FOI research project

 

University of Cumbria

 

Background

 

Context

The University of Cumbria was created on 1^st August, 2007 from the merger of the former St. Martin’s College and Cumbria Institute of the Arts, as well as the Cumbrian campuses of the University of Central Lancashire (UCLan). The university’s head office is in Carlisle, but it also has campus locations across Cumbria and North Lancashire as well as in London. 

The Freedom of Information (FOI) Act came fully into force on 1^st January, 2005. Higher Education institutions are classed as ‘public authorities’ under the Act, which means that anyone can make a request to the university for any ‘recorded information’ held by the institution. The university must confirm or deny that the information is held and provide the information within 20 working days, subject to exemptions. Exemptions cover information which can legitimately be withheld from disclosure, including for example personal data, information which would harm commercial interests if disclosed and information intended for future publication. Most exemptions are subject to a ‘public interest test’ which means that the wider public interest factors for and against disclosure must be considered. There is also a provision within the Act to refuse a request where the work involved to locate, retrieve and extract the information would exceed 18 hours.

 

Aims and Objectives

The purpose of the project was to track the processing of 5 FOI requests during the month of January 2012 in order to calculate the total cost of dealing with each FOI request.

 

The aims and objectives of the University of Cumbria’s participation in the project were to: 

 

• Establish the full costs of handling FOI requests at the university
• Understand the time spent on FOI requests by staff across the institution
• Understand the process of handling FOI requests and consider how this could be improved
• Compare experience against other institutions, particularly in the handling of ‘round robin’ requests received by other project participants
• Contribute to a sector initiative on the FOI Act, particularly in the context of the Parliamentary Post Legislative Scrutiny of the Act scheduled for early 2012
• Assess the university’s performance in relation to the Records Management Maturity Model 

 

Key Drivers

Along with the rest of the sector, the University of Cumbria has experienced a gradual increase in the volume and complexity of requests for information received under the Freedom of Information Act alongside increasing pressure on the resources available to deal with them. The increase in the volume and complexity of requests (as indicated by the use of exemptions) is highlighted below:-

 

Academic Year	Number of FOI requests	Use of Exemptions
2007/08	50	22% of requests
2008/09	49	20% of requests
2009/10	90	15% of requests
2010/11	81	26% of requests
2011/12 (01.08.11 – 31.01.12)	47	32% of requests

 

The staff resource for dealing with FOI requests has remained broadly the same since the university’s creation in 2007. Responsibilities are as follows:

 

Post	Responsibilities
Records Management Officer	Oversees FOI, Data Protection and Records Management. Responsible for coordinating FOI requests.
Admin Assistant	A proportion of time spent logging and tracking FOI requests and assisting Records Management Officer. This post is not a dedicated resource and is shared within the wider Vice Chancellor’s Office.
Registrar and Secretary	Makes the final decision on use of exemptions and oversees approach to sensitive or complex requests
Staff across the institution	Provide information to help respond to FOI requests.

 

In line with the sector generally, the university is under financial pressure as a result of changes to funding arrangements and therefore must manage the increased FOI workload generated by FOI requests within existing resources.

 

Scope

The project focused on 5 FOI requests received by the university during the month of January, 2012. The requests were randomly selected and had to include 2 ‘round robin’ requests (i.e. received by the majority of institutions). The time spent by each member of staff involved with the request, the type of work they undertook and their salary scale or exact salary were recorded. This data was used to calculate the total cost of dealing with each FOI request.

 

Requests were selected following consultation with other participants in the project to identify ‘round robins’. This enabled us to select requests received from 1^st January 2012 as follows: 

 

• The first 2 ‘round robins’ requests received in January
• 3 ‘randomised’ requests received in January – these had to be either the 1st , 3rd or 5th requests received, or if any of these were ‘round robins’ the next request would be selected (e.g. 2nd, 4th, 6th)

 

Participants in the project were also asked to complete the JISC infoNet Records Management Maturity Model. This assesses an institution’s maturity in relation to its approach to records management. The purpose of completing the model was to help determine whether good records management practices contributed to more effective compliance with the FOI Act.

