Information Commissioner’s Office (ICO) enforcement notice and improvement plan

On 13 September 2023 we received an enforcement notice from the Information Commissioner’s Office (ICO) relating to requests made under the Freedom of Information (FOI) Act and Environmental Information Regulations (EIR).

The Enforcement Notice (reference: ENF0988350) required us to complete the following within six months:

publish an improvement plan within 35 calendar days
issue valid responses to the backlog of FOIs and EIRs

We have complied with the Enforcement Notice requirements within the six month timescale and you can find the completed improvement plan below:

FOI and EIR Improvement Plan

Alternatively, find out how to request information in a different format.

Our FOI and EIR improvement plan

The main objectives of our improvement plan are to:

address volume of FOI and EIR requests with no responses
improve the rate of responses within statutory timescales

The improvement plan covers the following areas:

governance
processes and procedures
compliance and assurance
training and awareness

Governance

Statement	Actions	Priority	Owner	Start date	Target implementation date	Reviewed target implementation date	Date last reviewed	Status	Comments
Council Management Team renew commitment to FOI/EIR compliance across the council including swift action where there's identified blockers and bottlenecks.	Issue commitment statement. Emails sent by Chief Operating Officer. Council Management Team report.	High	Council Management Team	24/08/2023	13/09/2023	-	Not applicable	Action Completed - solution in place.
There is governance oversight in place to ensure compliance with FOI/EIR.	Governance Risk and Assurance Group (GRAG) 6 weekly meetings. Regular report to Council Management Team starting 25/10/2023.	High	Director of Governance	13/09/2023	Ongoing	-	Not applicable	Action Completed - solution in place.
Responsibility has been assigned to ensure compliance with FOI/EIR.	Corporate Governance Team (CGT) responsibilities will be reviewed. Responsibilities will be reviewed across directorates.	High	Director of Governance	13/09/2023	30/11/2023	31/03/2024	20/12/2023	Action Completed - solution in place.	Through regular reports to senior managers and Chief Officers as well as CMT however this will be kept under ongoing review alongside the council wide restructure
Sufficient resources are assigned to the handling of requests for information to ensure response within the statutory timescales.	Corporate Governance Team structure will be reviewed. Resources will be reviewed across directorates.	High	Director of Governance	13/09/2023	30/11/2023	31/03/2025	Ongoing	Solution in place but improvements are required.	Due to ongoing council wide restructure and transfer of complaints from CGT, this will be reviewed following the outcomes of those

Top of page

Processes and procedures

Statement	Actions	Priority	Owner	Start date	Target implementation date	Date last reviewed	Status	Comments
Processes and procedures are in place which explain the council's approach to, and responsibilities for, FOI and EIR.	FOI/EIR handling procedure will be reviewed. This will continue to be monitored and reported to Governance Risk and Assurance Group (GRAG), Council Management Team and Audit and Governance Committee.	High	Director of Governance	13/09/2023	29/09/2023	29/09/2023	Action Completed - solution in place.
Processes and procedures are easily accessible by staff.	Updated and approved procedures will be made available to all staff via the corporate Intranet.	High	Director of Governance	13/09/2023	30/11/2023	-	Action Completed - solution in place	Updated guidance available to all staff on the intranet.
Processes and procedures are easily accessible by customers.	Updated and approved procedures are available to all customers via the council website.	High	Director of Governance	13/09/2023	29/09/2023	29/09/2023	Action Completed - solution in place.
The council ensures that staff are informed of any changes to processes and procedures regarding FOI/EIR.	Communications are cascaded via the 'Leading Together' Group, training and additional communication via other all staff methods.	Medium	Director of Governance	13/09/2023	Ongoing	Not applicable	Action Completed - solution in place.
Staff know who to contact for advice or assistance regarding processes and procedures for FOI/EIR.	Published on the Intranet and Council website. Any changes will be communicated in a timely manner.	Medium	Director of Governance	13/09/2023	Ongoing	Not applicable	Action Completed - solution in place.
Processes and procedures for FOI/EIR account for personal information and how it should be dealt with.	FOI/EIR handling procedure review. This will continue to be monitored.	Medium	Director of Governance	13/09/2023	30/11/2023	-	Action Completed - solution in place.	Guidance available to all staff via updated intranet information and also via advice and support from CGT.

