Decision
Ms X and An FOI Body
From Office of the Information Commissioner (OIC)
Case number: OIC-123480-H7G6L6
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-123480-H7G6L6
Published on
Whether the FOI body was justified in refusing access to certain records concerning the applicant’s Protected Disclosure
13 October 2022
The applicant made a number of FOI requests to the body on 18 January 2022. This review concerns Request 1, which sought access to all records dating from 1 March 2018 to 31 December 2021 as held by three named staff (of the body) in relation to the applicant’s Protected Disclosure (PD). She excluded the preliminary and final reports and any correspondence relating to the PD of which she is the sender or recipient.
The body’s decision of 16 March 2022 part-granted the request. It relied, in particular, on sections 32(1)(a)(iii) (security of persons and property), and 37(1) (personal information) of the FOI Act in relation to the withheld records and parts of records.
The applicant sought an internal review on 20 March 2022. The body’s internal review decision of 11 April 2022 affirmed its decision on the request.
On 13 May 2022, the applicant applied to this Office for a review of the body’s decision. During the review, the body agreed to release certain further details concerning service providers and staff involved in the management/administration of matters arising from the PD.
I have now completed my review in accordance with section 22(2) of the FOI Act and I have decided to conclude it by way of a formal, binding decision. In carrying out my review, I have had regard to the above exchanges and to correspondence between this Office, the body and the applicant. I have also had regard to the contents of the records at issue and to the provisions of the FOI Act.
The scope of this review is confined to whether the body’s decision on the applicant’s request is justified under the FOI Act. It will not consider those details which the body says it is willing to release.
The applicant explains why she believes that it is in the body’s interest to withhold the information. She describes how she has been affected by various matters. She refers to public discussions calling for a review of the FOI Act in the interests of individuals and their rights to access all of their information as held by FOI bodies. She says that it is in all stakeholders’ interests for action to be taken to prevent bodies from misapplying the FOI Act, and that openness and transparency are optional at present.
However, section 13(4) of the FOI Act requires me to disregard any reasons that the applicant has or may have for making her FOI request. Furthermore, a review under section 22 cannot extend to or take account of matters more appropriate to an investigation under section 44, which inter alia gives the Commissioner the right to conduct investigations into the practices or procedures of FOI bodies for the purposes of compliance with the FOI Act. I do not consider this to be an instance where an investigation into how the body dealt with the applicant’s request, further to its FOI practices and procedures, appears to be warranted. In addition, this review does not extend to examining, making findings on or taking account of how the body performs its functions generally. I cannot take account of the applicant’s views on these matters.
Section 18(1) provides, that "if it is practicable to do so", access to an otherwise exempt record shall be granted by preparing a copy, in such form as the head of the public body concerned considers appropriate, of the record with the exempt information removed. Section 18(1) does not apply, however, if the copy provided for thereby would be misleading (section 18(2) refers).
The body has granted partial access to some of the records. However, the Commissioner takes the view that, generally, neither the definition of a record nor the provisions of section 18 envisage or require the extracting of particular sentences or occasional paragraphs from the remainder of such records for the purpose of granting access to those particular sentences or paragraphs.
Section 25(3) of the FOI Act requires the Information Commissioner to take all reasonable precautions in the performance of his functions to prevent the disclosure of information contained in an exempt record or that would cause the record to be exempt if it contained that information. For this reason, the descriptions I can give of the records and of the reasons for certain parts of my decision are somewhat limited.
Release of records under FOI is generally understood to have the same effect as publishing them to the world at large, given that the Act places no constraints on the uses to which the information contained in those records may be put.
Section 32(1)(c) – facilitate commission of an offence
The body withheld various passwords under section 32(1)(a)(iii) of the FOI Act, on the basis that their disclosure could reasonably be expected to facilitate the commission of an offence. However, these comments reflect the wording of section 32(1)(c) of the FOI Act, which is in my view the more relevant provision to consider.
Section 32(1)(c) of the FOI Act provides that a head may refuse to grant an FOI request if access to the record concerned could, in the opinion of the head, reasonably be expected to facilitate the commission of an offence. Section 32(1) is subject to section 32(3) which provides that consideration must be given to the possibility that the public interest would be better served by the release of the information rather than by it being withheld, in the event that one of three conditions is fulfilled.
