ICO (UK) - Enforcement notice to the Queen Elizabeth Hospital King's Lynn NHS Foundation Trust
From GDPRhub
| ICO - Enforcement notice to the Queen Elizabeth Hospital King's Lynn NHS Foundation Trust | |
|---|---|
 | |
| Authority: | ICO (UK) |
| Jurisdiction: | United Kingdom |
| Relevant Law: | Section 1(1) of the Freedom of Information Act Section 54 of the Freedom of Information Act |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 23.03.2026 |
| Published: | |
| Fine: | n/a |
| Parties: | The Queen Elizabeth Hospital King’s Lynn NHS Foundation Trust |
| National Case Number/Name: | Enforcement notice to the Queen Elizabeth Hospital King's Lynn NHS Foundation Trust |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | English |
| Original Source: | ICO (in EN) |
| Initial Contributor: | dt |
The DPA ordered a hospital trust to respond to the Freedom of Information requests it previously failed to reply to in time and to devise and publish an action plan with measures mitigating delays in the future.
English Summary
Facts
The DPA became aware of the poor Freedom of Information (FOI) performance of the Queen Elizabeth Hospital King’s Lynn NHS Foundation Trust (the controller) from a public website and following a complaint. Therefore, the DPA requested the FOI statistics for the last two full financial quarters of 2025 from the controller.
The Freedom of Information Act (FOIA) requires a public authority to inform people whether it holds information they have requested and to communicate it to them within 20 working days of receipt of their request.
Based on the provided statistics, among other things, the controller’s FOI compliance rate was 26%, with a backlog of 95 requests.
Holding
The DPA issued an enforcement notice to the controller, requiring it to comply with Section 1(1) of the Freedom of Information Act (FOIA) for each FOI request unanswered within the statutory 20 working days.
Furthermore, the DPA required the controller to devise and publish an action plan with measures to mitigate delays.
A failure to comply with the enforcement notice may lead to written certification to the High Court under section 54 of FOIA, with the possibility of holding the controller in contempt of court.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
Reference: ENF0988384
FREEDOM OF INFORMATION ACT 2000 (SECTION 52)
ENFORCEMENT POWERS OF THE INFORMATION COMMISSIONER
ENFORCEMENT NOTICE
DATED: 23 March 2026
To: The Queen Elizabeth Hospital King’s Lynn NHS Foundation
Trust
Of: Gayton Road
King’s Lynn
PE30 4ET
1. The Queen Elizabeth Hospital King’s Lynn NHS Foundation Trust (“ the
Trust”) is a “public authority” listed in [Schedule 1] and defined by
[section 3(1)(a)(i)] of the Freedom of Information Act 2000 (“FOIA”).
FOIA provides public access to information held by public authorities.
2. The Trust’s obligations as a public authority under FOIA include –
a. Being obliged to publish certain information about its activities;
b. Responding to requests for information from members of the
public.
3. The Information Commissioner (the “Commissioner”) hereby issues
the Trust with an Enforcement Notice (the “Notice”) under section 52
FOIA. The Notice is in relation to the Trust’s -
a. Continuing non-compliance with section 1(1) FOIA;
b. Continuing breach of section 10(1) FOIA.
1Reference: ENF0988384
4. This Notice explains the Commissioner’s decision to take enforcement
action. The specific steps that the Trust is required to take are set out
in [Annex 1]
Legal Framework for this Notice
5. A person requesting information from a public authority has a right,
subject to exemptions, to be informed by the public authority in writing
whether it holds the information, and to have that communicated to
them, if the public authority holds it. This is set out in section 1(1)
FOIA–
“(1) Any person making a request for information to a public
authority is entitled –
(a) to be informed in writing by the public authority whether it
holds information of the description specified in the request,
and
(b) if that is the case, to have that information communicated to
him.”
6. [Section 10(1) FOIA specifies that public authorities must respond to
requests within 20 working days:
“… a public authority must comply with section 1(1) promptly and in
any event not later than the twentieth working day following
receipt.”
7. There is provision under FOIA for a public authority to claim a
reasonable extension to this limit in certain circumstances but in all
cases, the public authority must give the requestor a written response
within the standard time limit for compliance.
2Reference: ENF0988384
8. The Commissioner has various powers under FOIA. One of these is the
issuing of an Enforcement Notice. Section 52(1) of FOIA states –
“If the Commissioner is satisfied that a public authority has failed to
comply with any of the requirements of Part I, the Commissioner
may serve the authority with a notice (in this Act referred to as an
“enforcement notice”) requiring the authority to take within such
time as may be specified in the notice, such steps as may be so
specified for complying with those requirements.”
9. Section 52 FOIA has effect subject to section 53 FOIA, which provides
details of the exceptions from the duty to comply with a decision notice
or enforcement notice.
Background
10. The Commissioner became aware of the Trust’s poor FOI performance
from a review he undertook of its request handling on the What Do
They Know website and as a result of a section 50 complaint he
investigated. The trust was asked on 1 December 2025 to provide its
FOI statistics for the last two full financial quarters of that year.
11. The trust provide some statistics on 6 February 2026, which raised
concerns about its timeliness rate for responding to requests.
12. The trust outlined that it has been without a substantive FOI officer
since September 2024 and until more recently it has been unable to
recruit to this role due to financial pressures on the Trust and a
proposed restructuring into a Group Model with two other Trusts within
the Integrated Care System.
