Neil Lightning v The Information Commissioner [2025] UKFTT 284 (GRC)

[2025] UKFTT 00284 (GRC)

Case Reference: FT/EA/2024/0241

First-tier Tribunal

(General Regulatory Chamber)

Date 7 March 2025

Information Rights

Decided without a hearing

Before

JUDGE KIAI

TRIBUNAL MEMBER CHAFER

TRIBUNAL MEMBER SAUNDERS

Between

NEIL LIGHTNINGAppellant

THE INFORMATION COMMISSIONERRespondent

Decision: The appeal is Allowed.

Substituted Decision Notice:

for reasons set out below:

(i) The Public Authority was not entitled to rely on section 12 of the Freedom of Information Act 2000. As such, the Public Authority is directed to:

a.Reconsider it’s analysis of Mr Lightning’s request in light of the Tribunal’s decision and provide a fresh response within 35 days of receipt of this decision;

b.Rigorously and efficiently carry out searches as necessary to identify evidence relating to Mr Lightning’s actual request, again within 35 days of receipt of this decision.

(ii) The Public Authority did not provide advice and assistance as required by section 16 of the Freedom of Information Act 2000. As such the public authority is directed to:

a.Provide Mr Lightning with a fresh response to his request for advice or assistance under section 16 FOIA, as to how he could refine his request if this is necessary, once it has reconsidered the request as required above.

(iii) Any failure to abide by the terms of the tribunal’s substituted decision notice may amount to contempt which may, on application, be certified to the Upper Tribunal.

REASONS

Background to the Appeal

[1]This appeal is against a decision (IC-280644-F4K7, the “Decision Notice”) of the Information Commissioner (‘the “Commissioner”) dated 23rd May 2024. The appeal relates to the application of the Freedom of Information Act 2000 (“FOIA”). It concerns information requested from Cambridge University Hospital NHS Foundation (“the Public Authority”), relating to the Epic electronic patient record system.

[2]The parties opted for paper determination of the appeal. The Tribunal is satisfied that it can properly determine the issues without a hearing within rule 32(1)(b) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended). The Request

[3]On 25th July 2023, Mr Lightning wrote to the Public Authority, requesting the following:

“1. All notes, drafts, emails, telephone recordings/transcripts, memos, agendas and Minutes regarding the operation of the Epic electronic patient record system between January 2017 and the present day. In particular, I am interested in information relating to the discovery of an error in the operation of that system which meant that Alerts were not being added to the system correctly. 2. All correspondence between CUH and Epic in that timeframe. 3. All notes, drafts, emails, telephone recordings/transcripts, memos, agendas and Minutes regarding the action plan to remedy the issue(s) outlined above, including whether a retrospective check was completed to understand the scope of the issue(s) and, if so, how many patients had been affected once that check was complete. 4. All notes, emails, telephone recordings/transcripts, memos, agenda and Minutes regarding whether those affected by the issue(s) outlined above should be informed and who was responsible for these decisions”

. The Response

[4]On 8th August 2023, the Public Authority responded to the request, refusing to provide the requested information, citing section 12(1) of FOIA (cost of compliance exceeds appropriate limit). It maintained that:a. The request would be disproportionately expensive to devote resources to answering. The cost of complying with the request exceeds the appropriate limit of £450;

b. The scope of this is too wide and the Public Authority would need to review all the collected data to ensure they are releasing only the data requested;

c. Much of the data would be business confidential or covered by intellectual property so they would need to review all the data to ensure they were only releasing appropriately.

[5]On 23rd August 2023, Mr Lightning emailed the Public Authority specifically asking for advice and assistance in line with section 16 FOIA: ‘Thank you for your email of 8 August and the attached letter. I understand there is a requirement in the ICO exemption information that you should offer advice and assistance as to how I can refine my request. Please can we explore this. In addition, could you explain which of the data might be considered business confidential or covered by intellectual property’.