Top of page

Compliance and assurance

Statement	Actions	Priority	Owner	Start date	Target implementation date	Reviewed target implementation date	Date last reviewed	Status	Comments
There are reporting mechanisms in place to provide oversight of requests and ensure that statutory deadlines are met.	Real time compliance reporting is available for monitoring through Key Performance Indicator (KPI) machine. Review of automated reports and distribution to be completed. Ongoing monitoring will be provided through reports to Governance Risk and Assurance Group, Council Management Team and Audit and Governance committee has been completed and will continue to be monitored.	Medium	Director of Governance	13/09/2023	30/11/2023	31/01/2024	20/12/2023	Action Completed - solution in place.	Reporting mechanisms reviewed following upgrade to case management system. This will be kept under regular and ongoing review from feedback, outcomes from restructures and so on.
There are mechanisms to monitor the quality of responses to requests and ensure that any reasons for refusal/application of exemptions or exceptions are valid.	Current quality monitoring process of responses will be reviewed to ensure that exemptions or exceptions valid. This will include review of previous internal audit recommendations.	Medium	Director of Governance	13/09/2023	29/12/2023	31/01/2024	20/12/2023	Action Completed - solution in place.	The procedures and mechanisms are in place to monitor quality of responses.
Contracts with third parties do not restrict the release of information that should be available to the public and provide for access to information, by the public authority, when needed.	Review and update current contracts and agreements clauses that mean third parties must support the council when responding to requests for information.	Low	Director of Governance	13/09/2023	29/12/2023	31/01/2024	20/12/2023	Action Completed - solution in place.	Processes in place with legal services and procurement team to ensure that where relevant, all new contracts and where contracts are reviewed that they include the appropriate FOI/EIR clauses.
Documented governance arrangements exist where the authority works in partnership with other organisations in relation to the handling of requests and/or the management of records.	Information Sharing Arrangements are in place and include relevant clauses about supporting the council when responding to requests for information.	Low	Director of Governance	13/09/2023	29/12/2023	31/03/2024	20/12/2023	Action Completed - solution in place.	Continue to work with regional IG group. These areas are covered in data sharing arrangements that the council enters into and also contained within relevant contracts and agreements.
The council has cleared the FOI/EIR overdue backlog.	Backlog is being reduced.	High	Council Management Team and/or Director of Governance	24/08/2023	27/10/2023		21/11/2023	Action Completed - solution in place.	31/10/2023
The council is complying with statutory timescales for FOI/EIR.	Corporate priority that time scales are adhered to. Ongoing monitoring will be provided through reports to Governance Risk and Assurance Group, Council Management Team and Audit and Governance committee has been completed and will continue to be monitored. Live monitoring via Key Performance Indicators. Focused targeting at areas continuing to not meet necessary timescales.	High	Council Management Team and/or Director of Governance	24/08/2023	ongoing		21/11/2023	Action Completed - solution in place.	Ongoing 2 weekly reports to CMT on timeliness and performance for FOI/EIR responses.
Internal review procedures comply with the relevant Codes of Practice and ensure that timely responses are provided to complaints.	Procedures for internal review will be reviewed to ensure the council follows best practice. This will continue to be monitored and reported to Governance Risk and Assurance Group, Council Management Team and Audit and Governance Committee.	High	Director of Governance	13/09/2023	30/11/2023	31/01/2024	20/12/2023	Action Completed - solution in place.	This is kept under ongoing review taking account of any changes or updates to Codes of Practice and other regulator guidance
Exemptions/Exceptions should be applied on a case-by-case basis, by appropriately trained staff, with no evidence of the use of blanket exemptions.	Corporate Governance Team undertake refresher training as overall specialists. Continue to keep skills up to date and undertake refresher training where gaps are identified. Service Areas given awareness training to apply exemptions relevant to their information. Obtaining further advice from the Corporate Governance Team when required.	Medium	Director of Governance	13/09/2023	29/12/2023	31/01/2024	20/12/2023	Action Completed - solution in place.	This is kept under ongoing review taking account of any changes or updates from regulator guidance and so on
There is evidence of an oversight or approval process for the use of exemptions or exceptions.	Review of Corporate Governance Team Structure and procedures will address any identified gap. Current quality monitoring process of responses will be reviewed to ensure that exemptions or exceptions valid. This will include review of previous internal audit recommendations.	Low	Director of Governance	13/09/2023	29/12/2023		-	Action Completed - solution in place.	This is kept under ongoing review taking account of any changes or updates from regulator guidance and so on on exemptions/exceptions
Redactions should be applied on a case-by-case basis, by appropriately trained staff, and records should be maintained of what has been redacted.	Redaction software and procedures for using it, is available to teams requiring them. Advice and support on what to redact provided by Corporate Governance Team.	Low	Director of Governance	24/08/2023	29/09/2023		29/09/2023	Action Completed - solution in place.

