A law student's guide to Freedom of Information requestsWatch
People who want to find out more information about:
a) the profile of students who already study law
b) the admissions process for law
c) the initiatives used by law faculties to promote e.g. social mobility
Part I: The Basics
What’s the Freedom of Information Act 2000?
From the Information Commissioner’s Office website:
“The Freedom of Information Act 2000 (‘FOIA 2000’) provides public access to information held by public authorities. It does this in two ways: public authorities are obliged to publish certain information about their activities, and members of the public are entitled to request information from public authorities. The Act covers any recorded information that is held by a public authority in England, Wales and Northern Ireland...”
How is this useful to me?
UK universities are public authorities for the purpose of the Act. ‘Recorded information’ is defined broadly and includes “printed documents, computer files, letters, emails, photographs, and sound or video recordings.” This means that you can request any recorded information about the course you’re interested in.
Ok, so how do I start?
I would recommend one of the following two methods to request information:
1. Send a (public) request through whatdotheyknow.com.
2. Send a (private) request using your personal email.
How should I pick between the two?
Drawbacks of whatdotheyknow.com: your name and email address will be visible (may result in you having to create a new email account and use a pseudonym)
Benefits of direct email: privacy, you get to ask more targeted/specific questions that suit your circumstances
Drawbacks of direct email: no one else sees the response unless you go through the pain of sharing the response indi
vidually, you need to find each university’s FOI request email
How do I send a request through whatdotheyknow.com?
- Go to https://www.whatdotheyknow.com/.
- Click on ‘Sign in or sign up’ on the top right.
- Insert your name (see below on fake names and emails), email, and password in the relevant text boxes on the left. Click ‘Sign up’. Make sure that you’ve got these saved somewhere.
- Regarding made-up names: you’re always free to use a pseudonym on either whatdotheyknow.com, but make sure to keep that (and your email) realistic-sounding. Adopting or modifying with the names of famous dictators, actors, musicians, etc. is not a good idea. If they suspect you to be using a pseudonym, they’ll ask you for a copy of your ID under s.8 FOIA. This pretty much marks the end of your request.
- Check your email for the confirmation email. Click on the link. It should direct you back to the website.
- Log in using the credentials you entered.
- Click on the ‘Make a request’ on the top left.
- Search for the university you wish to request information from.
- Click on ‘Make a Request’ button next to the name of the authority.
- Fill out the rest with the data you wish to request. You are able to preview this data before you send it off.
How do I send a direct request via email?
- Find the FOI address of the relevant institution(s). Google ‘FOI request email at <insert uni>’. It will always be listed somewhere on the university’s website.
- Open your email.
- Copy paste the address into the recipients field. If you’re planning on sending the same request to multiple universities, don’t forget to paste all of the emails in the Blind Carbon Copy (BCC) field, not the regular one!
- Start and finish the message as you would any other formal email (‘Dear Sir/Madam’ at the start, ‘Yours Sincerely’ or ‘Best Regards’ at the end). Don’t forget to set out your full name (first name + surname).
- Send it off!
What happens after I send the request?
Within a day or two, someone from the university will reply with a confirmation that they have received your request.
They will have 20 working days (i.e. up to a month in practice) to get back to you.
How do I view the university’s response?
Direct email: Check your inbox - each university’s reply will come back as a new thread, even if it was sent to multiple addresses one email. Also check your spam/junk folder just in case.
Part II: The content of the request
Do you have any suggestions as to what I should ask about?
For law courses, you might want to request data on any of the following:
- GCSE grades (or equivalent);
- AS grades;
- A-level grades (predicted or achieved);
- Other high school qualifications (SAT, the IB, the European Baccalaureate, etc);
- LNAT multiple choice scores or essay scores;
- Contextual offers;
- Sixth form or undergraduate diversity schemes;
- Grades achieved by current law students;
- Typical grades awarded to current law students in modules that are part of the undergraduate degree;
- The domicile/diversity/other background characteristics of the university’s current law students;
- Degree classifications in any or all of the years of the degree;
- The number of students who take advantage of ‘bonus years’, such as years abroad, years in industry, or joint degrees with foreign institutions;
- The availability and number of scholarships, prizes and awards for undergraduates.
You are not allowed to ask for data about yourself (such as your LNAT or CLT essay score, or your Oxbridge interview score, or your personal statement feedback).