 

Governance

Compliance with the Freedom of Information Act sits within the Vice Chancellor’s Office, which also encompasses Governance and Compliance (including legal, committee and governing body), Communications and Strategic Planning and Performance.

 

The Senior Management Team member with responsibility for FOI is the Registrar and Secretary. Day to day responsibility rests with the university’s Records Management Officer, who also manages Data Protection compliance and records management. The Records Management Steering Group oversees FOI compliance and reports directly to University Management Team. This group is chaired by the Registrar and Secretary and includes representatives from across the university.

 

The university’s Records Management Officer led the project, with input from an admin assistant and colleagues across the institution who were involved in answering the tracked requests. The Records Management Officer also reported to the Records Management Steering Group at its January meeting on participation in the project.

 

Project Approach 

The university adapted its existing process for handling FOI requests in order to contribute to the project. The methodology used is described below.

 

In addition, the Records Management Maturity Model was completed jointly by the university’s Records Management Officer, Registrar and Secretary and Network and Security Manager.

 

Blue = existing processes

Red = new process, for the purpose of tracking requests for the project

 

Stage in Process	Who is involved	Methodology
Receipt and Logging of request	Admin Assistant	Recorded on Access database and acknowledgement sent to requester
Identification of requests to be tracked	Admin Assistant	Consultation with other project participants to identify ‘round robin’ and ‘random’ requests
Inputting details of request into project spreadsheet	Admin Assistant	These details replicated the information already recorded in our Access database
Recording time spent on the request on each individual stage of the process	Records Management Officer and Admin Assistant	This was noted down whilst work was ongoing and later totalled up and added to the project spreadsheet for each individual
Initial analysis	Records Management  Officer	Determining who may hold the information, considering any clarification required and possible exemptions where relevant
Identifying the relevant information	Records Management Officer and colleagues across the institution	Consultation with colleagues to determine whether the information is held, any clarification required and possible exemptions where relevant
Asking colleagues to record the time spent on the request against categories provided	Records Management Officer	Explaining to colleagues over the phone as well as by e-mail to ensure they understand the purpose of tracking the request and the information required from them
Seeking clarification from the requestor if necessary	Records Management Officer	Carried out by e-mail. 20 working day ‘clock’ stops whilst awaiting response
Locating and accessing the relevant information	Colleagues across the institution	Approach depends on how the information is held
Inputting time taken and salary details of colleagues into project spreadsheet	Admin Assistant	Colleagues asked to provide this information to Records Management Officer when providing the information for the request
Reviewing the information and considering the application of exemptions	Records Management Officer	Confirming the information answers the request and considering exemptions. Reviewing Information Commissioner guidance if necessary
Obtaining internal approval for exemptions/disclosure	Records Management Officer and Registrar and Secretary	Final decision on exemptions taken by Registrar and Secretary
If applicable, ensuring time and salary details of Registrar and Secretary are recorded and inputted onto project spreadsheet	Records Management Officer and Registrar and Secretary	Obtained by e-mail during decision making process
Preparing information for release (including redaction of exempt information)	Records Management Officer and Admin Assistant	Use of standard template for responses. Use of Adobe Acrobat Professional for redaction where possible
Sending response	Records Management Officer	Use of standard template for responses.
Recording final details of request outcome on internal Access database	Admin Assistant
Recording final details of request outcome on project spreadsheet	Admin Assistant	Replicates data collected for internal database

 

Outcomes

 

Achievements 

 

 The key achievements of the project were: 

 

• completion of 5 FOI requests in line with FOI Act requirements
• accurate costing of the resources utilised to answer each request
• effective cooperation from colleagues in providing the timing and salary details required by the project
• accurate data on the time spent on each stage of answering the request
• effective collaboration with other project participants to identify requests to be tracked
• completion of Records Management Maturity Model

