The law on access to health details is meant to empower people but can sometimes be abused, writes Ian Cooper
The aim of the Freedom of Information Act was to empower individuals and organisations by granting them a right to access to documents and information held by public authorities.
While most people exercise their rights under the legislation in a sensible and responsible manner, it is true to say that some will abuse this right, imposing a burden, both in terms of finances and resources, on public authorities.
In order to deal with freedom of information requests efficiently, health organisations must ensure that they can confidently identify vexatious requests.
Section 14(1) of the Act says that the general right of access to information 'does not oblige a public authority to comply with a request for information if the request is vexatious'.
'Vexatious' is not defined within the legislation. Its normal definition would be to 'cause annoyance or worry'. Given that all such requests may cause annoyance or worry, this provides little assistance. However, the information commissioner's recently published Good Practice Guidance (No. 22, July 2007) says that a request can be treated as vexatious if it would impose a significant burden on the public authority in terms of expense or distraction and meets at least one of the following:
it does not have any serious purpose or value;
it is designed to cause disruption or annoyance;
it has the effect of harassing the public authority;
it can otherwise be characterised as obsessive or manifestly unreasonable.
It is important to remember that it is the request, rather than the requester, that is deemed vexatious. An individual can make as many requests for information as they wish but this cannot be labelled as vexatious if the request is genuine.
The Act provides that public authorities do not need to comply with requests for information if the request is identical or substantially similar to a previous request from the same person which the public authority has already complied with. The exception to this is where a 'reasonable interval' has elapsed between compliance with the previous request and the making of the current request.
Vexatious requests are often thought of as ones made repeately, however, some single requests impose a significant burden. The Good Practice Guidance provides some useful tests. A single request may be considered vexatious if:
The requester makes it clear it is their intention to cause the public authority maximum inconvenience
There is no serious purpose or value to the request
Much of the information falls within an exemption and requires extensive redaction leaving the remaining information meaningless
The request can be characterised as obsessive or manifestly unreasonable - this should be relatively easy to recognise and should not be common.
Failure to deal with requests in an appropriate manner or refusing to supply the information may ultimately lead to a complaint being made to the information commissioner, and damaging publicity.
Public bodies must send the requester a refusal notice if they intend to reject a request for information in whole or in part no later than 20 working days after the request is received. This is a strict time limit. The refusal notice must specify the exemption on which the organisation relies and why it applies to this request.
Good practice tips
Managing requests under the Freedom of Information Act can be challenging for any organisation. Health organisations should ensure:
all staff are able to identify these requests and know where to refer them within the health organisation;
the requests are dealt with by appropriately trained staff;
processes are in place to ensure complex requests are dealt with at a senior level; in particular to ensure that a decision to treat a request as - vexatious - is made appropriately;
a robust system is in place for logging, processing and responding to requests within the statutory time limits;
even if a request is deemed not to be vexatious, there are other exemptions within the Act and the person dealing with the request must be aware of these to ensure that information is not disclosed inappropriately;
if a request is likely to place a significant burden on the organisation (in terms of cost and time) the amount of time spent in dealing with the request should be recorded so that the organisation can demonstrate the likely burden placed on it by the request.