Decision
Mr K and Department of Foreign Affairs
From Office of the Information Commissioner (OIC)
Case number: OIC-100111-Z8K4M0
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-100111-Z8K4M0
Published on
Whether the statement of reasons supplied by the Department to the applicant as to why it had refused his data subject access requests (access requests) under the General Data Protection Regulation (EU) 2016/679 (the GDPR) was sufficient for the purposes of section 10 of the FOI Act
12 April 2021
The applicant made access requests to the Department under the GDPR on 11 September 2019, 15 February 2020, 26 March 2020, 1 May 2020, 13 June 2020 and 29 July 2020 seeking access to his personal data. The Department refused all six requests under Article 12(5) of the GDPR on the basis that they were “manifestly unfounded”.
In an application dated 31 August 2020, the applicant sought a statement of reasons in relation to the Department’s refusal of his data access requests. In a decision dated 25 September 2020, the Department refused his application under section 15(1)(g) of the FOI Act on the basis that his application was vexatious. It noted that the reasons for the refusal of his data subject access requests had been clearly outlined in the response letters provided in respect of each request.
The applicant sought an internal review of that decision on the same day. He contacted this Office on 28 October 2020 as he had not received a reply. Following correspondence with this Office, the Department issued a late internal review decision on 18 November 2020, in which it provided the statement of reasons sought.
On 23 November 2020, the applicant sought a review by this Office of the Department’s decision, on the basis that the statement of reasons provided by the Department was inadequate.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the correspondence between the applicant and the Department as set out above and to the communications between this Office and both the Department and the applicant on the matter. I have decided to conclude this review by way of a formal, binding decision.
This review is concerned solely with whether the Department has complied with the requirements of section 10 of the FOI Act in respect of the application for a statement of reasons as to why the Department did not grant the applicant access to the personal data sought under the GDPR.
Investigator’s Views
In his submissions to this Office, the applicant referred to the Investigator’s email of 22 February 2021, wherein she informed the applicant of her views on the matter, as a draft decision letter. I wish to make it clear that her email was not a preliminary decision. Rather, the Investigator informed the applicant of the recommendation she intended to make to the Commissioner or Senior Investigator, having considered the submissions and material on the case file at that time. I also note that the applicant expressed concerns that he was being given an opportunity to comment on the Investigator’s views in order to give an appearance of fair procedures. He was of the view that the Investigator’s mind was made up and that the Senior Investigator would simply accept the Investigator’s recommendation. It is important to note that responsibility for making a binding decision following a review rests with the Commissioner or the appropriate Senior Investigator who has delegated authority to make such decisions. I can confirm that I have had regard to all of the materials on this case, including the applicant’s comments and the Investigator’s recommendation.
Exchange of Submissions
During the course of the review, the applicant sought a copy of the Department's submissions to this Office. The policy of this Office in relation to the treatment of submissions is set out in its procedures manual, which is available at www.oic.ie. The procedure document provides that, in general, submissions will not be exchanged between parties to a review but that the parties should be notified of material issues arising for consideration. It describes material issues as including applicable exemptions not previously raised, pertinent search details not previously disclosed to the applicant, and new court judgments, which may have a bearing on the outcome of the review.
The applicant has been informed on a number of occasions, including in the course of previous reviews undertaken by this Office, of this general policy. Under section 45(6) of the FOI Act, the Commissioner has discretion to adopt such procedures as are appropriate in all the circumstances of a case. In all circumstances, this Office aims to ensure that the approach adopted is fair, and seen to be fair, to all the parties concerned. In this case, I am satisfied that this Office’s Investigator provided the applicant with a summary of all relevant matters raised by the Department in its submissions.
The applicant subsequently requested that this review be put on hold pending the outcome of a Court of Appeal hearing on another case involving the applicant and the Department. The matter of access to submissions was raised in that case. During the course of the review, the applicant also informed this Office that he had requested a copy of the Department’s submissions from the Department under the GDPR, so that he could make additional comments based on the contents of the Department’s full submission.
Having examined the Department’s submission and all correspondence between this Office’s Investigator and the applicant, I am satisfied that he has been afforded fair and reasonable opportunity to make informed submissions on the adequacy of the statement of reasons provided by the Department. I see no reason to delay this review any further on the basis of such separate, ongoing disputes or requests.
Role of this Office
I should also state that while I have had close regard to the applicant’s submission, a large part of his comments relate to the Department’s handling of his data subject access requests, his appeals to the DPC and the application of data protection legislation to these matters. The applicant provided copies of background documents pertaining to his data subject access requests to the Department. I note that he also referred to the Department’s failure to include details of his right to appeal its decision on a particular access request. It is important to note, as a preliminary matter in this regard, that this Office has no remit to investigate complaints, to adjudicate on how FOI bodies perform their functions generally, or to act as an alternative dispute resolution mechanism with respect to actions taken by FOI bodies.
Section 10 of the FOI Act provides that a person who is affected by an act of an FOI body, and has a material interest in a matter affected by the act or to which it relates, is entitled to a statement of reasons for the act, as well as a statement of any findings on any material issues of fact made for the purposes of that act.
In its internal review decision of 18 November 2020, the Department said that it considered it important that data subjects fully understand the reasons decisions are made concerning their personal data. The internal reviewer stated that he was therefore restating the reasons already provided to the applicant in its earlier decision letters. He set out the Department’s reasons for its actions as follows:
During the course of this review, the Department provided this Office with copies of its individual decisions on the applicant’s access requests. It said that as a significant level of detail was provided to the applicant in these letters of refusal, rather than simply repeat what was already provided, the statement of reasons provided in the internal review summarises the reasons in those letters. It said the objective of this was to explain as clearly as possible to the applicant why his access requests were refused.
Having considered the Department’s submission, this Office’s Investigator subsequently informed the applicant of her view that the Department’s internal review decision, taken together with the decision letters, were sufficient for the purposes of section 10 of the FOI Act. In his response, the applicant indicated that he did not agree with the Investigator’s view and provided an analysis of why he believed the Investigator’s proposed recommendation on the matter was incorrect, pursuant to the stated aims of the FOI Act.
This Office considers that a statement of reasons should be intelligible and adequate having regard to the particular circumstances of the case. The statement should be sufficiently clear to enable an applicant to understand without undue difficulty why the FOI body acted as it did. A statement does not necessarily have to contain a detailed clarification of all issues identified by an applicant as relevant to a particular act or decision. It is noteworthy that there are practical limits to the degree of explanation which can be given as to why a particular subjective judgement was made. If a public body adequately explains why it acted as it did, that is the end of the matter in terms of the obligations on the body under section 10 of the FOI Act. As set out above, this Office has no role in determining whether the decision or act of the FOI body was justified. It is sufficient, for the purpose of compliance with section 10, that the body adequately explains why it acted as it did.
The “acts” of the Department, the subject of the applicant’s present application under section 10 of the FOI Act, are the Department’s decisions that the applicant’s data subject access requests were “manifestly unreasonable” pursuant to the provisions of the GDPR. In my view, the Department’s internal review response of 18 November 2020, of itself, set out a statement of reasons, which, while succinct, was intelligible and sufficiently clear to enable the applicant to understand why the Department took those decisions. In the circumstances, I find that the Department has complied with the requirements of section 10 of the FOI Act in this case.
Having carried out a review under section 22 (2) of the FOI Act, I hereby affirm the decision of the Department in this case. I find that the Department has provided an adequate statement of reasons as to why the applicant’s access requests were refused.
Section 24 of the FOI Act sets out the detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Deirdre McGoldrick
Senior Investigator