protection law often permits disclosure of such data precisely because of the public role.

The starting point for any challenge is the guide to reading and fighting FOI refusals. Before engaging the escalation ladder, verify that you understand exactly which statutory provision is being cited and whether the authority's reasoning maps onto the actual requirements of that exemption.

Step 1 — Requesting an Internal Review: What to Write and Deadlines

When you receive a refusal, your first formal step is to request an internal review from the same authority. This must normally be submitted within 40 working days of receiving the refusal, though best practice is to act within 20 working days while the substance is fresh.

Your internal review request should do three things: identify the specific exemption or exemptions being challenged, explain why the authority's reasoning is legally insufficient, and request reconsideration of the public interest balance where qualified exemptions are involved. Keep it focused. A diffuse complaint about the authority being unhelpful will not succeed; a targeted argument about why Section 36 cannot apply because no qualified person's opinion is evidenced will.

The authority has 20 working days to respond to an internal review, though this can be extended in complex cases. If they do not respond in time, that failure is itself something you can raise with the ICO. Use the internal review request template to draft your request: the structure matters as much as the substance.

Step 2 — Filing an ICO Complaint: When to Escalate and What to Include

If the internal review confirms the refusal or produces no response, the next step is a complaint to the Information Commissioner's Office. There is no fee. There is also no strict time limit, but the ICO expects complaints to be made within three months of the final refusal.

Your ICO complaint needs to demonstrate that you have exhausted the internal review process, identify the specific legal provision you believe has been wrongly applied, and explain the public interest case for disclosure. The more precisely your complaint maps the authority's reasoning to the statutory requirements, and shows where the map fails, the stronger your submission.

ICO investigations typically take several months, but priority is given to cases with clear public interest dimensions and to those where the authority has failed to respond at all. The ICO has the power to issue Decision Notices requiring disclosure, and failure to comply is a contempt of court. Most authorities comply.

Step 3 — Information Tribunal Appeal: Realistic Expectations and Costs

If the ICO upholds the refusal and issues a Decision Notice against you, or if the ICO takes longer than you can afford to wait, appeal lies to the First-tier Tribunal (Information Rights). The appeal must be lodged within 28 days of the ICO's Decision Notice.

Tribunal hearings are usually conducted in writing, which means you do not need to attend in person. Costs are rarely awarded in either direction; unlike commercial litigation, the Tribunal is not designed to punish parties financially for pursuing or defending proceedings. This makes the Tribunal an accessible option even for small outlets and individual journalists.

The Tribunal applies the law independently of the ICO's findings. It can require disclosure, confirm the refusal, or vary the terms. Authorities do lose at Tribunal, particularly where they have relied on Section 36 without proper procedural compliance or where they have delayed the public interest balance unreasonably.

Recognising Bad-Faith Refusals Versus Legitimate Exemptions

The distinction matters strategically. A legitimate exemption is one where the authority can point to a specific, evidenced harm that disclosure would cause. A bad-faith refusal is characterised by vague language, an absence of reasoning, a mismatch between the exemption cited and the actual content of the information, or a pattern of refusals that suggests a desire to suppress rather than to protect.

Indicators of bad faith include: citations of multiple exemptions without developing the case for any of them, a Section 22 refusal where no publication date is specified, and Section 40 used to block information about officials' exercise of public functions rather than genuinely private data. When multiple exemptions are cited together with thin reasoning, it often signals that none is strong individually.

Documenting this pattern across multiple requests to the same authority builds a compelling ICO complaint, one that suggests systemic non-compliance rather than a single misjudgment.

Tracking Multiple Refusals Without Losing the Thread

Running simultaneous FOI requests across multiple authorities, or pursuing a single request through several stages of appeal, requires a management system. A spreadsheet tracking each request, the exemption cited, the internal review date, the ICO complaint reference, and the Tribunal deadline will prevent missed windows.

Tag each request with whether it involves a qualified or absolute exemption: qualified exemptions require a public interest balance, which provides the most fertile ground for challenge. Note any correspondence that involves the authority's public interest reasoning, since that reasoning is the heart of any ICO or Tribunal argument.

Persistence is not futile. Many of the most significant stories produced through FOI in recent years came after initial refusals. The escalation ladder exists for a reason.