Internal review is where good requests go to die
You filed a Freedom of Information request. You worded it narrowly, you named the department, you asked for dated records rather than commentary. Weeks pass. Then a letter arrives: refused under an exemption, or delayed past the statutory deadline, or answered with two nearly blank pages and a reference number. The records exist. The law says you can have them. So why do agencies win most rounds without ever litigating?
Because the refusal letter is not the end of the process. It is the start of a second one, and the second process is where requesters who do not know the machinery lose. What follows is the working playbook compiled from ombudsman case files, information commissioner decisions and the published appeal outcomes: the four stages after a refusal, the deadlines that actually bind, and the specific wording that moves a stalled file.
Stage one: the internal review you should never skip
Every jurisdiction with a functioning FOI regime requires the agency itself to reconsider a refusal before any outside body will look at it. This feels like asking the referee who just ruled against you to think again. It is. It is also free, and refusing to use it is the single most common self-inflicted wound in the case files.
Two things make internal review worth the stamp. First, a review is conducted by an officer senior to the original decision maker, and senior officers occasionally conclude that the exemption was stretched. Commissioners report that a meaningful minority of refusals are reversed or narrowed at this stage, usually where the original decision applied a blanket exemption to a bundle of documents that contained an obvious mix of exempt and releasable material. Second, and more important: the review response puts the agency’s reasons on the record in a form the commissioner can later test. A refusal letter with no reasons cannot be appealed anywhere. A review decision with bad reasons can.
Ask for the review in writing within the statutory window. In the United Kingdom the Information Commissioner expects it promptly and in any event within 40 working days. In Ireland the internal review fee is 30 euro and must be requested within four weeks. In Australia the request must reach the agency within 30 days. Miss the window and the file closes regardless of merit.
One drafting rule governs the whole letter: do not argue. List. State that you seek review of the decision, identify the exemption cited, and ask the reviewing officer to address three specific questions: which documents were located, which were assessed as exempt, and what harm the agency specifically anticipates from disclosure. Agencies lose reviews not because requesters shout but because the reviewing officer cannot answer those three questions on the paper in front of them.
Stage two: reading the refusal the way a commissioner reads it
While the review is pending, take the refusal letter apart. Commissioners decide on the reasoning, not the outcome, and most refusal letters contain at least one of four defects.
The unlocated record. The letter says no records were found. Did the agency search the relevant business units, or one mailbox? A search of a single custodian for a policy file that circulated across three directorates is a defective search, and commissioners say so in published decisions. Ask, in writing, which custodians and which systems were searched.
The bundled exemption. A single exemption applied to a whole bundle, with no document-by-document reasoning, is precisely what the public interest test exists to prevent. Class exemptions are rare; most exemptions require the agency to show harm case by case.
The time extension that never ends. Deemed refusal, where the deadline passes without a decision, is itself a reviewable event. It converts silence into a decision you can appeal immediately.
The redaction without a reason. Blacked-out lines with no exemption named against each redaction are vulnerable. Ask for a redaction schedule: a table mapping every redaction to the exemption clause relied on. Agencies that cannot produce one tend to release rather than defend it.
Stage three: the commissioner complaint that gets read
If the review upholds the refusal, the next rung is the oversight body: the Information Commissioner in the UK, the Information Commissioner in Ireland, the OAIC in Australia, the FOIC in most Canadian provinces. The complaint is free or near-free everywhere. What separates complaints that get case officers from complaints that sit in a queue is the same three-part skeleton every time: the request, the refusal, the specific defect.
Attach the original request, the refusal, and your review letter. State the defect in one sentence. Do not send a chronology of your feelings about the agency. Case officers triage hundreds of files; the complaint that names a defective search or a bundled exemption gets escalated, and the complaint that reads as a grievance gets a form letter.
Timeline reality: commissioner investigations routinely take 6 to 18 months from complaint to decision. That is not a reason to skip the stage, because a commissioner decision notice is a legal instrument. An agency that ignores it can be pushed into the tribunal on a paper application, and at the tribunal the burden of justifying the exemption sits squarely on the agency, not on you.
Stage four: the tribunal, and the settlement nobody announces
Tribunals are where agency solicitors do their honest arithmetic. Defending a defective search before a tribunal member who reads the case law is expensive, and losing sets a precedent the agency will cite against itself for years. The published pattern is consistent: a substantial share of appeals resolve before hearing, with the agency releasing some or all of the material on confidential terms. The requester gets the documents; nobody gets a headline.
Costs are the gate. In the UK, First-tier Tribunal appeals are generally low-cost to file, and each side normally bears its own costs. That asymmetry, an agency facing real legal spend against a requester paying a filing fee, is the quiet engine behind most pre-hearing releases.
The four deadlines that actually bind
Everything above compresses into a card you can keep. Statutory response time for the original request: 20 working days in the UK and Ireland, 30 calendar days in Australia and most of Canada. Internal review window: 40 working days UK, 4 weeks Ireland, 30 days Australia. Commissioner complaint window after an upheld review: 6 months UK, 6 months Ireland, 60 days Australia. Tribunal appeal after an adverse commissioner decision: 28 days UK. Every one of these is jurisdictional. The agency can be late; you cannot.
The records exist. The law entitles you to them. The machinery is slow, but every stage is scripted, and the script is written down. Requesters who work the script get paper. Requesters who argue get form letters.