[6]The Public Authority upheld its position on internal review (dated 29th September 2023) – we pause here to note that Mr Lightning does not accept this was a review, contending that the Public Authority merely suggested that he make an actual complaint. The wording of the purported review is set out below: ‘The case has been reviewed by the Director of Corporate Affairs and the Information Governance Lead. Please accept our apologies that when we applied the section 12 exemption, we did not provide you with advice and assistance to help you reframe your request with a view to bringing your request within the cost limits. Unless we get something absolute to investigate the hours involved in checking that we release only appropriate data will exceed the 18 hours. It would be better for you to make an actual complaint about the incident you are referring to so that we could investigate it appropriately – you are alluding to something that is not known to us. We need absolute specifics of the timing and issue that you think occurred so we can review and respond. Date and time of perceived incident, specific details of the perceived incident, area/speciality that the perceived incident is aligned to (paediatrics, medical, pharmacy, etc)’.

[7]On 13th October 2023, Mr Lightening replied, again repeating his request for advice and assistance. He further explained: ‘We are seeking information regarding an issue in the operation of the Epic system before Mum's death and an apparent cover-up of that issue. I thought I had been fairly specific in my original request but to add further information in Mum's case (although I stress this is extremely unlikely to be a single incident): 1) in March 2017 the report of a chest x-ray for Mum said "concerning for tumour" and an Alert was placed on the Epic system, but nobody did anything about this and we were not told 2) during the complaint process we asked several questions about this which were either ignored or answered in a vague manner 3) towards the end of complaint process, in September 2021 we received an email from Sue Bennison, PALS manager, that said "One of the issues in this case was that when the Alert was added by the Radiologist, it was not added correctly.... This issue was identified in December 2017 and additional information was sent to allradiologists to remind them of the correct way to record these alerts" suggesting that either a retrospective check was not done to see who had been affected, or it was done but somebody decided to take no action’.

[8]On 10th January 2024 Mr Lightening referred the matter to the Information Commissioner. He explained that ‘In five months CUH have neither complied with my request nor offered advice as to how I can refine my request to avoid the Section 12 Exemption. In any case, I believe that the cover-up of a systematic flaw in their Epic electronic patient record system which has likely affected many patients is information that is in the public interest to release irrespective of Section 12’.

[9]A revised review report was prepared on 9th May 2024 – it does not seem this was sent to Mr Lightning at this stage (this is expanded upon below). The revised report concluded with the following: ‘Our Chief Clinical Information Officer has confirmed that: We don’t record user-errors in a systematic way. Of course, QSIS (incident system) will be raised if there was an incident, and some of these may involve user ‘workflow’ errors but we don’t code these explicitly so it would take >18 hours to search through all the QSIS reports and make a determination. If you still feel this would exceed the costs limits under section 12, again I would ask that you provide advice and assistance As the QSIS system is the only place that system errors may be recorded our only option would be to request an extract of incidents raised and review these incidents to identify any that would fall within the remit of your request, up to the 18 hours limit. We could request an extract from March 2017 to date. As each incident is categorised, we may be able to exclude some to focus on the type of incidents that may be relevant to review, I would be happy to give you a proposal of the types of incidents that we could exclude ahead of us undertaking the review. We could then either review from March 2017 in date order or focus on specific periods if you prefer. Following this review, we would be able to provide a response to your request and provide an overview of how many incidents we reviewed. Please advise if you want the trust to undertake this review of QSIS incidents’.

[10]On 10th May 2024, the Commissioner wrote to Mr Lightning explaining that it had asked the Trust to reconsider the way it dealt with his question and having done so, the Commissioner understood that the Public Authority had written to him and disclosed information. It also provided him with advice and assistance in order to bring his request within the appropriate limit of FOIA. The Commissioner explained that it was writing to ascertain if Mr Lightning wanted to proceed with the case which would investigate whether the Trust was entitled to refuse the original request of 25th July 2023 under section 12. Or Mr Lightning could use the advice and assistance that the trust has now provided to submit a new request for information.