An FOI body relying on section 32(1)(c) should show how the release of the particular details could make the commission of an offence easier, and also consider the reasonableness of that occurring. It should also indicate the nature of the relevant offence(s).
The parties’ submissions
The body says that passwords are generally used as a security control to reduce opportunities for unauthorised access to information systems. It says that it holds very sensitive and confidential personal information that it is legally required to treat confidentially and securely. It says that when sharing documents containing sensitive information, it ensures their security by password-protecting them and circulating them to only the minimum number of people who need to know the details. It reiterates that that disclosure of information under FOI is equivalent to its publication to the world at large.
The applicant accepts that the body’s decisions refer to the withholding of specific passwords. She does not comment on the body’s arguments other than to query if she has an entitlement to records referring to her that are password-protected. She queries how the FOI Act can be of use to her if she does not have such an entitlement.
The FOI Act provides for members of the public to obtain access to information held by public bodies (the right of access). However, it also provides for exceptions to that right by way of exemption provisions, such as section 32(1)(c). This review cannot determine whether the applicant has a general right of access to records about her, whether password protected or otherwise. Whether a record is exempt under a specific provision of the FOI Act depends on the contents of the record, the arguments made and the circumstances of the particular case.
I am satisfied that the details at issue here are comprised of passwords. I accept that these passwords are intended to ensure the security of the particular sensitive documents and information to which they relate, and which the body is obliged to hold securely. I accept that placing these passwords, effectively in the public domain, could reasonably be expected to facilitate unauthorised access to the documents and information concerned. I understand that such unauthorised access is an offence. I find that section 32(1)(c) of the FOI Act applies to the withheld passwords. Further to section 32(3), the public interest in the release of the passwords is only required to be considered in certain circumstances. I am satisfied that no such circumstances arise in this case.
Section 37 - personal information
The body’s schedules say that some of the remaining withheld details “do not relate to the requester”, whilst also referring to the exemption provisions of the FOI Act. For avoidance of any doubt, I have carefully examined all of the remaining withheld material. While certain records and parts of records do not refer to the applicant, I am satisfied that those details nonetheless relate to her and that they are covered by her request. I will now consider these, and all of the other remaining withheld details, under section 37 of the FOI Act.
Section 37(1)
Section 37(1), subject to other provisions of section 37, requires the refusal of access to a record containing personal information. It is not relevant whether the applicant created the record or may be aware of the information concerned.
For the purposes of the FOI Act, personal information is defined in section 2 as information about an identifiable individual that (a) would ordinarily be known only to the individual or members of the family, or friends, of the individual, or (b) is held by a public body on the understanding that it would be treated by it as confidential. Section 2 also includes a list of 14 non-exhaustive examples of what must be considered to be personal information, including (iii) information relating to the employment or employment history of the individual and (xiv) the views or opinions of another person about the individual. Where information can be classified as one of these 14 examples, there is no need for the requirements at (a) or (b) of the definition to also be met.
Section 2 of the FOI Act excludes certain information from being considered as personal information. In particular, paragraph I provides that where the individual is or was a staff member of an FOI body, personal information does not include the name of the individual or information relating to the office or position or its functions or the terms upon and subject to which the individual holds or held that office or occupies or occupied that position or anything written or recorded in any form by the individual in the course of and for the purpose of the performance of those functions.
These exclusions intend, in essence, to ensure that section 37 cannot be used to exempt the identity of a public servant in the context of the particular position held or any records created by the staff member while carrying out his or her official functions, or information relating to the terms conditions and functions of positions. They do not deprive public servants of the right to privacy generally.
The body says that section 37 has been relied on to protect the personal information of staff who have been party to a PD or complaint process. It says that details identifying public servants about whom allegations were made are not of a sort that is captured by the exclusions in section 2.
In addition to her general comments as already set out, the applicant says that the level of information being withheld, and the reasons for so doing, are unacceptable.
Given the requirements of section 25(3) and the circumstances of this case, I must limit my description of the withheld details. However, I am satisfied that they fall under various categories of what must be considered to be the personal information of identifiable individuals and that they are not captured by the exclusions in section 2. Furthermore, I am satisfied that even without names, individuals would be identifiable from the context and content of the remaining details.
