What does "neither confirm nor deny" mean?

What it is

The duty to confirm or deny is separate from the duty to communicate information. Many FOIA exemptions exclude the duty to confirm or deny where giving that answer would itself cause the harm the exemption protects against. It must be used consistently, including where no information is held, or the pattern of responses gives the answer away.

When it can be used

• An exemption excludes the duty to confirm or deny, and confirming or denying would itself engage it. FOIA s.1(1)(a); s.2(1)
• For qualified exemptions, the public interest in maintaining the exclusion of the duty outweighs the public interest in confirming or denying. FOIA s.2(1)(b)
• Under the EIR, an authority can neither confirm nor deny only where confirming would harm international relations, defence, national security or public safety. EIR reg 12(6)

Who is responsible

The authority, which must still issue a refusal notice explaining the exemption relied on.

What it involves

1. Decide whether confirming or denying would itself reveal exempt information.
2. Apply the public interest test for qualified exemptions.
3. Use NCND consistently whether or not information is held.
4. Issue a refusal notice.

If it goes wrong

Regulatory

The requester can complain to the regulator, which issues a decision notice requiring the authority to act. Either side can appeal to the First-tier Tribunal (General Regulatory Chamber), then on a point of law to the Upper Tribunal. Failing to comply with a notice can be certified to the High Court and dealt with as contempt.

Criminal

No offence.

Civil

No right to compensation. Enforcement runs through the regulator and the tribunal.