ICO Decision: DfC breached FOIA for Universal Credit info
Summary
The UK's Information Commissioner's Office (ICO) found the Department for Communities (DfC) breached the Freedom of Information Act (FOIA) by failing to confirm it held requested Universal Credit information within 20 working days and by not issuing a timely refusal notice. No further steps are required.
What changed
The Information Commissioner's Office (ICO) has issued a decision notice finding that the Department for Communities (DfC) breached sections 1 and 10 of the Freedom of Information Act (FOIA) by failing to confirm it held requested information about Universal Credit claimants within the statutory 20-working-day period. Additionally, the DfC breached section 17 of the FOIA by failing to issue a timely refusal notice, specifically citing section 12 (appropriate limit) as justification for not providing the information. Although the DfC eventually provided the information and confirmed it held it at the time of the request, the Commissioner determined these procedural failures constituted a breach.
While the ICO found breaches occurred, it has decided not to require any further steps to be taken by the DfC. This decision implies that while procedural compliance failures were identified, the subsequent actions of the DfC in providing the information and the nature of the breaches did not warrant mandatory corrective actions or penalties. Regulated entities, particularly government agencies, should note that failure to adhere to FOIA timelines and proper refusal notice procedures can result in a finding of breach, even if the information is eventually disclosed.
Source document (simplified)
Department for Communities
- Date 12 March 2026
- Sector Central government
- Decision(s) FOI 1: Upheld, FOI 10: Upheld, FOI 17: Upheld The complainant requested information about Universal Credit claimants. The Department for Communities (DfC) stated that it did not hold the information requested. During the course of the Commissioner’s investigation DfC confirmed that it did hold the information requested at the time the request was received. It stated that it should have issued a refusal notice relying on section 12 (appropriate limit) of the FOIA as compliance with the request would have exceeded the appropriate limit. In addition, DfC provided the information requested during the course of the Commissioner’s investigation. The Commissioner’s decision is that DfC breached sections 1 and 10 of FOIA as it failed to confirm the requested information was held within 20 working days of receipt of the request. The Commissioner also finds that DfC breached section 17 of the FOIA for failing to issue a refusal notice stating it was relying on section 12 of the FOIA within the appropriate time limit. The Commissioner does not require any steps to be taken as a result of this notice.
Related changes
Source
Classification
Who this affects
Taxonomy
Browse Categories
Get Data Privacy & Cybersecurity alerts
Weekly digest. AI-summarized, no noise.
Free. Unsubscribe anytime.
Get alerts for this source
We'll email you when ICO Decision Notices publishes new changes.