[11]On 14th May 2024, Mr Lightning wrote back to the Commissioner, explaining that the Trust had not written to him disclosing information and providing advice. He had not heard from them since 12th January 2024, when they had said they were looking at the points he had raised and would send him a response. He explained that in the nearly 10 months since he had submitted his FOI request, he had received no advice, assistance or information of note.

[12]On 17th May 2024, the Public Authority wrote to the Commissioner, explaining:

‘As advised in the review report the only place that any information could be held that would answer the above is on our QSIS system, this system records the incidents that take place in the Trust. There is no category on the incident log that would relate to the questions asked above so all incidents would need to be reviewed. From 2017 to date there are 31,599 incidents logged. The description from each incident would need to be reviewed. We have reviewed a number of incidents to gage how long it would take to read the description of each incident. This review has shown that it would take 10 seconds to read each description, we could therefore review a maximum of 360 per hour. To review all incidents would take 87 hours. The team responsible for our EPR have confirmed that they do not hold central records that would answer the above questions’

. The Decision Notice (dated 23rd May 2024)

[13]The Commissioner concluded that:a. The Public Authority was correct to refuse the request under section 12;

b. The Public Authority had complied with its section 16 (advice and assistance) obligations.

c. The Commissioner did not require further steps.

[14]There was reference to the revised review report in that decision. Correspondence

[15]On 23rd May 2024, Mr Lightning wrote to the Commissioner, explaining that he was very surprised to have received the decision. He had explained in his email of 14th May that the communication he had received from Addenbrooke was in January 2024 and this remained the case.

[16]On the same day, the Commissioner wrote to the Public Authority, explaining that Mr Lightning had not received the correspondence of 9th May 2024 (document titled 469.23). The Commissioner asked the Public Authority to provide a copy of the correspondence. The Public Authority also wrote to Mr Lightning, explaining that the document would be forwarded to him.

[17]Again, on the same day, the Public Authority contacted Mr Lightning, apologising for the delay in responding to him and that he had not received the email sent on 9th May 2024. They attached the revised review report and a document titled ‘Re 2nd letter complaint Lightning’, they stated that if ‘you would like the Trust to undertake a review of the QSIS incident system up to the 18 hours time limit then please do not hesitate to contact me’.

[18]On 31st May 2024, Mr Lightning wrote to the Public Authority, confirming that this was the first email he had received from them since January and that their response now indicates that they have misunderstood his original request. He was not asking for a list of incidents of user errors from the QSIS system. The refusal under section 12 was therefore based on a search of a system that he had not asked for and which would not provide the information he was requesting.

[19]On 3rd June 2024, Mr Lightning wrote to the Commissioner explaining that:a. The refusal under section 12 was based on a search of a system that he did not ask them to do and would not provide the information he was requesting;

b. The Commissioner’s decision was based on inaccurate information: i. The Commissioner stated that the Trust had provided the outcome of its internal review on 29 September 2023 upholding its position in relation to section 12(1), however this was not correct. On that date the Trust asked for more information and suggested making a complaint which they had already done; ii. The Public Authority had not contacted him to offer advice and assistance, despite him asking several times.

c. Mr Lightning explained that he was aware an appeal needed to be submitted within 28 days but he was not sure if the decision stood given the inaccuracies and whether an appeal was necessary.

[20]The following day the Commissioner replied, stating that the decision could not be amended once issued and if Mr Lightning was concerned that the decision was wrong, or the public authority had misinterpreted the scope of his request, this could be addressed by the Tribunal via the appeal procedure. The Commissioner added that at the time the decision notice was issued, the public authority had provided the commissioner with a copy of the advice and assistance it said it had provided to Mr Lightning. He didn’t receive the email, but the Commissioner can’t verify why it wasn’t received. Again, the Tribunal could investigate this in more detail if he wanted to include it in his grounds.

