Subject: Re: ICO Case Reference: IC-546505-W6P0
From: Sion Buckler
Direction: sent
Date: Wed, 21 Oct 2026 15:50 UTC
Institution: Information Commissioner's Office
Refs: 1188/26, FOI 1040/26, FOI 719/26, IC-546505-W6P0
Archive id: gm-1a15f285df2fb1de
------------------------------------------------------------

Dear Ms Cuthbert,

ICO Case Reference: IC-546505-W6P0

Thank you for your letter of 10 August 2026, and I am sorry for the delay in replying. I understand the limits of the Commissioner's remit that you set out: the ICO does not decide maladministration, does not refer matters to other bodies, and does not decide what an authority should hold.

As you suggested, complaints will come to you one request at a time, on the FOI complaint form, with the request, the response, the internal review request and the review outcome. Internal reviews are now in progress, for example:
- South Wales Police: internal review 1188/26 of FOI 719/26 (outcome due 26 October 2026), and an internal review of FOI 1040/26 requested today;
- Welsh Government: an internal review of ATISN 26-0010 requested on 19 October 2026. ATISN 27589 was refused on 19 October 2026 under section 14(2), with no internal review procedure given.

So that those complaints are framed correctly, I would be grateful for answers to four points that do fall within the Commissioner's functions:

1. Records management (section 46 Code and section 48 FOIA). Welsh Government has said (ATISN 27021 and its internal reviews of July 2026) that the 1988 listing file for the farm was "most likely" destroyed, that no destruction record could be found, and that it could not say what retention arrangements applied at the time. Will the Commissioner consider a concern about an authority's conformity with the section 46 Code of Practice on records management, separately from a section 50 complaint? If so, what form should it take and what evidence do you need?

2. Records within scope of open requests. Your letter says preservation for a legal matter is outside the ICO's remit. Please confirm that where information within the scope of a live request is altered, defaced, erased, destroyed or concealed to prevent disclosure, that falls under section 77 FOIA, regulation 19 EIR or, for personal data, section 173 DPA 2018, and that the ICO is the body to report it to. How should such a concern be reported?

3. Late responses. Where an authority answers after the 20 working-day limit (for example, South Wales Police answered FOI 1040/26 seven working days late), can the section 10 breach be included in the section 50 complaint about that request, or should it be reported separately?

4. Case status. Please confirm that IC-546505-W6P0 is closed, so that new complaints about specific requests are not treated as duplicates of it.

I would be grateful for a reply by 18 November 2026.

Yours sincerely,

Sion's Tab agent
AI agent acting on behalf of Sion Buckler
[email redacted]