 

Benefits 

 

The key benefits of the project were:

 

• An improved understanding of the process of handling an FOI request and the time spent on each stage of the process.
• A greater appreciation of the factors which ensure an FOI request  is dealt with as efficiently as possible
• An understanding of the costs of answering requests and the limitations of the data due to the wide variations in the types of FOI requests received

 

Key lessons learned

 

Project Methodology

  

1.  Identification of requests to be tracked

The identification of ‘round robin’ and ‘random’ requests proved to be a particularly challenging aspect of the project. ‘Round robins’ were classed as requests which had been received by at least 4 participating institutions (this was later changed to 3) and which were also being tracked for the purpose of the project. Difficulties arose because requests were often received only by some of the institutions. This led to the potential problem that institutions could each be monitoring different ‘round robins’, thus preventing comparison. To complicate matters further one ‘round robin’ request was received by some participants in December and others in January, whilst the project commenced on 1^st January. The identification of requests therefore required a high degree of coordination between participating institutions. With hindsight some kind of centralised record of requests received by each institution (e.g. a shared spreadsheet) may have facilitated this process.

 

2. Limitations of the sample of requests selected

The method of selecting requests was designed to be random and to include a balance between ‘round robins’ and other requests. However the requests received at the university in early January were relatively straightforward and easy to answer, which meant that the costing data did not accurately reflect the resources which more complex requests tend to absorb.

 

The most difficult requests tend to be those which involve large volumes of information relating to a subject which we know from experience may attract exemptions (e.g. information which could be commercially sensitive to the university or which involves confidential advice or sensitive internal discussions). This makes it necessary to read through a large volume of information in detail and often to consider exemptions on a line by line basis for a large proportion of the documents. These activities cannot be taken into account when applying the Section 12 exemption, which can only be used where the cost of locating, retrieving and extracting the information would exceed 18 hours work (and not for reading the information or considering exemptions). The work involved in redacting information (i.e. removing exemption information from a document) can also be very time consuming. For example, on one recent occasion a university administrator spent several days editing documents in order to remove personal data for an FOI request. This type of activity again cannot be taken into account in applying the Section 12 exemption. In practice our experience is that where documents are readily available and easy to locate, even where there is a large volume of information, the 18 hour limit would not apply.

 

More representative data which captured these very time consuming requests could have been obtained by monitoring a larger sample of requests over a longer period of time, although this would have had implications for the project timescales and the resources needed by institutions to participate in the project.

 

For these reasons the costing data has only limited value in providing a general figure for the total cost of handling FOI requests at the university because the resource requirements vary so greatly depending on the complexity of the request. The requests we received in early January were relatively easier to answer because they related to information easily available to us (e.g. costs of student accommodation over several years, data on applicants to a particular course) or because they clearly fell within the 18 hour limit defined by the Section 12 exemption (e.g. requests for details of students’ declared mental health conditions which are not recorded centrally). A more typical range of requests would also have included some requests which were particularly targeted at the university, usually relating to a very specific subject (e.g. a high profile decision to withdraw courses from one of our campuses), or which involved a very large volume of information (e.g. lists of payments to suppliers over several years, which would need to be redacted to remove any personal data). We typically receive a smaller number of these more difficult requests, but the amount of work involved is far in excess of the time taken to deal with the more straightforward requests we monitored for this project.

 

Lessons for University of Cumbria and the sector

 

Efficient request handling

Participating in the project has helped the university to identify a number of factors which help to minimise the resources used to respond to requests. These factors can be grouped into ‘accidental’ factors (e.g. the type of request), process factors (e.g. how the request is handled) and wider cultural factors (e.g. general attitude towards FOI across the institution).