[21]On 13th June 2024, Mr Lightning asked the Commissioner for a copy of the email the Public Authority had allegedly sent him. He explained that when he had asked the Public Authority for this, they had sent him a new email rather than providing evidence that they contacted him on 9th May.

[22]On the same day, the Commissioner replied stating that the Commissioner only held the information that Mr Lightning had already received: document ‘469.23 Review Report – updated’, it was attached to an email from the Commissioner which explained it had been sent, but the Commissioner was not copied into the actual email and was not sent it as an attachment.

[23]Further emails were exchanged between Mr Lightning and the Commissioner, which are not set out here. Notice of Appeal

[24]Mr Lightening appealed on the basis that: a. The Commissioner was incorrect when it stated that the public authority was correct to refuse the request under section 12, because their refusal was nothing to do with the information he was requesting. The Public Authority’s argument for refusing the request was based on a search of a system that he did not ask them to do, and neither would it provide the information he is requesting:

‘As I said in my email on 31 May to Michelle Ellerbeck, DPO at CUH, to which unsurprisingly I have not yet received a reply “I am not asking for a list of incidents of user errors from the QSIS system, We already know that the Alert was placed incorrectly on the Epic EPR system for Mum’s x-ray in March 2017, and that this is very unlikely to be a one-off error…What my sister and I are trying to establish, as I have already said, is not the errors themselves but the covering-up of those errors as revealed in Sue Bennison’s email to us on 27 September 2021, and who was responsible for this cover-up. The systematic issue was discovered by Addenbrooke’s in December 2017 but either Addenbrooke’s did not retrospectively check who was affected, or they did check but decided not to tell those affected. Both of these options are extraordinarily damning”. b. The Public Authority did not provide him with advice or assistance under section 16 as to how he could refine his request until after the Commissioner had made its decision on 23rd May 2024. c. A senior Case Officer at the Commissioner emailed Mr Lightning on 10th May 2024 saying that the Trust had contacted him, disclosed information and provided him with advice and assistance. He replied that it had not, that the last contact from the Public Authority was a brief email on 12th January 2024 and that in the nearly 10 months since he had submitted his FOI request, he had received no advice, assistance or information of note from the Trust. Despite this, the Commissioner went ahead and issued a factually incorrect Decision. d. Paragraph 21 stated that the public authority wrote to Mr Lightning. However, he had told the senior case officer that the last email he had received was almost 4 months prior to that. e. The Trust failed to provide him with the results of its internal review. f. He does not wish to reopen the investigation relating to his mother’s care as suggested. g. ‘In summary, we have a Trust who in almost 11 months have not addressed a very valid and important Freedom of Information request, and an independent body (the ICO) who have agreed with the Trust based on incorrect information and processes that favour the Trust. Even after I had told the ICO it was incorrect they made their flawed Decision anyway and say they cannot now amend it, adding extra time and effort to an already lengthy process’

. Information Commissioner’s Response

[25]The Information Commissioner, responded on 17th July 2024: Issue 1: S.12(1) FOIAa. The Commissioner reiterated that it relied on the Decision Notice. He further added the points below.

b. Mr Lightning had not disputed the Public Authority’s cost estimate of searching the QSIS system (only that this would not be necessary). The Commissioner’s understanding is that to search for the information requested and provide a response the Trust would need to identify any relevant incidents and to do this it would be required to search the QSIS system. On this basis the Commissioner submitted that the search was entirely necessary. Issue 2: S.16 FOIA

c. The Trust provided advice and assistance following service of the Decision Notice.

d. The Commissioner would therefore consent to a substituted Decision Notice finding a breach of section 16 FOIA as advice and assistance had not been provided to Mr Lightning, however no substituted steps would now be required.

e. It was open to Mr Lightning to submit a refined request based upon the advice and assistance now provided. Mr Lightening’s Reply

