If You Have to Ask: Proactive Disclosure Requirements in RTI and International Law

Most modern right-to-information laws now require governments to publish certain categories of information without waiting for a request. New global standards are creating a backstop. What do these laws and standards contain?

The Proactive Disclosure Coalition, meeting at the 2025 OGP Summit in Vitoria-Gasteiz, Spain (Credit: OGP)

By Joseph Foti

The Right to Information (RTI) Rating, developed by Access Info Europe and the Centre for Law and Democracy (CLD), is the most widely used tool for assessing the legal strength of access to information frameworks.¹ The Rating is used by OGP to assess eligibility of new national members, alongside governments, academics, and civil society to understand bedrock open government law.

Despite covering 61 indicators across seven dimensions, it acknowledges leaving out one crucial area:

…rules on the proactive disclosure of information. The reason for this is that proactive disclosure rules are often spread among many different pieces of legislation, making it difficult to provide a scientific assessment without significant resources.

This is true, and, understandably, it may not be appropriate for a social-scientific rating. But, outside of the purposes of ranking, it is still worth looking at to understand what the law might say. Proactive disclosure is a common part of fiscal rules, environmental laws, and judicial processes, distributed across each country’s legal code. Nonetheless, most 21st century access to information laws have minimal sets of information to guide proactive (versus reactive) publication of information. International legal instruments, as well, increasingly encourage this action.

This article will explore what is currently covered by RTI laws, as well as emerging norms, including the work of the Proactive Disclosure Coalition launched by OGP members at the 2025 Global Summit in Victoria-Gasteiz, Spain.

Two Models: Prescriptive Lists or Process-Based

Most RTI laws take one of two approaches to proactive disclosure.

• Prescriptive list: The law specifies, often in detail, what categories of information public authorities must publish on their own initiative. The most common are organograms and leadership positions of the various agencies.
• Process-based model: The law requires each institution to publish a manual or scheme describing what it makes available, without prescribing to specific categories.

Mexico represents the enumerated list approach at its most developed. Mexico’s Ley General de Transparencia y Acceso a la Información Pública (2015) originally set a gold standard for proactive disclosure, with at least 48 distinct categories of mandatory public data. Categories range from budget execution and audit results to human rights recommendations. However, sweeping constitutional reforms dissolved Mexico’s independent transparency watchdog, transferring enforcement directly to the executive branch, complicating the independent oversight and execution of these mandates.

Nigeria’s Freedom of Information Act (2011), also list-based, includes institutional functions, job descriptions, staff salaries, budget, procurement, and grants data, and official decisional records. Indonesia’s Law on Public Information Openness (2008), has a distinctive three-tier model. Some information must be published periodically (general institutional and financial data), others announced immediately (emergencies, disease outbreaks, disasters), and a third category that must be available on an ongoing basis (laws, policies, service descriptions, contracts). The tiered structure has been widely adapted in Southeast Asia, while Mexico and Nigeria show how such lists create clear, enforceable, and comparable standards.

The second model, a process-based approach, is common in Africa and some Asian systems. South Africa’s *Promotion of Access to Information Act (2000)* requires each public body to compile a manual itemizing the categories of records it makes automatically available. This delegates the scope of proactive disclosure to individual agencies rather than leaving it to the legislature to define.

Unlike prospective lists, manual-based systems offer flexibility but make it harder to audit compliance, harder for civil society to organize their demands, and difficult to build a comparative picture for international norm-setting.²

Are You on the List? A Deeper Dive on Proactive Lists

So, what are governments committing to publish on proactive lists?

To find out what is in proactive lists, I pointed to Claude (Sonnet 4.6) to analyze nearly two dozen national Freedom of Information (FoI) laws. I built a database of right to information laws from countries in three categories.

• First, I looked at *Proactive Transparency: The Future of the Right to Information *authored by Helen Darbishire. The paper explored cases from India, Mexico, Hungary, and the UK.
• I then looked at members of the Proactive Disclosure Coalition, which are Armenia, Brazil, Canada, Croatia, Estonia, Finland, Germany, Norway, The Netherlands, Portugal, Romania, Spain, and Scotland).
• I also included a few middle and upper-middle income countries to get more regional diversity, namely Kenya, Ghana, Indonesia, the Philippines, and South Africa.

Finally, I added the requirements from two sources of international law: the OECD Open Government Recommendation and the EU member states High-Value Data Directive.

Claude extracted specific phrases and requirements from these laws. I then directed it to sort these into five buckets, adapted from Helen Darbishire’s work. These were institutional data, accountability data, basic data infrastructure, regulatory & policy transparency, and environmental & public interest data. The full database can be accessed here.

What Proactive Disclosure Requirements do RTI Laws Include?

