To have and to hold: new guidance from the ICO on what constitutes 'holding' information under the Freedom of Information Act 2000


In many cases, it will be simple for a public authority to locate information requested under the Freedom of Information Act 2000 (FOIA). However there are circumstances where the authority has difficulty in determining whether it actually 'holds' the requested information. In response to these concerns, the Information Commissioner's Office (ICO) has published new guidance to assist public authorities with this process. The guidance covers:

the extent to which a public authority is obliged to extract information from its records to compile information in order to respond to a request;
how a public authority should deal with deleted records;
the searches for information that a public authority is expected to conduct; and
the cost of dealing with a FOIA request.

Extracting Information

The ICO states that a public authority will 'hold' information if it holds the building blocks required to generate it and no complex judgement is required to produce it. For example, a public authority may receive a request for information in a list or a schedule; if the authority does not hold the information in this particular format but does possess the requested data, it must extract and organise this data into the requested form. The extraction of existing data and presenting it as a schedule is not the creation of new information. The information is therefore 'held' by the authority.

The level of skill and judgement required to answer a request will determine whether information is 'held'. Public authorities may for example be required to manipulate the relevant building blocks of information by applying mathematical calculations to the data. Generally, if answering a request involves exercising sophisticated judgement, the information will not be 'held'. Correspondingly if only a reasonable level of judgement is required to identify the relevant building blocks, or manipulate those blocks, the information will be 'held'.

Deleted information

Public authorities are entitled to delete information they no longer require. If information was still said to be 'held' when it had been intentionally deleted in line with the public authority’s disposal schedule, it would undermine the principle of good records management. With this in mind it follows that:

paper records destroyed permanently through shredding/incineration is not 'held' information;
electronic information destroyed permanently through deletion from recycle bins and consequent overwriting is not 'held';
information held electronically that has been deleted but is still retained in a recycle bin is 'held';
information that has been intentionally deleted from a recycling bin but not yet overwritten is not 'held', despite the fact that it could still be recovered; and
only information that has been selected and downloaded, or printed off from a third party database will be 'held' by a public authority.

Extent of the Search

In the event that a Commissioner receives a complaint that a public authority has not provided any or all of the requested information, the Commissioner will decide on the balance of probabilities whether the information was 'held' by the authority. In doing so he will assess:

The scope, quality, thoroughness of results of the authority's searches

The scope of the search will depend on the analysis and interpretation of the request. The public authority will first need to understand what it is looking for. Only then can it decide where it is most logical to search. Once the Commissioner has established that the public authority is searching for the right information, in the right places, he will assess whether the search has been reasonable and thorough. This will take account of whether the public authority has correctly applied the factors discussed earlier, for example whether it has taken steps to extract the information/ searched its recycle bins.
ii) Whether there are other explanations from the authority for information not being held

If a public authority is able to demonstrate that it has never had a business need to record the information, the Commissioner is more likely to be persuaded that no information is 'held'. For example, if the requested information does not relate to matters that the public authority is responsible for, it is unlikely to 'hold' the information. Alternatively, even though it has responsibility for the matter, the public authority’s staff may have found through experience that there is no practical need to record the sort of information captured by the request. For example it may not be common practice to make a note of every phone call or every site visit. In both cases however, if there are statutory duties or practical reasons to hold the information, the Commissioner will need more evidence to convince him that it is not held.

When a public authority accepts that the information was 'held' but has now been destroyed, the Commissioner will initially look at the public authority’s destruction schedules and the age of the information. He will also take account of the importance of the information to the public authority. The more important the information is, the more unlikely he will consider it that the public authority would have chosen to destroy it.

Costs of dealing with a request

The cost of determining whether information is 'held' and providing it if it is, has a bearing on a public authority’s obligation to respond to a request. Under section 12 of FOIA, a public authority is not obliged to comply with a request if the cost of certain activities, including locating, retrieving and extracting the information would exceed the appropriate limit. For detailed ICO Guidance on Section 12 click here.


The Guidance provides valuable clarification on FOIA obligations at a time when the number of FOIA requests received by local authorities is increasing. It will allow public authorities to become more confident in determining whether they hold the information requested, making them more efficient in handling FOIA requests. However, the guidance is only a recommended approach – it must be borne in mind that every case is individual and will be judged on its own unique circumstances. Whilst this guidance has been produced by the English ICO and relates to English legislation, it will also act as a useful point of interest for Scottish public authorities who receive requests under the Freedom of Information (Scotland) Act 2002 until such time as an equivalent Scottish guidance is produced.

To see the full guidance click here.