Section 31: When “Law Enforcement” Isn’t an Explanation

There is something uncomfortable about having to ask a specialist Freedom of Information team what its own exemption actually means.

Not whether it is entitled to use an exemption. Police forces plainly can withhold information where disclosure would genuinely prejudice law enforcement.

The problem is more basic.

If a force tells a requester that Section 31 — Law Enforcement is engaged, the requester should be able to understand which part of Section 31, which information is affected, and what harm disclosure is said to create.

Across this project, that very often did not happen.

That is the finding this post is about.

It is not a finding that Section 31 was wrongly invoked in every case.

It is a finding about the quality of the explanation supplied by specialist information-rights teams when they invoked it.

Why this matters

Section 31 is not a magic label that turns policing information opaque.

The Information Commissioner's Office describes it as a prejudice-based exemption. The authority has to connect disclosure to a protected law-enforcement interest and identify a real, substantive risk of harm.

The ICO's current guidance asks three basic questions:

• Which law-enforcement interest protected by Section 31 could be harmed?
• Is the claimed harm real, actual or of substance, and is there a causal link between disclosure and that harm?
• How likely is that harm to occur?

Its wider Section 31 guidance also says authorities should be clear about which subsection they are relying upon and why it applies.

ICO: applying the Section 31 prejudice test
ICO: Section 31 — Law enforcement

None of that requires disclosure of operational secrets.

It simply requires the authority to explain the legal basis it has already chosen to rely upon.

What we actually asked for

The national request was about the safeguards around police facial recognition: deletion and retention records, audits, non-retrievability, data incidents, RFR/OIFR governance and supplier arrangements.

It expressly excluded passwords, IP addresses, encryption keys, security credentials, exploitable vulnerabilities, covert policing tactics, detailed network architecture and operational intelligence about individuals.

Where genuinely sensitive material existed inside a wider document, the request expressly accepted appropriate redaction.

So when Section 31 began appearing repeatedly, the follow-up was deliberately narrow:

Which subsection? Which part of my request? What prejudice does disclosure cause?

We were not asking forces to complete their public-interest tests early.

We were asking them to define the exemption they had already invoked.

What the original notices actually contained

The table below records the first Section 31 notice in each of the 29 cases reviewed for this exercise.

✓ means the element was supplied in the original notice. × means it was absent or insufficiently identified. The final column records whether we had to seek clarification.

* Nottinghamshire's initial notice identified Sections 31(1)(a) and/or (b), but still did not identify the affected parts of the request or explain the prejudice sufficiently for the scope to be understood.

29 out of 29 required clarification

That is the statistic I keep coming back to.

These were not casual replies from officers answering an email between other jobs. They were responses from specialist FOI, disclosure, legal or information-rights functions.

Yet in every case, something fundamental was missing.

In most notices, virtually everything was missing beyond the words “Section 31 — Law Enforcement.”

Only West Yorkshire's initial notice came close to explaining the substantive prejudice. Even there, it did not identify which numbered parts of the request were affected, so clarification was still necessary.

The result was that the requester repeatedly had to send the same elementary follow-up to professional information-rights teams.

That should not be necessary.

And then something revealing happened

When we asked those short clarification questions, many forces were able to provide the missing detail.

Several identified Section 31(1)(a) and (b).

Several then said the concern related specifically to Q5(a), Q5(b) and Q6.

Several identified the claimed prejudice as “prejudice to tactical capability.”

And fifteen forces ultimately supplied the same full formulation: disclosure would make the facial-recognition tool less effective in preventing and detecting crime and apprehending offenders.

That later explanation may or may not ultimately justify withholding particular information. The public-interest tests are still pending in many cases.

But it demonstrates something much simpler:

The missing explanation could be given.

Once asked, it often arrived quickly.

That raises a fair question about why it was not included in the original notices.

The timing problem

There is a second procedural issue.

Several forces used Section 31 notices to extend the response period while they completed the public-interest test.

That can be legitimate. Section 10(3) FOIA allows extra time where a qualified exemption is engaged and more time is genuinely needed to decide where the public interest lies.

But the ICO guidance is equally clear about the boundary:

The additional time is for considering the public-interest balance. It cannot be used to decide whether the exemption itself is engaged.

Authorities should therefore already have identified the relevant exemption and satisfied themselves that it applies within the initial 20-working-day period.

ICO: time limits and Section 10(3)

That makes notices saying, in effect, “we need more time to consider whether Section 31 may apply” particularly difficult to square with the stated purpose of the extension.

Again, that does not automatically determine the legality of every extension.

But it is another reason the wording of these notices matters.

What this does — and does not — show

The evidence does not establish that 29 forces deliberately misused Section 31.

It does not establish that information is being concealed unlawfully.

It does not establish that the repeated wording was centrally dictated.

And it certainly does not mean that genuinely operational facial-recognition information can never properly be withheld.

We already have ICO authority showing that some genuinely operational LFR material can engage Section 31 while other material does not.

The narrower finding is strong enough:

In this dataset, specialist police information-rights teams repeatedly invoked a prejudice-based law-enforcement exemption without giving the requester enough information to understand the claimed prejudice without further correspondence.

That is a transparency problem in its own right.

A different problem: Cleveland's “No information held”

Not every problematic response involved Section 31.

On 7 October, after its response had already passed the statutory deadline, Cleveland Police finally answered our six-part request.

Every question received the same response:

“No information Held.”

Initially, that looked straightforward. If a force does not use a particular facial-recognition technology, there may genuinely be little or nothing to disclose.

Then we checked Cleveland Police's own published FOI disclosures.

In FOI 437/25, Cleveland was asked whether it had used retrospective facial recognition. Its published answer was:

“Yes – PND.”

In FOI 616/25, Cleveland went further, stating that Retrospective Facial Recognition is utilised through a function within the Police National Database.

And FOI 116/25 provides actual monthly figures for PND facial-recognition searches during 2024. Cleveland recorded searches in July, August, September, October, November and December — precisely within the period covered by our request, which began on 1 July 2024.

Our Question 5 expressly asked whether Cleveland Police had used Retrospective Facial Recognition (RFR) or Operator Initiated Facial Recognition (OIFR) during that period.

The published record and the response we received cannot presently be reconciled.

That matters.

“Information not held” is a perfectly legitimate FOI answer when it is accurate. But a requester should be able to rely on an authority having carried out sufficient searches before giving that answer — particularly where the authority's own website already contains information directly relevant to the question.

We have therefore requested an internal review and asked Cleveland Police to explain how its blanket response was reached, reconsider its searches, and reconcile it with its earlier published disclosures.

We are not speculating about why the incorrect response was given.

We do not need to.

The documentary contradiction is enough.

An answer should withstand scrutiny

This project began by asking a fairly simple question: if facial-recognition safeguards are important enough to justify public confidence, where is the evidence showing that those safeguards operated as described?

What we are also learning is that scrutiny depends on something even more basic: the public authority's response must accurately reflect the information it already holds.

Whether the obstacle is an unexplained exemption, an incomplete search, or a response contradicted by the authority's own published records, the principle is the same.

An exemption should be explained, not merely named.

An answer should withstand scrutiny.

Trust requires evidence.

SEEN. NOT PROCESSED.

The right to be seen, but not processed.