My research showed that across list-based systems, certain categories appear consistently. Organizational structure, officer names and contacts, institutional mandate, and budget information appear in virtually every enumerated regime. Almost all also require each agency to publish service descriptions and procedural information like how to use government services, relevant fees, and deadlines. These are low-cost, low-controversy categories.

Accountability-focused requirements are less common. Full contract and procurement data, audit results, senior remuneration, and asset declarations appear only in the most comprehensive regimes (Spain, Estonia, Croatia, and Mexico), and drop out of the basic ones (Romania, Armenia, Kenya, and Ghana). Beneficial ownership, lobbying, and political finance are almost entirely absent from RTI disclosure requirements. Mexico is the lone clear case with political party funding and subsidy beneficiaries, while Spain is the outlier on asset declarations and full contract transparency. Everywhere else these categories either are in different statutes or not required to be published.

Older laws tend to have fewer proactive disclosure requirements. The prescriptive lists are concentrated in newer 21st century laws (Estonia, Croatia, Spain, Mexico, India, and Indonesia). The process-based regimes that set no statutory floor at all are mostly older or common-law systems: Germany, Norway, the UK, Scotland, and Finland.

Environmental permits and extractive industry contracts, despite being categories with established transparency norms such as the Aarhus Convention, are not consistently enumerated in general access to information frameworks like they are in Portugal, Estonia, and Armenia.

The data shows us that there are still significant gaps in requiring high-value accountability data into the public’s hands. (Recall the caveats that laws are not always implemented, and some countries require this data elsewhere in the code.) This is a clear opening for international standards and best practices.

Emerging International Standards

Against this national-level picture, there are a few significant international frameworks shaping what proactive disclosure should look like. They reflect different priorities.

The Tromsø Convention, Article 10, states that for authorities making “documents public at the initiative of the public authorities” should take necessary measures to publish documents on their own initiative, where appropriate.

The EU’s Commission Implementing Regulation on High-Value Datasets (2023/138, which has applied since June 2024) specifies six thematic categories of public sector data that EU member states must make available free of charge, in machine-readable format, via API. These are:

• geospatial data;
• earth observation and environment;
• meteorological data;
• statistics;
• company ownership; and
• mobility data.

The regulation is technically specific and enforceable, setting requirements for format, licensing, and access infrastructure. It is focused primarily on economic reuse value, ideally enabling researchers, businesses, and public authorities to combine data across borders.

Of the six categories, only company ownership overlaps clearly with the accountability-focused categories that are in the national RTI proactive disclosure frameworks. The EU High-Value Data regulation is not primarily a transparency instrument in the governmental accountability sense; it is a data infrastructure instrument. It’s still very useful, but it is limited for purposes of democratic accountability, as it focuses mostly on data for economic and social benefits.

The OECD Recommendation on Open Government (2017), the first internationally recognized legal instrument specifically on the topic, takes a different approach. Provision 7 instructs adherents to proactively make information available that is:

• clear, complete, timely, reliable, and relevant;
• free of charge;
• available in open, machine-readable formats;
• easy to find, understand, use, and reuse;
• disseminated through multiple channels; and
• prioritized in consultation with stakeholders.

The OECD’s own 2023 review found Provision 7 is one of the areas in need of improvement.

And more recently, the Netherlands is currently leading a coalition of 12 countries that are collaborating with the OGP Support Unit, civil society partners, and the OECD to develop Good Practice Principles on Proactive Disclosure that have the potential to move the bar higher. The Principles will offer the chance to address the substantive gaps in governance datasets on the topics of beneficial ownership, lobbying, environmental permits, and subsidy beneficiaries.

An Emerging Best Practice for RTI Law?

As we move towards a global norm of proactive disclosure, one thing is clear: the shift toward proactive disclosure in RTI law is real and global. But accountability and democracy need to be more at the core of this work with accountability-intensive categories, which are consistently underrepresented in the enumerated lists.

The Good Practice Principles consultation is an opportunity to close some of the gaps and inconsistencies explored throughout this article, if the process is able to produce principles that are specific enough to address the accountability categories, not just the easy ones. In particular, experts, advocates, and practitioners in lower and middle-income countries, where the stakes for disclosure are often highest, can make a real difference in ambition.

Over the next few years, it will be exciting to see the combined efforts of the OECD (with its tradition of rigor and comparable data) and OGP with its civil society and government practitioners from all over the world to implement the Principles on Proactive Release.

¹ The Rating relies on de jure information, although both Carter Center and CLD have implementation assessment tools.

² Arguably, there is a third form of proactive disclosure requirement that could be termed “evolutionary.” It derives from jurisprudential or common law practices. As information commissions, judges, or other jurists rule, they may mandate agencies to proactively publish a list of information. We can see this with the Aarhus Convention Compliance Committee and Mexico (before significant legal changes) when these bodies built out a list of required proactive releases following legal challenges. These proactive release requirements are not directly mandated through statute, but often have the force of law and derive from delegated power.