Learned over the course of writing a think-tank report, and getting frustrated with Oxford several times. Feel free to reach out if you’re considering doing an FOI and wondering if I could help :)
- What Do They Know is probably the best way of making a request, provided that your aim is to surface information for the
public (rather than, say, trying to
get a scoopThough they do also have a paid tool for journalists, which I’ve not tried), – it’s got a decent UI, and more importantly the outcome of your request will be easily findable by others
- Use Claude to draft rebuttals and requests for an internal review; it will save you time!
- Practically any request for information counts under the Act
- It doesn’t matter
who you send the request for information to – the 20 working day
time period for response starts from the day after anybody in the organisation receives it
- This means that, for example, you can email the press office with a question in the hope that they answer it quickly & informally – and if not have your query “upgraded” to an FOI request without any additional delay
- Frustratingly, quite a few press office staff seem not to know this and will tell you to re-submit the request yourself
- I have the impression that there aren’t really any consequences for organisations responding to FOIs late. If getting a response
is critical, you should probably reach out 3+ months before your deadline.
- The University of Bedfordshire got back to me 6 months after I submitted the request, with an intranet link that I couldn’t access (!!!)
- The ICO themselves are also annoyingly slow at dealing with complaints, so I wouldn’t count on this as a means of forcing a reply, it’s more a form of vindication for you…
- FOI and press office emails don’t have a standardised format between organisations
(e.g. sometimes they’re
foi@, orinformation.compliance@, ordataprotection@) so you probably will have to go through every single website individually.- I tried to automate this back in Autumn 2024 but there weren’t any tools reliable enough. I suspect that you might be able to get an LLM with computer use to manage it. Search engine access alone isn’t good enough because on a lot of websites you need to click through various buttons to reach the actual email.
- If you’re doing a mass mail-merge, it’s worth paying £1.99 to have Outlook Premium (or equivalent, not sure if Gmail has this) so that your emails don’t get rate limited & blocked as spam (by paying you get up to 1,000 per day, compared to about 20 otherwise)
- It’s worth taking the time to be precise with your initial request, almost red-teaming to see what an adversarial interpretation would look like. Some organisations seem to like asking pointless clarifications as a time-wasting tactic.