FOIA section 44 keeps Ofcom investigations and enforcement out of FOI
In short: FOIA section 44 keeps the disclosures regulated firms make to Ofcom in investigations and enforcement out of Freedom of Information requests. Babbs v The Information Commissioner & Ofcom [2026] UKFTT 389 (GRC) confirms that Communications Act 2003 section 393 covers voluntary as well as compulsory submissions, applies across telecoms, broadcasting and online safety, and that public interest is not weighed in the analysis. Ofcom remains free to publish the existence, status and outcome of investigations and enforcement; what is shielded is the substance of what the regulated firm tells Ofcom.
FOIA section 44 keeps disclosures regulated firms make to Ofcom in investigations and enforcement out of Freedom of Information requests. Section 393 of the Communications Act 2003 prohibits Ofcom from disclosing information obtained in the exercise of its powers under the 2003 Act, the Broadcasting Acts 1990 and 1996, and the Online Safety Act 2023. The carve-out is narrow: Ofcom remains free to publish the existence, status and outcome of investigations and enforcement, because that publication falls within section 393(2)(a); section 393(6) adds supplementary carve-outs for other Ofcom publications. The protection reaches every power conferred on Ofcom by the four listed statutes, covers voluntary as well as compulsory submissions, is not limited to commercially sensitive material, and is not subject to a public-interest balance under FOIA section 44 (Babbs, First-tier Tribunal, 17 March 2026). The Babbs request happened to concern Ofcom’s meetings with the major platforms on the OSA Codes of Practice; the principle reaches every Ofcom investigation and every enforcement step that follows.
The statutory architecture: FOIA section 44 and Communications Act 2003 section 393
Ofcom is a public authority for FOIA purposes, but section 44 of the Freedom of Information Act 2000 is an absolute exemption that disapplies disclosure where another statute prohibits release. Section 393 of the Communications Act 2003 is the prohibition that applies to Ofcom’s regulatory information, and it is the conduit through which the FOIA absolute exemption in section 44 is engaged. The result is the Ofcom information disclosure regime that governs every voluntary disclosure to the regulator and every compelled response to an information notice.
Section 393 prohibits disclosure of information about a particular business that Ofcom has obtained in exercise of a power conferred by the 2003 Act, the Broadcasting Act 1990, the Broadcasting Act 1996, or the Online Safety Act 2023, while the business continues to be carried on. The bar is enforced by criminal penalty. Section 393(10) provides that a person who discloses information in contravention of the section is guilty of an offence, punishable on summary conviction by a fine not exceeding the statutory maximum and on conviction on indictment by up to two years’ imprisonment or a fine, or both. The offence is not confined to Ofcom staff: it reaches any person who discloses in contravention of the section. The provision lists statutory gateways at section 393(2): Ofcom’s own functions, the relevant functions of listed bodies including the Competition and Markets Authority, the Comptroller and Auditor General, certain criminal proceedings, civil proceedings under specified enactments, and compliance with the United Kingdom’s international obligations. The Online Safety Act 2023 was added to the source-statute list on 26 October 2023, when the OSA passed into law.
One class of Ofcom work falls outside the section 393 bar altogether. Section 393(8) provides that information Ofcom obtains in the exercise of functions exercisable concurrently with the Competition and Markets Authority under Part 1 of the Competition Act 1998 is subject to Part 9 of the Enterprise Act 2002, and not to the preceding provisions of section 393. An operator engaging with Ofcom on a Chapter I or Chapter II case is therefore within the Part 9 regime, which carries its own restrictions and its own gateways. Establish which of the two governs before advising on any disclosure, because the available gateways differ under each.
What the Tribunal decided in Babbs: voluntary, compulsory, and not just commercially sensitive
The Tribunal dismissed the appeal and confirmed the Information Commissioner’s decision notice IC-403651-J1L1 of 15 September 2025. Section 393 captures voluntary as well as compulsory engagement with Ofcom, and it is not limited to commercially sensitive material. The public interest is not weighed in the FOIA section 44 analysis. The Tribunal imposed one limit, against the Commissioner’s wider reading: the section requires the exercise of a power rather than the discharge of a function.
David Babbs of Clean Up the Internet argued that section 393 should apply only to information Ofcom obtained by exercising compulsory information-gathering powers, with Movement for an Open Web supporting that line as interested party. The Tribunal rejected the argument at paragraphs 21 to 23. At paragraph 21 it held that the power exercised need not be one directed at obtaining the information, because information may reach Ofcom whichever of its powers it is exercising, and there is no rational basis for distinguishing between those powers. At paragraph 22 it accepted Ofcom’s submission that the distinction risks making the provision unworkable, and put the point directly: “The fact that information is provided voluntarily does not mean that it does not or should not carry the same prohibition against disclosure”, particularly where consent has not been given. The same distinction would make an identical disclosure an offence under section 393(10) in one case and not in the other.