How can I request data about myself?
You need to submit a subject access request. These are a completely different beast and fall outside the scope of this guide. You can find two excellent introductions here:
How should I structure my request?
- Start of with ‘Dear Sir/Madam’.
- Specify the courses you are asking about (including the UCAS course code - it takes the form of M1xx). If you’re asking about a single-honours law course (the LLB or the BA in Jurisprudence at Oxbridge), your course code will likely be M100.
- Specify the years or admissions cycles you are asking about (e.g. ‘students who enrolled in 2019’ or ‘applicants for the 2018/19 admissions cycle’).
- Ask the questions in numbered form (1, 2, 3, etc). Make sure that each question is clear distinct from the next. Don’t waffle.
- Say something like ‘Thank you for your attention’ or ‘Thank you for your time’.
- Finish with ‘Best Regards’ or ‘Yours Sincerely’, and the full name or pseudonym.
Do you have any examples of successful requests?
Part III: Refusal and how to deal with it
Grounds for refusal
- s.21 - information reasonably accessible to the applicant by other means
- s.22 - information intended for future publication and research information
- s.40(2) - personal information of third parties [usually students]
- s.43 - prejudice to [the university’s] commercial interests
- s.44(1)(a) - release of data is prohibited by law [often used as the ground for the refusal of releases that would otherwise - allegedly - violate competition law]
If my request has been refused, what do I do?
If you do, identify the section under which the refusal is issued. This will be stated somewhere in the university’s refusal notice/letter.
Click on the link that corresponds to the reason for the refusal. Each takes you to the Information Commissioner’s Office guidelines for public authorities. These contain the wording of the relevant section of the Act, as well as suggestions as to how the authority (the university in our case) should or shouldn’t be acting. Skim through the one that is relevant to you:
- s.21 - https://ico.org.uk/media/for-organis...eans-sec21.pdf
- s.22 - https://ico.org.uk/media/for-organis...nd-22a-foi.pdf
- s.40(2) - https://ico.org.uk/media/for-organis...ulation-13.pdf
- s.43 - https://ico.org.uk/media/for-organis...a-guidance.pdf
- s.44(1)(a) - https://ico.org.uk/media/for-organis...disclosure.pdf
My data’s been refused on the basis that its release would breach competition law - what do I do?
A refusal may look something like this:
“Section 44 (1)(a) of the Freedom of Information Act 2000 permits the University to withhold information if its disclosure would be prohibited by law.
Due to competition law, under the Competition Act 1998, the University must exercise caution in releasing any information of a strategic nature such that it may constitute an exchange that would infringe competition law by placing it in the public domain where it could potentially be access by other Higher Education Institutions. Competition law is seen to be infringed if parties do not actually agree on an anticompetitive act but exchange information that would lead competitors to understand how and what benchmarks have been set. This would include the release of strategic, or strategically useful, information.
It is therefore necessary to withhold such information that is not already in the public domain and would include specific information about the University’s clearing operations. Such information has therefore been withheld because the University believes that its release would breach the Competition Act 1998. By disclosing the information it would be placed in the public domain where it would be readily accessible to other institutions in the Higher Education sector; thus it could adversely affect the free competition between institutions.
This is an absolute exemption and the University is not required to consider the public interest in the release of this data.”
What should I write in response to a refusal on the basis of competition law?
Copy any of the arguments used in the internal review of this decision, here: https://www.whatdotheyknow.com/reque...utgoing-934139.
Take a look through a recent summary of Chapter I of the Competition Act 1998 (e.g. https://www.slaughterandmay.com/medi...tion-rules.pdf, page 10 onwards).
Compare what you’re requesting to the things that are prohibited by that Act. This is where you need to start thinking like a lawyer. Should the thing you're requesting be released?
Nitpick the response you’re given by the university. Can rival institutions already access data that is similar to that which you are requesting? Can rival institutions even use the data you’re requesting to their commercial advantage? Is the data you’re requesting only useful if paired with other data that is not in the public domain?
After you’ve done that, you should start drafting a new request for internal review. Guidance for this has been provided below.
How should I draft my own internal review request?
- Start off with ‘Dear Sir/Madam’.
- Mention the reference number of the original request if you were given one.
- Mention the date you submitted the original request, its title, and the date you got the refusal notice (i.e. response) from the university.
- Quote the reason given by the university for the rejection. Quote it in full.
