ICO Updates FOI Public Interest Test Guidance Following Supreme Court Ruling on Cumulative Exemption

Key Takeaways

• The Information Commissioner's Office has revised its Freedom of Information Act guidance on the public interest test to reflect the Supreme Court's ruling in DBT v ICO [2025] UKSC 27, which permits public interest factors supporting multiple qualified exemptions to be weighed cumulatively against disclosure.
• The update also sets out expectations for refusal notices and for handling ICO complaints.
• Compliance teams at organizations subject to FOIA, or that supply information to public authorities, should review their withholding procedures and templates.

Deep Dive

The Information Commissioner's Office has revised its Freedom of Information Act guidance on the public interest test to reflect the Supreme Court's ruling in DBT v ICO [2025] UKSC 27, which permits public interest factors supporting multiple qualified exemptions to be weighed cumulatively against disclosure. The update also sets out expectations for refusal notices and for handling ICO complaints. Compliance teams at organizations subject to FOIA, or that supply information to public authorities, should review their withholding procedures and templates.

The update also clarifies two procedural matters. First, it states what the ICO expects public authorities to tell applicants in a refusal notice when the public interest test results in withholding. Second, it describes what authorities must provide if the ICO receives a complaint about the decision. Authorities should expect closer scrutiny of the quality and transparency of their public interest reasoning, including how cumulative factors were identified and weighed. The ICO has also published a summary guide to the test for those new to FOIA or short on time, which is useful for staff training.

No implementation deadline or transition period is stated. The guidance is available now, and the ICO will presumably apply it to current and future complaints. Organizations should therefore treat it as immediately relevant. Note that the Supreme Court judgment was issued in 2025, so authorities that have already applied its principles should check their practices against the ICO's formal interpretation.

Recommended actions for compliance professionals:
- Review internal FOI and information-request procedures, including refusal notice templates, against the revised guidance.
- Update decision-making frameworks to document cumulative public interest analysis where multiple exemptions apply.
- Brief and train FOI handlers using the summary guide.
- Where the firm supplies sensitive information to public authorities, review how it is marked and justified, and prepare to provide clear exemption rationale if consulted.
- Maintain audit trails to support responses to ICO complaint inquiries.

Risk implications are moderate. Authorities with inadequate refusal notices or thin reasoning face complaint escalation, adverse ICO decisions, and reputational harm. For firms outside FOIA scope, the main exposure is the potential disclosure of their information held by public bodies, which the cumulative approach may modestly reduce. Overall, the update refines existing obligations rather than creating new ones, but it warrants prompt procedural alignment.

Source: Information Commissioner's Office