A small amount of the information concerned relates solely to parties other than the applicant. However, the majority comprises personal information relating to other individuals which is inextricably linked to personal information relating to the applicant (joint personal information). Section 37(7) provides that, notwithstanding section 37(2)(a) (see below), access to a record shall be refused where access to it would, in addition to involving the disclosure of personal information relating to the requester, also involve the disclosure of personal information relating to an individual or individuals other than the requester.
I find that the remaining withheld records and parts of records are exempt under section 37(1) of the FOI Act. This is subject to the consideration of sections 37(2) and (5), however.
Section 37(2) - exceptions to section 37(1)
Section 37(2) of the FOI Act sets out certain circumstances in which 37(1) does not apply. Section 37(2)(a) provides for the grant of access to personal information relating to the requester. Noting the details released by the body in this case, I am satisfied that no further information falls for release further to this provision of the FOI Act. I have already outlined the provisions of section 37(7). While most of the withheld details comprise joint personal information, as outlined above, I do not consider that personal information relating to the applicant can be separated from that of other individuals. I am satisfied that the remaining circumstances set out in section 37(2) do not arise.
Section 37(5)(a) - the public interest
In considering section 37(5), I consider that only section 37(5)(a) is relevant in this case. This section provides that a request that would fall to be refused under section 37(1) may still be granted where, on balance, the public interest that the request should be granted outweighs the public interest that the right to privacy of the individuals to whom the information relates should be upheld.
When considering the public interest, it is important to have regard to the comments of the Supreme Court in The Governors and Guardians of the Hospital for the Relief of Poor Lying-In Women v. the Information Commissioner [2011] IESC 26 ("the Rotunda case"). It is noted that a true public interest should be distinguished from a private interest.
On the matter of the type of public interest factors that might be considered in support of the release of the information at issue in this case, I have had regard to the findings of the Supreme Court in The Minister for Communications, Energy and Natural Resources v The Information Commissioner & Ors [2020] IESC 5. In her judgment, Baker J. indicated that the public interest in favour of disclosure cannot be the same public interest as that broadly stated in the Act. She said the public interest in disclosure must be something more than the general public interest in disclosure and the reason must be found from the scrutiny of the contents of the record. She said there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure.
While the comments of the Supreme Court in both judgments cited above were made in relation to provisions of the FOI Act other than section 37, I consider them to be relevant to the consideration of public interest tests generally.
Both the language of section 37 and the Long Title to the FOI Act recognise a very strong public interest in protecting the right to privacy (which has a Constitutional dimension, as one of the un-enumerated personal rights under the Constitution). Unlike other public interest tests provided for in the FOI Act, there is also a discretionary element to section 37(5)(a), which is a further indication of the very strong public interest in the right to privacy. Privacy rights will therefore be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy. It is also relevant to note that the release of records under FOI is, in effect, regarded as release to the world at large given that the Act places no constraints on the uses to which the information contained in those records may be put.
The body’s decisions outline various public interests in favour of releasing the records, including promoting openness as to how it performs its functions. However, it says that these are outweighed by the significant public interest in protecting the right to privacy.
Having regard to the applicant’s arguments as set out earlier, I accept that the disclosure of the details would give her some further insight into matters regarding her PD. However, this does not mean that there should be no protection of privacy rights of other individuals, including other public servants. Furthermore, I do not believe it is appropriate for me to direct the release in the public interest of third party personal information, effectively to the world at large, on the basis that the applicant may be dissatisfied with the actions of the body or particular individuals. Neither, as already stated, do I have any remit to consider, or make findings on, those actions.
It seems to me the body’s release of certain records in full and in part attempts to strike a balance between the competing interests. I am satisfied that placing the withheld details in the public domain would significantly breach the rights to privacy of identifiable individuals other than the applicant. Having regard to the nature of the specific information at issue, I am aware of no public interest factors in favour of its release that, on balance, outweigh the right to privacy of the individuals to whom the information relates. I find, therefore, that section 37(5)(a) does not apply.
Having carried out a review under section 22(2) of the FOI Act, I hereby affirm the body’s decision, on the basis that sections 32(1)(c) and 37(1) of the FOI Act apply to the withheld details.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Anne Lyons, investigator