- State which part of the reason you wish to be reviewed (e.g. “I do not believe that the data I requested will prejudice the university’s commercial interests”, or “I do not believe that the data I required can be used, in conjunction with other publicly available data, to identify the individuals involved”). This only needs to take one sentence.
- Give the reasons why you believe this in bullet points (for clarity). A lot of the observations you will make will be common sense!
- Finish with a single sentence of waffle (“I look forward to hearing the outcome of the internal review” or “Thank you for taking the time to review”).
- Write ‘Best Regards’ and your name and surname.
Sounds tough! Do you have any examples of successful and/or unsuccessful internal review requests?
Successful requests for internal review:
- Liverpool John Moores - https://www.whatdotheyknow.com/reque...ring_2018_2050
- Northumbria - https://www.whatdotheyknow.com/reque...utgoing-930111
- Dundee - https://www.whatdotheyknow.com/reque...coming-1433842
Unsuccessful requests for internal review:
Part IV: Tips and tricks
Most universities use the full 20 working days to get back to you. Few-to-none will get back to you immediately.
Many universities seem to alert requesters that they don’t have the data/that their application has been refused on the very final day. This is possibly because it takes these universities a lot of time to consider whether to refuse the request, and possibly because they hope that you’ll have forgotten about the request and that you therefore won’t challenge their refusal.
You need to check the status of your requests (either by checking ‘My Requests’ on whatdotheyknow.com or by checking your email’s inbox) every couple of days. This is for three reasons:
- I’ve never had universities all get back to me on the same day - it’s more common for me to get perhaps three or four answers at various points in the week, every week.
- It’s also not uncommon for a university to say that you’ve requested too much data and that you need to narrow down your request (see above), or for it to ask for clarification on a part of your request.
- If you have gone over the £450 limit, the university is instructed - in the ICO’s guidance - to “give [you] reasonable advice and assistance to refine [your] request.” This should involve “explaining why the limit would be exceeded and what information, if any, may be available within the limits.” The point is that you still have a chance to save your request if you reply in time!
Always check the information you’re given before thanking the university or marking the request as ‘successful’ on whatdotheyknow.com. I’ve had a lot of incomplete or ludicrous responses to my requests (including one university’s claim that 90% of its law cohort got a First, and another’s claim that the average LLB undergraduate had 4.5A*s).
Universities can’t see the whatdotheyknow.com status of your request (successful, partially successful, refused, etc.). If a university has provided you with the data you were looking for, it’s good practice (and good manners!) to write a reply to confirm that you’ve received the data and thank them.
Remember that the FOIA refers to ‘recorded data’ only. The ‘recorded’ bit is actually important, because some universities don’t appear to save/file some information. For example, LSE doesn’t have information on how it used the LNAT in the 2018/19 admissions cycle, and many universities don’t record the GCSEs held by applicants and offer holders.
Keep in mind that some requests can really drag on. The longest I’ve seen was:
- 5 working days (i.e. one week) for the university to acknowledge receipt of my request.
- 20 working days (i.e. four full weeks) for the university to get in touch, saying that it wanted me to clarify certain aspects of my application.
- 5 working days (by which time it had gone over the statutory limit) for the university to get back to me, saying that the data I had requested had ‘changed’ and that the information I requested was being treated as a new request.
- 15 working days for the information on the new/second request to be released in part.
- 3 days (a weekend) for me to check the data, find out that some of it was missing, and write up and send a request for internal review.
- 20 working days for the university to reply to my request for internal review, releasing some of the data it had not originally provided. The rest of the data was refused for a second time.
- The above took up an entire summer from start to finish.
Some universities get lots of FOI requests over the summer, often from journalists or from students who will be applying in the autumn. This is combined with the absence of some data officers (who are off on holiday). The result? Large delays and some applications ‘falling through the cracks’.
Part V: Useful links and further reading
Guardian: Background to the FOIA 2000
ICO: “When can [universities] refuse a request for information?”
Text of the FOIA 2000
More law resources on TSR
Thank you for taking the time to write this
(I'm thinking about the OP in another thread who was finding SOAS very reticent on this issue).
First Noto, now Johan.
Hahaha, my same reaction.
The law forum and TSR will never be the same. :'(
Be a shame if he and N are gone for good, especially for the law section (even with their abrasiveness and disdain for fools)