Decision
Ms N and Office of the Revenue Commissioners
From Office of the Information Commissioner (OIC)
Case number: OIC-122344-W5K8H5
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-122344-W5K8H5
Published on
Whether Revenue was justified in refusing access to records relating to the names of staff members who had accessed the applicant’s personal data or details on Revenue’s systems on the basis of sections 30 and 37 of the FOI Act
10 November 2022
In a request dated 27 January 2022, the applicant sought access to the names of staff members who had accessed her personal data/details on Revenue’s systems from 1 January 2010 to date. On 4 March 2022, Revenue relied on sections 30(1)(a) and 30(1)(b) of the FOI Act to refuse the applicant’s request in full.
On 7 March 2022, the applicant made an internal review request. On 29 March 2022, the internal reviewer affirmed Revenue’s original decision to refuse the request, relying on section 37(1) of the FOI Act as well as the exemptions cited above.
On 21 April 2022, the applicant applied to this Office for a review of Revenue’s decision.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the applicant’s comments in her application for review and to the submissions made by the FOI body in support of its decision. I have also had regard to the contents of the records concerned. I have decided to conclude this review by way of a formal, binding decision.
This review is solely concerned with whether Revenue was justified in refusing the applicant’s request on the basis of sections 30 and 37 of the FOI Act.
I note that in her application for review to this Office, the applicant stated that she felt that her “personal data has been compromised”. It is important to note, as a preliminary matter, that this Office has no remit to investigate complaints, to adjudicate on how FOI bodies perform their functions generally, or to act as an alternative dispute resolution mechanism with respect to actions taken by FOI bodies. In any event, I understand that this matter has been followed up by Revenue with the applicant directly.
Section 13(4) of the FOI Act provides that in deciding whether to grant or refuse a request, any reason that the requester gives for the request shall be disregarded. This means that this Office cannot have regard to the applicant's motives for seeking access to the records in question, except in so far as those motives reflect what might be regarded as public interest factors in favour of release of the records where the Act requires a consideration of the public interest.
The records concerned
The FOI Act provides for a right of access to records held by an FOI body. Requests for information or for answers to questions, as opposed to requests for records, are not valid requests under the Act, except to the extent that a request for information or for an answer to a question can reasonably be inferred to be a request for a record containing the information or answer sought. The FOI Act does not require FOI bodies to create a record if none exists, apart from a specific requirement to extract records or existing information held on electronic devices, in accordance with section 17(4) of the Act.
Under section 17(4), where a request relates to data contained in more than one record held on an electronic device by the body concerned, the body must take reasonable steps to search for and extract the records to which the request relates. The reasonable steps are those that involve the use of any facility for electronic search or extraction that existed on the date of the request and was ordinarily used by the FOI body. Where these reasonable steps result in the creation of a new record, that record is, for the purposes of considering whether or not such a new record should be disclosed in response to the request, deemed to have been created on the date of receipt of the request.
In this case, the applicant sought records containing the names of the staff members who accessed her information on Revenue’s systems. Revenue extracted this information from its IT system in the form of five audit logs (records 1-5) from its relevant IT systems, in line with the provisions of section 17(4)(a).
Records 1, 2, 3 and 4 show the date and time the applicant’s file was accessed, the staff member’s username and full name, the relevant Revenue division, the customer’s ID code and various machine codes. Record 5 shows the date and time of access and an ID code.
Section 37
Revenue has relied on sections 30 and 37 to refuse access to the records at issue. Having regard to the nature of the information sought, it seems to me that section 37 is the most relevant and I will consider the applicability of that exemption in the first instance.
Section 37(1) provides for the mandatory refusal of access to a record if it would involve the disclosure of personal information of parties other than the requester. Section 37(1) is subject to the other provisions of section 37.
