FOIA section 44 keeps Ofcom investigations and enforcement out of FOI
In short: FOIA section 44 keeps the disclosures regulated firms make to Ofcom in investigations and enforcement out of Freedom of Information requests. Babbs v The Information Commissioner & Ofcom [2026] UKFTT 389 confirms that Communications Act 2003 section 393 covers voluntary as well as compulsory submissions, applies across telecoms, broadcasting and online safety, and that public interest is not weighed in the analysis. Ofcom remains free to publish the existence, status and outcome of investigations and enforcement; what is shielded is the substance of what the regulated firm tells Ofcom.
FOIA section 44 keeps disclosures regulated firms make to Ofcom in investigations and enforcement out of Freedom of Information requests. Section 393 of the Communications Act 2003 prohibits Ofcom from disclosing information obtained in the exercise of its powers under the 2003 Act, the Broadcasting Acts 1990 and 1996, and the Online Safety Act 2023. The carve-out is narrow: Ofcom remains free to publish the existence, status and outcome of investigations and enforcement, because that publication falls within section 393(2)(a) and the express carve-outs in section 393(6). The First-tier Tribunal in Babbs on 17 March 2026 confirmed that the protection runs across the whole of Ofcom’s regulatory remit, covers voluntary as well as compulsory submissions, is not limited to commercially sensitive material, and is not subject to a public-interest balance under FOIA section 44. The Babbs request happened to concern Big Tech meetings on the Ofcom Codes of Practice for the OSA; the principle reaches every Ofcom investigation and every enforcement step that follows.
The statutory architecture: FOIA section 44 and Communications Act 2003 section 393
Ofcom is a public authority for FOIA purposes, but section 44 of the Freedom of Information Act 2000 is an absolute exemption that disapplies disclosure where another statute prohibits release. Section 393 of the Communications Act 2003 is the prohibition that bites on Ofcom’s regulatory information, and it is the conduit through which the FOIA absolute exemption in section 44 is triggered. The result is the Ofcom information disclosure regime that frames every voluntary disclosure to the regulator and every compelled response to an information notice.
Section 393 prohibits disclosure of information about a particular business that Ofcom has obtained in exercise of a power conferred by the 2003 Act, the Broadcasting Act 1990, the Broadcasting Act 1996, or the Online Safety Act 2023, while the business continues to be carried on. The bar is enforced by criminal penalty: under section 393(10) Ofcom officials commit an offence on disclosure outside the prescribed routes, punishable on summary conviction by a fine and on indictment by up to two years’ imprisonment or a fine. The provision lists statutory gateways at section 393(2): Ofcom’s own functions, the relevant functions of listed bodies including the Competition and Markets Authority, the Comptroller and Auditor General, certain criminal proceedings, civil proceedings under specified enactments, and compliance with the United Kingdom’s international obligations. The Online Safety Act 2023 was added to the source-statute list when the OSA passed into law and Ofcom’s online safety functions came on stream.
What the Tribunal decided in Babbs: voluntary, compulsory, and not just commercially sensitive
The Tribunal upheld the Information Commissioner’s decision notice IC-403651-J1L1 of 15 September 2025 and confirmed three propositions about section 393 that materially expand its practical reach. First, it captures voluntary as well as compulsory engagement with Ofcom. Second, it is not limited to commercially sensitive material. Third, the public interest is not weighed in the FOIA section 44 analysis.
David Babbs of Clean Up the Internet argued that section 393 should apply only to information that Ofcom obtained by exercising compulsory information-gathering powers, with Movement for an Open Web supporting the line as interested party. The Tribunal rejected the argument at paragraphs 21 to 23. Section 393 applies to information obtained in exercise of a power, and Ofcom exercises a power whenever it acts under one of the listed statutes. Drawing a line between compulsory and voluntary submissions would mean the same disclosure could be a criminal offence in one case and lawful in the other, with section 393(10) operating arbitrarily.
Movement for an Open Web’s narrower argument, that section 393 protects only commercially sensitive information, fared no better. At paragraphs 29 and 30 the Tribunal noted that the provision does not refer to the affairs of a business or to commercial sensitivity; the Explanatory Notes cannot import limitations the legislature did not write. Citing R (PACCAR Inc) v Competition Appeal Tribunal [2023] UKSC 28 on statutory interpretation, the Tribunal applied the words of section 393 in their ordinary meaning.
The third holding is the one most likely to be felt in practice. The appellant invited the Tribunal to read section 393 narrowly because of openness and transparency arguments. At paragraph 32 the Tribunal accepted that openness is in the public interest in relation to online safety but recorded that the public interest is not a relevant consideration in the application of FOIA section 44 and cannot be read into section 393. The neither-confirm-nor-deny duty under section 44(2) was engaged on the same logic for the parts of the request relating to X and Google/YouTube, where confirming or denying contact would itself disclose whether those firms had been subject to Ofcom’s regulatory functions.
What Babbs means for regulated firms: confidence to engage, no public-interest backstop
After Babbs, the FOIA section 44 position is settled. Section 393 covers Ofcom‘s voluntary as well as compulsory information channels, and the section 44(2) neither confirm nor deny duty extends the protection to the fact of contact itself.
The bar reaches across Ofcom’s regulatory work, not just the OSA. Section 393(1) lists the Communications Act 2003, the Broadcasting Acts 1990 and 1996, and the Online Safety Act 2023 as source statutes, so engagement under each is captured. That brings Ofcom’s General Conditions investigations and market reviews, telecoms security investigations under the Telecommunications (Security) Act 2021 (inserting ss.105A to 105Z29 of the 2003 Act), broadcasting code investigations and the OSA Codes of Practice process inside the same regime. The Babbs reasoning attaches to the statutory section, not the regulatory pillar, so a fixed operator responding to a section 135 information notice and a platform engaging with Ofcom on illegal harms occupy the same statutory protection.