[26]Mr Lightening replied in a letter dated 31st July 2024:a. If the Public Authority considered that providing that information would be too costly then it should have provided advice and assistance to Mr Lightening on that basis;

b. The 18-hour limit was irrelevant if the time was estimated for a process that would not provide the information requested;

c. The caselaw referred to by the Commissioner was not relevant as it concerned the best way to obtain the information requested. The proposed search of the QSIS system would not provide the information he had requested;

d. The email received from the Public Authority on 23 May 2024, after he had received the Decision Notice, offered advice and assistance to provide information that he had not requested and was therefore irrelevant to his Section 16 challenge. He had never received advice and assistance from the Public Authority on his FOIA request of 25 July 2023. Issues and Evidence

[27]The issue in this case is whether the Public Authority was entitled to rely on section 12(1) FOIA to refuse the Request and whether there was a breach of section 16 FOIA.

[28]By way of evidence and submissions we had the following, all of which we have taken into account in making our decision:a. An Open Hearing Bundle;

b. The Commissioner’s Response;

c. Mr Lightning’s reply to the Response by the Commissioner to the Notice of Appeal;

d. Mr Lightening’s witness statement, dated 4th October 2024. Legal Framework

[29]The relevant provisions of FOIA are as follows: 1. General right of access to information held by public authorities.(1) Any person making a request for information to a public authority is entitled— (a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b) if that is the case, to have that information communicated to him. 12 Exemption where cost of compliance exceeds appropriate limit (1) Section 1(1) does not oblige a public authority to comply with a request for information if the authority estimates that the cost of complying with the request would exceed the appropriate limit.

(2) Subsection (1) does not exempt the public authority from its obligation to comply with paragraph (a) of section 1(1) unless the estimated cost of complying with that paragraph alone would exceed the appropriate limit.

(3) In subsection (1) and (2) “the appropriate limit” means such amount as may be prescribed, and different amounts may be prescribed in relation to different cases.

(4) The [Minister for the Cabinet Office] may by regulations provide that, in such circumstances as may be prescribed, where two or more requests for information are made to a public authority – (a) By one person, or (b) By different persons who appear to the public authority to be acting in concert or in pursuance of a campaign, The estimated cost of complying with any of the requests is to be taken to be the estimated total cost of complying with all of them.

(5) The [Minister for the Cabinet Office] may be regulations make provisions for the purposes of this section as to the cost to be estimated and as to the manner in which they are to be estimated. 16 Duty to provide advice and assistance (1) It shall be the duty of a public authority to provide advice and assistance, so far as it would be reasonable to expect the authority to do so, to persons who propose to make, or have made, requests for information to it. (2) Any public authority which, I relation to the provision of advice or assistance in any case conforms with the code of practice under section 45 is to be taken to comply with the duty imposed by subsection (1) in relation to that case. 17 Refusal of request. (5) A public authority which, in relation to any request for information, is relying on a claim that section 12 or 14 applies must, within the time for complying with section 1(1), give the applicant a notice stating that fact.

(6) Subsection (5) does not apply where— (a) the public authority is relying on a claim that section 14 applies, (b) the authority has given the applicant a notice, in relation to a previous request for information, stating that it is relying on such a claim, and (c) it would in all the circumstances be unreasonable to expect the authority to serve a further notice under subsection (5) in relation to the current request.

[30]The Freedom of Information and Data Protection (Appropriate Limits and Fees) Regulations 2004, make the following provision in relation to the “appropriate limit” and the costs which can be included when calculating that limit:(a) Regulation 3 of the Fees Regulations, read in in conjunction with Schedule 1 FOIA, provides that ‘the appropriate limit’ for the purposes of section 2(1) FOIA is £600 for central government departments (reg.3(2)), and £450 in the case of any other public authority (reg.3(3)).