The Tribunal also fixed a limit running the other way. At paragraph 24 it rejected the Commissioner’s submission that section 393 is broad enough to cover information Ofcom obtains in the exercise of its functions generally. The provision is limited to the exercise of a power. Exercising a power may enable Ofcom to discharge a duty or carry out a function, but the section applies only where a power has in fact been exercised. At paragraph 25 the Tribunal read section 393 as applying to every provision of the listed statutes that confers a power on Ofcom unless specifically excluded, and said that had Parliament meant to confine it to the information-gathering powers it would have said so. The reach is therefore wide across Ofcom’s powers, and it stops at the boundary between a power and a function.
The Tribunal also rejected Movement for an Open Web’s narrower argument that section 393 protects only commercially sensitive information. At paragraphs 29 and 30 it noted that the provision does not refer to the affairs of a business or to commercial sensitivity; the Explanatory Notes cannot import limitations the legislature did not write. Applying the interpretive framework it had set out at paragraph 16, drawn from R (PACCAR Inc) v Competition Appeal Tribunal [2023] UKSC 28, the Tribunal gave the words of section 393 their ordinary meaning.
The appellant invited the Tribunal to read section 393 narrowly because of openness and transparency arguments. At paragraph 32 the Tribunal accepted that openness is in the public interest in relation to online safety but recorded that the public interest is not a relevant consideration in the application of FOIA section 44 and cannot be read into section 393. Section 44(2) was engaged on the same logic for the parts of the request relating to X and Google/YouTube. It provides that the duty in section 1(1)(a) to confirm or deny does not arise, so Ofcom was permitted, though not obliged, to decline to confirm or deny contact where doing so would itself disclose whether those firms had been subject to Ofcom’s regulatory functions.
What Babbs means for regulated firms: confidence to engage, no public-interest backstop
Babbs is a First-tier Tribunal decision and binds no later tribunal, but it is a considered treatment of section 393 on full argument and it is where the analysis now starts. Section 393 covers Ofcom‘s voluntary as well as compulsory information channels, and section 44(2) extends the protection to the fact of contact itself, by providing that the duty to confirm or deny does not arise and so permitting Ofcom to give a neither confirm nor deny response. That extension has a limit: Ofcom may be able to confirm whether it holds the information where a gateway applies or where the fact of a meeting is already public knowledge (Babbs at paragraph 36).
The bar reaches every power conferred on Ofcom by the four listed statutes, not just those under the OSA. Section 393(1) lists the Communications Act 2003, the Broadcasting Acts 1990 and 1996, and the Online Safety Act 2023 as source statutes, so engagement under each is captured. Spectrum information is protected instead by the parallel bar in section 111 of the Wireless Telegraphy Act 2006, and postal regulation by the Postal Services Act 2011’s own regime, so the section 44 analysis is similar but the statutory conduit differs. Section 393 brings Ofcom’s General Conditions investigations and market reviews, telecoms security investigations under the Telecommunications (Security) Act 2021 (inserting ss.105A to 105Z29 of the 2003 Act), broadcasting code investigations and the OSA Codes of Practice process inside the same regime. The Babbs reasoning attaches to the statutory section, not the regulatory pillar, so a fixed operator responding to a section 135 information notice and a platform engaging with Ofcom on illegal harms occupy the same statutory protection.
The bar carves out Ofcom’s own publication of investigations and enforcement. Section 393(2)(a) permits disclosure for the purpose of facilitating Ofcom’s functions, and Ofcom’s published enforcement practice treats transparency about open cases, updates summarising provisional decisions and non-confidential confirmation decisions, settlements and penalty totals as part of those functions. Section 393(6) expressly provides that the bar does not limit publication under sections 15, 26 or 390 of the 2003 Act, the matters made public as part of an Ofcom report, the matters published as a comparative overview under section 134D, or the security reports under sections 105Z and 105Z13. The case identifier, the name of the firm under investigation, the existence of a section 138 enforcement notification, the section 139A confirmation decision and the penalty figure are all matters of public record. What stays inside the FOIA section 44 bar is the substance of the regulated firm’s submissions, technical evidence and correspondence.
On the OSA, the meetings, written submissions and consultation responses Ofcom received during the Illegal Harms Statement of 16 December 2024 and the codes effective 17 March 2025 are inside the bar. The same logic covers Ofcom complaints and investigations work and the information notices in the Ofcom mobile messaging scams consultation and the Global Title leasing ban.