The bar carves out Ofcom’s own publication of investigations and enforcement. Section 393(2)(a) gateways disclosure for the purpose of facilitating Ofcom’s functions, and Ofcom’s published enforcement practice treats transparency about open cases, provisional and confirmation decisions, settlements and penalty totals as part of those functions. Section 393(6) expressly provides that the bar does not limit publication under sections 15, 26 or 390 of the 2003 Act, the matters made public as part of an Ofcom report, the matters published as a comparative overview under section 134D, or the security reports under sections 105Z and 105Z13. The case identifier, the name of the firm under investigation, the existence of a section 138 enforcement notification, the section 139A confirmation decision and the penalty figure are all matters of public record. What stays inside the FOIA section 44 bar is the substance of the regulated firm’s submissions, technical evidence and correspondence.
On the OSA, the meetings, written submissions and consultation responses Ofcom received during the Illegal Harms Statement of 16 December 2024 and the codes effective 17 March 2025 are inside the bar. The same logic covers Ofcom complaints and investigations work and the information notices we examined in the Ofcom mobile messaging scams consultation and the Global Title leasing ban.
The same architecture runs across UK economic regulation. The FCA, PRA and Bank of England are protected by section 348 of the Financial Services and Markets Act 2000, the PSR by section 91 of the Financial Services (Banking Reform) Act 2013, and the CMA by Part 9 of the Enterprise Act 2002. In each case the FOIA section 44 conduit is the same: an absolute exemption that does not depend on commercial sensitivity and is not subject to a public-interest balance. The Babbs reasoning on voluntary submissions and on the irrelevance of public-interest arguments is likely to be persuasive in any tribunal applying section 348 or its analogues. A regulated firm engaging with the FCA on a Consumer Duty supervisory query, or with the PSR on scheme rules, sits inside the same FOIA section 44 protection as a telecoms operator engaging with Ofcom.
For civil society groups and journalists, the route to public accountability narrows to judicial review of Ofcom’s disclosure decisions, which the Tribunal at paragraph 28 expressly identified as the alternative remedy. Judicial review tests rationality and procedural fairness, not the merits, and is procedurally demanding. Lobbying registers, voluntary platform disclosures, and Parliamentary scrutiny remain the forums in which the substance of those engagements may surface, if at all.
Viewpoint
The Babbs decision is the right answer, even if the transparency cost is real. The Communications Act 2003 has always treated information obtained in the exercise of Ofcom’s powers as a confidential channel between regulator and regulated, with criminal sanction under section 393(10) for breach. The channel exists because regulated firms share more, and share earlier, when they know the substance of what they say cannot be lifted by a stranger to the conversation. Reading section 393 down to compulsory submissions only, or to commercial sensitivity only, would have shifted that calculus and pushed firms to provide less unless legally compelled. The accountability point made by the appellant is real and the judicial review backstop identified by the Tribunal is a thin substitute, but the answer on Ofcom transparency is to legislate fresh duties of disclosure, not to rewrite section 393 from the bench. In our experience advising operators on online safety, telecoms security and competition matters, the best practical protection is still careful confidentiality marking at the point of disclosure, ahead of any later Ofcom consultation under section 393(2).
Frequently asked questions
Does FOIA section 44 protect every meeting between Ofcom and a regulated firm?
Section 44 covers information whose disclosure is prohibited by another statute. For Ofcom that conduit statute is section 393 of the Communications Act 2003, which captures information obtained in exercise of a power conferred by the 2003 Act, the Broadcasting Acts 1990 and 1996, and the Online Safety Act 2023. Information already in the public domain, information published under Ofcom’s research and comparative overview functions, and information shared under a statutory gateway in section 393(2) sits outside the bar.
Does FOIA section 44 protection apply to voluntary submissions to Ofcom?
After Babbs, no. The Tribunal at paragraphs 21 to 23 held that section 393 applies whether the information was compelled or volunteered. Same protection, same criminal offence under section 393(10) for breach by Ofcom. The Tribunal reasoned that any other reading would make the same disclosure a criminal offence in one case and lawful in the other, with section 393(10) operating arbitrarily.
Can the public interest force disclosure where the regulatory issue is serious?
Not under FOIA. Section 44 is an absolute exemption and there is no public-interest balance. The Tribunal accepted that openness is in the public interest in relation to online safety but found that the public interest is not a relevant consideration in the application of section 44 and cannot be read into section 393.
What is the route to challenge Ofcom’s section 393 reasoning?
Judicial review of Ofcom’s disclosure decision. At paragraph 28 the Tribunal recorded that this is the available remedy. JR tests rationality and procedural fairness, not the merits, and is procedurally demanding; for a flavour of how Ofcom investigations and decisions are tested in practice, see our work on regulatory investigations and enforcement support.
Can Ofcom still publish that an investigation is underway?
Yes. Section 393(2)(a) gateways disclosure for the purpose of facilitating Ofcom’s functions, and section 393(6) carves out publication of Ofcom’s reports and comparative overviews under section 134D, among other publication-empowered sections. Ofcom publishes the case identifier, the firm’s name, the opening of an investigation, provisional and confirmation decisions, settlement details and penalty figures. What stays inside the bar is the substance of what the firm has disclosed.
For advice on responding to Ofcom information notices, managing voluntary engagement with Ofcom on Codes of Practice or market reviews, or assessing FOIA exposure on regulator-platform contact, contact Rob Bratby at Bratby Law.