13. The trust confirmed that it has, however, now began the process of
3Reference: ENF0988384
recruiting into this role, which is expects will assist in tackling its poor
FOIA performance and backlog.
14. Additionally the Trust highlighted a number of other contributory
factors:
• Increase in the volume and complexity of requests.
• Its current software being very limited and not designed to
manage FOI specifically.
• Not being able to proactively publish information which is
commonly requested.
• Loss of experienced staff in the relevant departments across the
Trust, who would pull the relevant data together.
• Delays in signing off responses that require Executive approval
(cases which relate to sensitive material, come from the media
or a similar requestor).
• Lack of understanding and familiarity with FOI processes across
the Trust.
• The need across the Trust to prioritise clinical care and need over
FOI duties.
15. The Trust highlighted how it takes its FOI responsibilities very
seriously and prides itself on the quality of responses it does issue. It
feels this is reflected in the few internal review requests it receives and
the very few section 50 complaints with the ICO across a period of
years, despite its current FOI compliance rates. It also said that its
compliance rate for subject access requests under the Data Protection
Act is consistently above 95%.
16. The Trust provided up to date statistics on 24 February 2026. For
quarters two to four, the Trust was operating at an FOI compliance
rate of 26% (with this slightly dropping to 24% in quarter two). At the
4Reference: ENF0988384
end of quarter four the Trust had a backlog of 95 requests; 60 of which
were over three months old and the remainder being under 6 months
old. Its monthly intake was between 194 to 229 over this period.
The Contravention and Reasons for this Notice
17. FOIA requires a public authority to inform people whether it holds
information they have requested and to communicate it to them within
20 working days of receipt of their request.
18. The Commissioner acknowledges how the Trust takes its FOI
responsibilities seriously and issues high quality responses when it
does respond. However, taking into account the continuing low
compliance rate, volumes of requests each month and the substantial
backlog as at 24 February 2026, alongside the need for significant and
sustained improvement in timely FOI responses, the Commissioner
considers it a proportionate regulatory step to issue an Enforcement
Notice to the Trust. This notice requires the Trust to comply with
section 1(1) of FOIA in respect of each FOI request, where the
response is outside of 20 working days at the date of this Notice, and
where a permitted extension of a maximum of 20 working days has
not been applied. It is essential that the improvements described in
Annex 1 are implemented which compliance with this Notice will
support. The Commissioner has produced a range of resources , 1
including a template Action Plan, which should support the Council in
complying with this step.
19. The Commissioner also considers it a proportionate regulatory step to
require the Trust to devise and publish an action plan, which formalises
measures to mitigate delays. This action plan should be supported by a
1
FOI self-assessment resources | ICO
5Reference: ENF0988384
‘lessons learned’ exercise, which examines the root cause of delays in
responding to FOI request, from allocation through to clearance at
different stages, with mitigations for any recurring problems addressed
specifically in the plan.
Terms of this Notice
20. The Commissioner therefore exercises his powers under section 52 of
FOIA to serve an Enforcement Notice requiring the Trust to take
specified steps to comply with FOIA. The specified steps are set out in
Annex 1 of this Notice.
21. The consequence of failing to comply with an Enforcement Notice is
that the Commissioner may make written certification of this fact to
the High Court pursuant to section 54 of FOIA. Upon consideration and
inquiry by the High Court, the Trust may be dealt with as if it had
committed a contempt of court.
Right of Appeal
22. By virtue of section 57 of FOIA there is a right of appeal against this
Notice to the First-tier Tribunal (Information Rights). If an appeal is
brought against this Notice, it need not be complied with pending
determination or withdrawal of that appeal.
23. Information about the appeals process may be obtained from:
First-tier Tribunal (Information Rights)
General Regulatory Chamber
PO Box 11230
Leicester
LE1 8FQ
6ReferenceENF0988384
Tel: 0203 9368963
Email: GRC@justice.gov.uk
Website: www.justice.gov.uk/tribunals/general-regulatory-
chamber
24. Any Notice of Appeal should be served on the Tribunal within 28
(calendar) days of the date on which this Enforcement Notice is sent.
Phillip Angell
Head of Freedom of Information & Transparency
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
7Reference: ENF0988384
Annex 1
TERMS OF THE ENFORCEMENT NOTICE
THIS NOTICE REQUIRES THE QUEEN ELIZABETH HOSPITAL KING’S
LYNN NHS FOUNDATION TRUST TO TAKE THE FOLLOWING STEPS
BY NO LATER THAN SIX MONTHS FROM THE DATE OF THIS
NOTICE:
(i) In respect of each information request where the response is
outside of 20 working days as at the date of this notice, and
where a permitted extension has not been applied, to comply
with section 1(1)(a) of FOIA and, if information of the
description specified in the request is held, either:
(ii) communicate it pursuant to section 1(1)(b) FOIA; or issue a
valid refusal notice under section 17 FOIA, unless section
17(6) FOIA applies.
THIS NOTICE FURTHER REQUIRES THE QUEEN ELIZABETH
HOSPITAL KING’S LYNN NHS FOUNDATION TRUST
TO TAKE THE FOLLOWING STEP BY NO LATER THAN 35 CALENDAR
DAYS FROM THE DATE OF THIS NOTICE:
(iii) Devise and publish an action plan, supported by a lessons
learned exercise identifying the root cause of delays, which
formalises measures to mitigate delays and ensure the Trust
complies with its legal duties under Part 1 of FOIA to respond
to information requests in a timely fashion.
8
