Risks following a product recall, part 1: disclosure and freedom of information requests

Following a product recall, there are a number of risks to a business that the directors, senior staff and the legal team should be aware of from the outset and may need to address long after the initial recall.

The dissemination of documents created during a product recall poses a real threat to a company and can have serious implications in the event of a potential criminal prosecution. 

In part 1 of this two-part briefing, Alison Newstead, partner with Shook Hardy & Bacon International, examines the issue of confidential and sensitive information reaching external parties by way of disclosure or as a result of requests under the Freedom of Information Act 2000. Part 2 of this series will look at potential criminal liabilities – both for the company and individuals.


During a product recall, a plethora of documentation is created throughout the business. Such documentation is always at risk of disclosure.

After the recall of one or more product lines, businesses are likely to see a general increase in the number of enquiries and complaints, even if products do not fall within the model, serial number, or batch affected. This may well lead to an increased number of complaints and product liability claims that cross the desks of customer services teams and legal departments.

It has become commonplace in all types of litigation, particularly relating to personal injury claims, for claimants’ solicitors to routinely request pre-action disclosure of documents. Such requests may include demands for documents relating to the product recall, safety investigations and similar incidents. Unless documents are covered by privilege, all documents created during the course of a recall investigation are in danger of being disclosed. For example this may include internal risk assessment reports, notifications to the authorities and recall communications.

There are two main reasons to resist disclosure of such documentation:

  • privileged communications with lawyers and documents created in relation to actual or potential litigation are not disclosable; and
  • if a product is not within the cohort covered by the recall notice, where the request is for documents relating to ‘similar’ products.

A persistent claimant solicitor may make an application to a court for disclosure. Such a request could be resisted on the grounds of relevancy or proportionality. However, on the wrong day before the wrong judge, a business may find that it is faced with an order for disclosure of documents that it would prefer did not enter into the hands of a claimant’s solicitor. While disclosure would only be for the purposes of that case, there is a risk that any knowledge of a wide-scale problem with one of your products could lead to a media campaign to ‘recruit’ other potential claimants, potentially forming a group action.

Commercially, a business will be reluctant to release any internal documents relating to a product recall or safety investigation, and this may drive a strategy to close down claims at the earliest opportunity prior to any disclosure. The cost of settling a small number of claims on a confidential basis must be weighed against the costs of a potential group action and the implications of any associated negative publicity.

Key personnel need to be aware of any overarching commercial policy regarding early settlement of claims and the legal team will need to discuss this with insurers or claims handlers. It may be that the commercial and brand protection issues that are driving the commercial strategy are not shared by your insurers.


A plethora of information will have been provided to the regulatory authorities during the product recall process. Such documents are likely to include:

  • the recall notification form, which gives details of the product affected and the risk posed;
  • copies of risk assessment documents; and
  • other documents provided to the authorities to assist them in understanding the risk posed by the product and the steps taken by the business to address this risk.

A claimant’s solicitor may make a request under the Freedom of Information Act to a relevant regulatory authority for copies of information that they hold regarding a particular product recall. A copy of the recall notification form is not going to provide much more information than is already in the public domain. However, the risk assessment and correspondence between the regulatory authority and your business may be useful to them in drafting their letter of claim.

Many businesses underestimate the use of freedom of information requests. Recall notifications and risk assessments may also be of interest to competitors, the press and consumer organisations and pressure groups.


The Freedom of Information Act recognises that in many cases, and for a wide variety of reasons, it will be inappropriate for a public authority to disclose the information it holds. To cater for this, the Act contains a number of exemptions, which protect information from potential disclosure.

Of particular relevance in a product recall situation are those exemptions relating to investigations, law enforcement and information provided in confidence. Although these helpful exemptions exist, the obligation to consider and apply exemptions rests with the public authority, not the entity which provided the information. In fact, the provider of the information has no right to prevent disclosure, or any route to remediation if it is incorrectly disclosed.

The key point to note is that exemptions do not prevent a public authority from disclosing information – they merely relieve it of the obligation to do so.


When faced with a freedom of information request, the regulatory authorities are placed in a difficult position, as they have to evaluate what is confidential and what is not. They also have to assess whether it is necessary to disclose the information in order to comply with their obligations to inform customers of the relevant risks associated with a product.

Under the General Product Safety Regulations (s39):

‘An enforcement authority shall, in general, make available to the public any information as is available to it on the following matters relating to risks to consumer health and safety posed by a product:

    1.  the nature of the risk;
    2. the product identification and the measures taken in respect of that risk.’

However, this obligation does not apply to any information obtained by the enforcement authority, which is covered by professional secrecy, unless the circumstances require such information to be made public to protect the health and safety of consumers.

There is no definition of ‘professional secrecy’ in the regulations; so this is open to interpretation. In all likelihood, consumers are likely to be fully informed of the nature of the risks posed by a particular product and the steps taken to address these risks will be adequately outlined in any recall notices and communications. The background risk assessment documents are unlikely to improve the information for consumers.

Among the various regulatory agencies, there is no standard approach to handling freedom of information requests. However, some regulators appear to be taking steps to ensure that they go some way in preventing indiscriminate disclosure.

Trading Standards

Trading Standards has no common approach across its offices. While local Trading Standards websites usually display a freedom of information policy, the extent of such policies is not always evident. If this is the case, it is advisable to work closely with your local Trading Standards officer (TSO) during the product recall to ensure that both parties understand the information policy in place and how your business can work with the TSO to protect sensitive information.

The Health & Safety Executive

The Health & Safety Executive (HSE) has a more transparent approach. It has issued a policy statement indicating that it will ‘consider the need to consult’ the information provider prior to responding to any freedom of information request and will engage in such consultation ‘if necessary’. There is no guidance on when it is necessary for the HSE to consult. The decision rests entirely within their discretion. Indeed, even when the HSE does consult a business about disclosing information following a freedom of information request, it can still disclose the documents in its possession.

The Food Standards Agency

The Food Standards Agency helpfully publishes lists of such requests in their online ‘Disclosure Log’. This log details any requests relating to product recalls and indicates whether the information was fully or partially provided and what, if any, exemptions were applied.

Vehicle and Operator Services Agency

The Vehicle and Operator Services Agency (VOSA) is also aware of the sensitive issues surrounding requests for information and will generally liaise with businesses regarding any such requests.


As outlined above, the response to a request under the Freedom of Information Act is ultimately at the discretion of the regulatory authority. There is no absolute right to be consulted or to give consent to disclosure. Therefore it is important to ensure that there is co-operation and communication between the regulatory authority and the recall team.

To achieve some degree of protection, it is advisable to mark documents as ‘confidential’ or ‘not be disclosed for other purposes’.

One protective measure, albeit not watertight, is to insert wording onto any recall notification form sent to the relevant authorities. For example:

‘[Company name] has, in making this notification, provided information which is confidential and which is covered by professional or trade secrecy. This information should not be disclosed by the recipient to any third party save as is strictly necessary for it to comply with the requirements on member states contained in the European Directive 2001/95/EC. If any request is made for this information please notify [company name] immediately.’

Marking a document as ‘confidential’ is not sufficient for a legal right to arise in relation to the laws of confidence, privilege and privacy in the UK. However, this is a step towards putting regulatory authorities on notice that confidential information is to be treated as such. It may mean that the regulatory authority gives disclosure a second thought.


A business has few options and little influence on how the regulatory authorities choose to disclose company documents once they are in their possession. While a few simple steps will help to minimise the risk of arbitrary disclosure, this significant risk needs to be considered from the outset of any product recall.