(b) Not all costs which may be incurred in complying with the request may be taken into account. Regulation 4 of the Fees Regulations sets out the activities which can be taken into account when estimating the cost of compliance with s.1(1) FOIA for the purposes of the appropriate limit, together with the estimated cost for the time spent in undertaking those activities: “(3) In a case in which this regulation has effect, a public authority may, for the purpose of its estimate, take account only it reasonably expects to incur in relation to the request in – (a) Determining whether it holds the information, (b) Locating the information, or a document which may contain the information,

(d) Extracting the information from a document containing it. (4) To the extent to which any of the costs which a public authority takes into account are attributable to the time which persons undertaking any of the activities mentioned in paragraph (3) on behalf of the authority are expected to spend on those activities, those costs are to be estimated at a rate of £25 per person her hour”. (a) Determining whether it holds the information, (b) Locating the information, or a document which may contain the information, (c) Retrieving the information, or a document which may contain the information, and (d) Extracting the information from a document containing it. Discussion and Conclusions

[31]In accordance with section 58 of FOIA, our role is to consider whether the Commissioner’s Decision Notice was in accordance with the law. As set out in section 58(2), we may review any finding of fact on which the notice in question was based. This means that we can review all of the evidence provided to us and make our own decision.

[32]We set out from the outset that we accept Mr Lightning’s evidence as credible. We accept that he did not receive a copy of the revised review report on 9th May 2024. No evidence has been provided either to Mr Lightning nor to the Tribunal to show that the email was in fact sent or received on that date. We consider each issue in turn. Section 12(1) of FOIA (Cost of Compliance exceeds appropriate limit)

[33]The Public Authority maintains that the only place that any information could be held that would answer the issues raised is on the QSIS system, this system records the incidents that take place in the Trust. All incidents would need to be reviewed. Having undertaken a sample, the Public Authority considers that this would take 87 hours. The Commissioner upholds this view in the decision notice, concluding that a ‘manual review of all incidents would be the only way to fulfil the request’.

[34]We accept that if the information that was being considered under the QSIS system, would result in the information being requested, section 12 FOIA would be applicable – there is no challenge to the time estimates provided.

[35]However, having considered the matter further, we accept Mr Lightning’s submission that the Public Authority’s reasons for refusing the request were based on a search of a system that would not provide the information requested. Mr Lightning did not want a list of incidents of user errors from the QSIS system, he was not seeking to show that errors took place – that was not the purpose behind his FOIA request. He has repeated this on several occasions. What Mr Lightning was trying to establish through the request was any evidence of the cover up of those errors – not the errors themselves. Again, Mr Lightning explained that he was aware that the systematic issue was discovered in December 2017 – what he wanted to find out from the FOIA request was whether the Public Authority retrospectively checked who was affected by those errors and/or if they did carry out those checks, they chose not to tell those who were affected/took a decision not to take any action.

[36]It seems that the Public Authority (and subsequently the Commissioner in reliance on the Public Authority’s reasoning) has misunderstood the nature of the request when applying section 12 FOIA. The Public Authority have focused entirely on the one system (QSIS) when considering the current request. Although we note the submission that ‘the QSIS system is the only place that system errors may be recorded’ and therefore the assertion that ‘our only option would be to request an extract of incidents raised and review these incidents to identify any that would fall within the remit of your request’, we find this is based on the assumption that Mr Lightning is requesting information about user errors. This was not what he was requesting. Mr Lightning wanted information about - for example - what checks were carried out retrospectively, how that information was treated, what actions were taken. As such we find it difficult to accept that there would not be further information available on other systems such as an internal management system that reports to the management board perhaps, or emails between individuals if there had been errors within the QSIS system for example.

[37]For these reasons, we conclude that the Public Authority was not entitled to rely on section 12 FOIA. The proposed search of the QSIS system will not provide the information Mr Lightning has requested and therefore the cost of compliance assessment undertaken by the Public Authority and relied upon by the Commissioner is not relevant to the request in question. We conclude that the decision was not in accordance with the law.