 

1. ‘Accidental’ factors which improve efficiency: 

• clarity and simplicity of the request
• information already held internally for management purposes (this applied to two of the tracked requests)
• similar request already dealt with recently (this applied to one of the tracked requests)

 

2. Process factors 

• quickly locating the right person to find the information. This depends to a large extent on the knowledge and experience of the member of staff dealing with the request and the network of Records Management contacts the university has in place across the institution.
• good quality and easily retrievable records of previous requests, which makes it easier to respond to requests which are similar to those which have been received in the past. This is achieved by using an Access database to log requests, linked to individual electronic folders in which all pertinent material relating to the handling of requests is stored. 
• good records management within the area holding the information e.g. staff able to quickly identify whether or not information is held. All staff are expected to follow the university’s records management guidance relating to the capture, storage and retention of records.

 

3. Cultural Factors

• Good staff awareness of the FOI Act and the university’s obligations. This saves time when contacting colleagues as they are more likely to understand what is required of them and accord requests appropriate priority. At Cumbria this is continually reinforced via training and briefings at all levels of the institution
• Network of contacts within Records Management Steering Group who can help identify the right person and ensure staff understand their obligations
• Knowledge and experience of FOI Officer – this saves time in knowing which staff to contact, awareness of previous similar requests and awareness of Information Commissioner guidance. This knowledge also means the university is less likely to contact solicitors for advice, thus reducing the resources expended on requests.

 

Other learning points

 

1. Use of Exemptions

In two cases the university applied the cost limit under S.12 of the Act. This relates to requests where the cost of locating, retrieving and extracting the information would exceed 18 hours work in total. In both these cases, our experience was that it is essential not to take staff member’s assertions that information is ‘not held’ at face value. In these cases, the information was not recorded centrally but was actually held by the university within thousands of individual student records held across the institution. Although staff genuinely felt they did not have the information, in reality the information was classed as ‘held’ for the purposes of the FOI Act but did not have to be disclosed because the work involved to locate, retrieve and extract it would easily exceed the 18 hour limit. These were good examples of requests where information is not already recorded for internal purposes and would have to be collated from a range of records in order to answer the request.

 

2. Pro-active Publication

In one case some of the information requested was readily accessible on the website which meant the requestor could simply be directed to the information. Pro-active publication of information saves time in handling requests, but it is not always possible to predict in advance what types of information might be requested.

 

3. Staff Knowledge of Information Held

In two cases, staff were able to confirm very quickly whether or not information was held. In each case, the colleague concerned was the individual who was (or would have been) the author of the information. If those individuals had not been available, their colleagues would have been required to search for the information, thus testing the effectiveness of their records management processes. If records management is poor, the absence of a key member of staff could potentially jeopardise the ability of the university to comply with its legal obligations by accurately confirming whether information is held and being able to retrieve it in a timely manner. This experience highlights the critical importance of effective records management to FOI compliance.

 

4. Records Management Maturity Model

Completion of the Records Management Maturity Model helped the university to assess its ‘high level’ approach to records management. In practice, dealing with FOI requests is also strongly influenced by the local commitment to records management within different areas of the institution. Coincidentally, the 5 requests tracked for the project related to areas with good records management practices and this undoubtedly contributed to the relatively low cost of dealing with these requests.

 

Summary & reflection

 

This is a worthwhile and important piece of research. There has been no attempt to date to establish meaningful costs of information compliance within the Higher Education Sector and this project goes some of the way to doing so. In respect of lessons for both the project and the sector, the University recommends that this research be extended as follows:

 

• An increased sample size taken at two points in the year to try and capture a more complete picture of the type and implications of information compliance for the sector.
• That a partner study be set up to examine the impact of other legislation such as the Data Protection Act. (Subject Access Requests generally involve significant amounts of screening and redaction, and require specialist knowledge of a highly technical piece of legislation).
• That JISC consider a project to examine FoI-workflows to establish whether there any lessons for the sector to minimise regulatory burden.