Top of page

Training and awareness

Statement	Actions	Priority	Owner	Start date	Target implementation date	Reviewed target implementation date	Date last reviewed	Status	Comments
There is an induction training programme, with input from Corporate Governance Team, Workforce Development Unit etc which includes general training on how FOI/EIR applies to the council, what they currently do to comply, and how to recognise an FOI/EIR request.	Review training materials and training requirements and ensure this is included in the Induction Package.	Medium	Director of Governance	13/09/2023	29/12/2023	31/03/2024	20/12/2023	Action Completed - solution in place.	This will continue to be kept up to date.
Staff receive refresher training in the requirements of FOI/EIR, including, where appropriate, updates from the relevant decisions of the ICO and the Information Tribunal.	Link to guidance included with all requests sent to service areas. Guidance and specific advice provided by Corporate Governance Team.	Medium	Director of Governance	13/09/2023	Ongoing		20/12/2023	Action Completed - solution in place.	Training materials and intranet guidance will continue to be updated where required and sessions provided to council staff.
There is specific training for staff with responsibility for handling requests for information, on FOI, EIR and Codes of Practice.	Corporate Governance Team to complete ICO FOI/EIR online training. Continue to refresh Corporate Governance Team skills where gaps are identified during review of Corporate Governance Team structure and appropriate training provided with ongoing mentoring. Service Areas will be given ongoing awareness training to apply exemptions relevant to their information. Obtaining further advice and guidance will continue to be provided to service areas from the Corporate Governance Team.	Medium	Director of Governance	13/09/2023	Ongoing		20/12/2023	Action Completed - solution in place.	Continue to work with managers and WDU to identify and provide appropriate training and guidance where required.
Records are maintained by Corporate Governance Team and Workforce Development Unit of the FOI/EIR training received by staff. These records are monitored to ensure that all staff receive or attend all relevant training.	Review of training material will include modules on a platform that allows training to be monitored.	Medium	Director of Governance	13/09/2023	Ongoing		20/12/2023	Action Completed - solution in place.	WDU maintain records for training made available through e-learning/MyLO. CGT maintain record of other training provided to council staffs.
Staff receive regular reminders of how to recognise FOI/EIR requests.	Review of procedures includes a requirement for Corporate Governance Team to arrange regular communications about recognising request.	Low	Director of Governance	13/09/2023	Ongoing		Not applicable	Action Completed - solution in place.

Also see

FOI enforcement notices, information notices and practice recommendations

Corporate Governance Team - Information Governance

West Offices, Station Rise, York, YO1 6GA

Telephone: 01904 554145

Email: information.governance@york.gov.uk

Comment on this page