[38]It is important that we note here, the QSIS system was not raised with Mr Lightning before the Decision Notice was issued:a. The first purported ‘review’ on 29th September 2023, did not actually review the initial decision (and made no reference to the QSIS system) but instead suggested that Mr Lightning make a complaint about the incident he was referring to, as they needed specifics about the timings and issue that he was referring to. Mr Lightning did provide specifics on 13th October 2023, but nothing was forthcoming from the public authority until May in the ‘revised review’;

b. The ‘revised review’ which did raise the QSIS system, was not actually sent to Mr Lightning until after the decision notice was issued, despite Mr Lightning having told the Commissioner on 14th May (before the date the decision notice was issued) that he had not had any contact with the Public Authority since January 2024.

[39]In light of this, we find that Mr Lightning was deprived of the opportunity to highlight his concerns to either the Public Authority or the Commissioner in advance of the decision notice and his views were therefore not taken into consideration. This was a procedural irregularity capable of making a material difference to the outcome of the proceedings. Section 16 FOIA (Duty to provide advice and assistance)

[40]Mr Lightning first requested advice and assistance on 23rd August 2023, however there is an ongoing duty on the Public Authority to provide advice and assistance even if no request had been made.

[41]The Commissioner maintains in his reply that it was informed by the Public Authority that advice and assistance had been provided to Mr Lightning on 9th May 2024 and a copy of this was provided to the Commissioner on this date, ’32…However the Commissioner acknowledges that he [the Appellant] had not received any correspondence from the Trust since 12 January 2024. The Appellant informed the Commissioner again, upon receipt of the DN that the advice and assistance had not been provided to him. The Commissioner alerted the Trust to the fact that the Appellant had not received the advice and assistance and asked for this to be provided urgently. The Trust provided the advice and assistance on 23 May following service of the DN.33. Whilst the Commissioner would therefore consent to a substituted DN finding a breach of section 16 FOIA as advice and assistance had not been provided to the Appellant, he submits that no substituted steps would not be required.

34. It is open to the Appellant to submit a refined request based upon the advice and assistance now provided’.

[42]The Tribunal find that aspects of this analysis are incorrect:a. Whilst we accept that the Commissioner was informed by the Public Authority that advice and assistance had been provided to Mr Lightning on 9th May 2024, we have not seen any evidence that this was actually served on Mr Lightning on this date – despite repeated requests from Mr Lightning to both the Public Authority and the Commissioner (the Commissioner confirmed on 13th June 2024 that it had received an email which explained that the review had been sent - but the Commissioner had not been copied into the actual email and had not been sent it as an attachment);

b. Again, it is accurate that Mr Lightning informed the Commissioner upon receipt of the Decision Notice (on 23rd May 2024) that he had not received advice and assistance. However this fails to acknowledge that Mr Lightning also emailed the Commissioner on 14th May 2024 (ie before the Decision Notice) and told the Commissioner that he had not received any information from the Public Authority since 12th January 2024 (and indeed even that email from the Public Authority provided no actual information, but stated that they were looking at the points he had raised and would send him a response). No action was taken in relation to this by the Commissioner;

c. We pause to note that even if the review had been served on 9th May 2024, this was 10 months after the request (which was 25th July 2023) and 9 months after the first request for advice (23rd August 2023). This is unsatisfactory.

[43]The Commissioner accepts, there was a breach of section 16 FOIA as advice and assistance was not provided to Mr Lightning by the Public Authority in advance of the Decision Notice.

[44]We further conclude that the revised review served on 23rd May 2024, again related to the incident system (QSIS). We conclude that it did not engage with the information that Mr Lightning had actually requested (as already addressed above) and is therefore irrelevant to the section 16 challenge. As such, we conclude that Mr Lightning did not receive advice and assistance from the Public Authority of his FOIA request of 25th July 2023, either before or after the Decision Notice was served.

[45]We find that substituted steps are required: the Public Authority are directed to issue a fresh response to his request for advice and assistance, if they are unable to disclose the information requested. Signed Date: Judge Kiai 1st March 2024