The same pattern holds across UK economic regulation: the FCA, PRA and Bank of England are protected by section 348 of the Financial Services and Markets Act 2000, the PSR by section 91 of the Financial Services (Banking Reform) Act 2013, and the CMA by Part 9 of the Enterprise Act 2002. In each case the FOIA section 44 conduit is the same: an absolute exemption that does not depend on commercial sensitivity and is not subject to a public-interest balance. The Babbs reasoning on voluntary submissions and on the irrelevance of public-interest arguments is likely to be persuasive in any tribunal applying section 348 or its analogues. A regulated firm engaging with the FCA on a Consumer Duty supervisory query, or with the PSR on scheme rules, has the same FOIA section 44 protection as a telecoms operator engaging with Ofcom.
For civil society groups and journalists, the route to public accountability narrows to judicial review of Ofcom’s disclosure decisions, which the Tribunal at paragraph 28 expressly identified as the alternative remedy. Judicial review tests rationality and procedural fairness, not the merits, and is procedurally demanding. Lobbying registers, voluntary platform disclosures, and Parliamentary scrutiny remain the forums in which the substance of those engagements may surface, if at all.
Viewpoint
The Babbs decision is the right answer, even if the transparency cost is real. The Communications Act 2003 has always treated information obtained in the exercise of Ofcom’s powers as a confidential channel between regulator and regulated, with criminal sanction under section 393(10) for breach. The channel exists because regulated firms share more, and share earlier, when they know the substance of what they say cannot be lifted by a stranger to the conversation. Reading section 393 down to compulsory submissions only, or to commercial sensitivity only, would have shifted that calculus and pushed firms to provide less unless legally compelled. The accountability point made by the appellant is real and the judicial review backstop identified by the Tribunal is a thin substitute, but the answer on Ofcom transparency is to legislate fresh duties of disclosure, not to rewrite section 393 from the bench. On competition work the section 393 analysis does not carry across at all, because section 393(8) routes concurrency information to Part 9 of the Enterprise Act 2002 instead. Whichever regime governs, the practical protection remains careful confidentiality marking at the point of disclosure. Section 393(1) prohibits disclosure without the consent of the person carrying on the business, and Ofcom has to know what it is holding, and on what terms, before it can decide whether a gateway is open.
Frequently asked questions
Does FOIA section 44 protect every meeting between Ofcom and a regulated firm?
Section 44 covers information whose disclosure is prohibited by another statute. For Ofcom that conduit statute is section 393 of the Communications Act 2003, which captures information obtained in exercise of a power conferred by the 2003 Act, the Broadcasting Acts 1990 and 1996, and the Online Safety Act 2023. Information already in the public domain, information published under Ofcom’s research and comparative overview functions, and information shared under a statutory gateway in section 393(2) falls outside the bar.
Does FOIA section 44 protection apply to voluntary submissions to Ofcom?
Yes. Section 393 applies whether the information was compelled or volunteered (Babbs at paragraphs 21 to 23). Information provided voluntarily carries the same prohibition against disclosure, particularly where the business has not consented, and the opposite reading would make an identical disclosure an offence under section 393(10) in one case and not in the other (Babbs at paragraph 22). That offence is committed by any person who discloses in contravention of the section, not only by Ofcom.
Can the public interest force disclosure where the regulatory issue is serious?
Not under FOIA. Section 44 is an absolute exemption and there is no public-interest balance. Openness and transparency are in the public interest in relation to online safety, but the public interest is not a relevant consideration in the application of section 44 and cannot be read into section 393 (Babbs at paragraph 32).
What is the route to challenge Ofcom’s section 393 reasoning?
Judicial review of Ofcom’s disclosure decision (Babbs at paragraph 28). Judicial review tests rationality and procedural fairness, not the merits, and is procedurally demanding.
Can Ofcom still publish that an investigation is underway?
Yes. Section 393(2)(a) permits disclosure for the purpose of facilitating Ofcom’s functions, and section 393(6) carves out publication of Ofcom’s reports and comparative overviews under section 134D, among other publication-empowered sections. Ofcom publishes the case identifier, the firm’s name, the opening of an investigation, updates summarising provisional decisions and non-confidential confirmation decisions, settlement details and penalty figures. What stays inside the bar is the substance of what the firm has disclosed.
For advice on responding to Ofcom information notices, managing voluntary engagement with Ofcom on Codes of Practice or market reviews, or assessing FOIA exposure on regulator-platform contact, contact Rob Bratby at Bratby Law.
