Nottingham's hospital trust missed its first Freedom of Information deadline in December 2025. The regulator considered sending that failure to the High Court for contempt, decided not to, and gave the trust until 2028 to hit a target it has never reached.
Estimated reading time: 6 minutes
In short. The Information Commissioner served Nottingham University Hospitals NHS Trust a second Enforcement Notice on 18 September 2026 under section 52 of the Freedom of Information Act 2000, for continuing non-compliance with the Act's basic response duties (page 1) [1]. The notice itself records that the trust did not fully comply with the Commissioner's first Enforcement Notice, served 3 July 2025, by its required deadline (page 4) [1]. The Commissioner states he "actively considered" certifying that failure to the High Court, which can treat continued non-compliance as contempt of court, then "ultimately decided not to take that step" (page 8) [1]. The trust's own reported compliance rate for August 2026, the most recent figure in the notice, was 32 per cent (page 7) [1]. Four documented mistakes: three stars.
Nottingham University Hospitals NHS Trust runs Queen's Medical Centre and Nottingham City Hospital, treats more than a million patients a year, and is the largest employer in Nottinghamshire [3]. In July 2025 the Information Commissioner's Office picked it out from a sample of 31 NHS trusts for enforcement action, after proactive sector-wide work on Freedom of Information performance found it responding to just 17 per cent of requests on time, with 536 requests open, 309 of them more than six months old and 196 more than a year old (page 4) [1] [2]. That first Enforcement Notice, reference ENF0988366, dated 3 July 2025, is referred to throughout the new notice simply as "the 2025 Notice" [4].
What the 2025 notice actually achieved
By June 2026 the trust had closed every request the 2025 Notice specifically covered (page 4) [1]. That took recruiting a largely new information rights team, a digital case management system, an action plan and extra senior oversight (page 7) [1], plus, on the way, missing the 2025 Notice's own deadline. The new notice records plainly that "it did not fully comply with the 2025 Notice by the required deadline" (page 4) [1], a deadline its own Annex 3 timeline gives as 31 December 2025 (page 12) [1], and that compliance was reached "only after further monitoring, meetings and repeated intervention at Chief Executive level" (page 6) [1]. A legal Enforcement Notice, the Commissioner's formal escalation tool, was itself missed on schedule, with no separate consequence recorded for that.
The threat that was made, then not used
Section 54 of the Act lets the Commissioner certify a public authority's non-compliance with an Enforcement Notice to the High Court, which can then treat the matter "as if it had committed a contempt of court" (page 2) [1]. The new notice names this power twice as the reason the trust's non-compliance should be taken seriously (pages 2, 6) [1], then states, of the actual missed 2025 deadline: "the Commissioner attaches significant weight to the fact that, during 2026, he actively considered whether the trust's failure to comply with the 2025 Notice should be certified to the High Court", before concluding "he ultimately decided not to take that step because of the progress subsequently made" (page 8) [1]. The one sanction the Act gives the Commissioner for a missed Enforcement Notice was weighed against this trust specifically, and then set aside. What followed instead was a second notice with no fine and no named individual held accountable.
Deadlines that match the trust's own forecast
Asked what it expected next, the trust itself told the Commissioner it "considered that its compliance figures were unlikely to be significantly healthier until approximately April 2027" (page 5) [1]. The new notice's first deadline, for clearing every request older than the 20-working-day statutory limit, is 1 April 2027 (page 10) [1], the same month the trust had already named as its own best estimate. The notice's toughest requirement, a sustained 90 per cent on-time rate across three separate months, is not due to be finally proven until 1 June 2028 (page 10) [1], nearly three years after the original 2025 Notice and close to two years after this one. Nothing in the notice explains why these dates, rather than earlier ones, represent the Commissioner's independent judgement of what is achievable, as opposed to a restatement of the timetable the trust had already given him.
A number that moved by 33 inside one month
The notice's performance data comes entirely from the trust's own self-reporting (Annexes 2 and 3) [1]. At a meeting on 24 August 2026, the trust reported provisional month-to-date compliance of 31 per cent and "33 requests that were more than six months old." Its final reported figures for the same month then recorded 32 per cent compliance, 65 overdue requests, and "one overdue request more than six months old" (page 5) [1]. Annex 2's own table confirms the final figure: one request over six months old in August 2026, against 33 reported at the meeting a week earlier (page 11) [1]. The notice records both numbers without reconciling them, on the same self-reported data its entire monitoring regime, and now its 2027 and 2028 deadlines, depend on.
The claims, tested
| The notice's own words | What the record shows | Verdict |
|---|---|---|
| Section 54 certification to the High Court demonstrates "the seriousness with which the continuing non-compliance was regarded" (page 6) [1] | The Commissioner "actively considered" certifying this trust's own missed 2025 deadline, then "decided not to take that step" (page 8) [1] | The one real sanction in the Act was loaded and not fired |
| The new deadlines are the Commissioner's "necessary and proportionate" regulatory response (page 8) [1] | The first deadline, April 2027, matches the trust's own forecast of when it expected to improve (page 5) [1] | Enforcement timed to the subject's own estimate, not shown to be independently driven |
| The trust's performance is tracked through Annexes 2 and 3's reported figures (page 5) [1] | The trust's own "over six months old" figure for August 2026 fell from 33 to 1 within the same month, unexplained (pages 5, 11) [1] | The monitoring data the whole notice rests on contains an unreconciled swing |
| Missing the 2025 Notice's deadline was treated as serious, with "express warnings" about section 54 (page 6) [1] | The only named consequence was a second Enforcement Notice, no fine, no named individual held to account, timetable extended to June 2028 (page 10) [1] | A missed legal deadline produced a longer deadline, not a sanction |
Credit where due
The Commissioner "acknowledges the trust's positive engagement, the work undertaken by its information rights staff and its eventual completion of the case-specific requirements of the 2025 Notice" (page 5) [1]. The trust recruited a largely new team, built a digital case-tracking system, ran a full-day workshop with its care groups to diagnose where requests were stalling, and brought in temporary support from NHS England (page 7) [1]. It also told the Commissioner directly that staff absences over the summer had affected its figures, rather than disputing the shortfall (page 5) [1]. None of that is in dispute here.
Verdict
Three stars, from four documented mistakes. The trust's underlying problem, closing requests inside a 20-working-day statutory limit, has not gone away since the Commissioner's own July 2025 sector review named this trust specifically for a 17 per cent compliance rate. What the new notice does not show is that a second Enforcement Notice, with its one real enforcement lever considered and dropped and its headline deadlines tracking the trust's own forecast, does more than restate the first one with a longer clock.
The star score counts four documented mistakes: the Commissioner's own account of "actively" considering High Court certification over the missed 2025 deadline, then deciding not to use it; a first new compliance deadline (April 2027) that matches the trust's own self-reported pessimistic forecast rather than demonstrating independent regulatory pressure; an unreconciled swing in the trust's own reported "over six months old" backlog figure, from 33 to 1, inside the same reporting month; and a missed legal deadline that produced no fine or named accountability, only a second notice whose toughest target is not due until June 2028. Four falls in the 4 to 9 band: three stars; the bands are on the ratings page. This piece makes no finding against the accuracy of the compliance figures or statutory framework the notice sets out, which are detailed and procedurally sound; the finding is narrower, that the notice's own evidence does not show its chosen deadlines or its decision not to escalate reflect more than the trust's own stated timetable. Checked directly against the 12-page Enforcement Notice PDF (full text), the 2025 Notice PDF and the ICO's own July 2025 sector blog, all fetched 4 October 2026.
Sources
- Enforcement Notice: Nottingham University Hospitals NHS Trust (PDF), reference ENF0988403, Information Commissioner's Office, dated 18 September 2026
- Successes and setbacks: ICO reports on FOI compliance across NHS trusts in England, Information Commissioner's Office, 24 July 2025
- About us, Nottingham University Hospitals NHS Trust
- Enforcement Notice: Nottingham University Hospitals NHS Trust (PDF), reference ENF0988366, the 2025 Notice, Information Commissioner's Office, dated 3 July 2025