Section 2 of the FOI Act defines "personal information" as information about an identifiable individual which would, "in the ordinary course of events, be known only to the individual or members of the family, or friends, of the individual", or is held by an FOI body on the understanding that it would be treated as confidential. It goes on to list 14 specific categories of information that comprise personal information. Of these, the following categories are of relevance to the present case: (iii) information relating to the employment or employment history of the individual; (v) information relating to an individual in a record falling within section 11(6)(a) (that is, a personnel record) and (ix) a number letter, symbol, word, mark or other thing assigned to the individual by an FOI body for the purpose of identification or any mark or other thing used for that purpose.
In addition, Paragraph (I) of section 2 of the Act excludes certain information from the definition of personal information, including "... in a case where the individual… occupies or occupied a position as a member of the staff, of a public body, the name of the individual or information relating to the… position or its functions or the terms upon and subject to which the individual… occupies or occupied that position or anything written or recorded in any form by the individual in the course of and for the purpose of the performance of the functions aforesaid ...".
The exclusion at (I) does not provide for the exclusion of all information relating to such staff members. The Commissioner takes the view that this exclusion is intended to ensure that section 37 will not be used to exempt the identity of a staff member in an FOI body in the context of the particular position held or any records created by the staff member while carrying out his or her official functions. However, he also takes the view that the exclusion to the definition of personal information at (I) does not deprive staff members in FOI bodies of the right to privacy generally.
The FOI request in this case was quite specific, in that it sought access to the names of staff members who had accessed the applicant’s details. I note that, in her application to this Office, the applicant stated that she felt as though her “personal data had been compromised”. My understanding is that she was of the view that there was some kind of unauthorised access to her file by Revenue staff. I also understand that the applicant has since made a complaint under data protection legislation to Revenue relating to these matters.
In its internal review decision, Revenue stated that the records contained the personal information of individuals other than the requester, i.e. its staff members. I understand that the data protection complaint is being investigated by Revenue. In the context of the creation of the records concerned, and bearing in mind that an allegation of misconduct has essentially been made against any staff member listed in the records I am satisfied that the information in the records relating to Revenue staff members relates to the various individuals’ employment or employment history; and/or relates to a personnel record. While section 2 of the Act provides an exception to the definition of personal information where the individual is a staff member of a public body, I am satisfied, given the circumstances of this case, that the exceptions do not apply in this instance.
Accordingly, I find that section 37(1) applies in the case of all five records. The effect of section 37(1) is that a record disclosing personal information of a third party or third parties cannot be released to another person unless one of the other relevant provisions of section 37 applies - in this case section 37(2) or 37(5).
There are some circumstances, provided for at section 37(2) of the FOI Act, in which the exemption at section 37(1) does not apply. I am satisfied that none of the circumstances identified arise in this case. That is, the information concerned does not solely relate to the applicant; the staff members have not consented to the release of their information; the information is not of a kind that is available to the general public; the information is not of a class of information which would or might be made available to the general public; and the disclosure of the information is not necessary in order to avoid a serious and imminent danger to the life or health of an individual. Consequently, I find that section 37(2) does not apply to the records at issue here.
Section 37(5) of the FOI Act provides that a request which would fall to be refused under section 37(1), may still be granted where, on balance, (a) the public interest that the request should be granted outweighs the public interest that the right to privacy of the individual(s) to whom the information relates should be upheld, or (b) the grant of the request would benefit the individual(s) concerned. In my view the grant of the request would not benefit the individuals to whom the information relates. I am satisfied that section 37(5)(b) does not apply in this case.
This leaves me to consider, under section 37(5)(a), whether the public interest in granting the request outweighs, on balance, the public interest in upholding the privacy rights of the individuals concerned.
S37 public interest
Section 37(5) provides that a request that would fall to be refused under section 37(1) may still be granted where, on balance, (a) the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or (b) the grant of the information would be to the benefit of the person to whom the information relates. Neither party has argued that the release of the information at issue in this case would be to the benefit of the individuals to whom the information relates. In the circumstances of this case, I am satisfied that section 37(5)(b) does not apply.
In relation to the applicability of section 37(5)(a), in carrying out any review this Office has regard to the general principles of openness and transparency set out in section 11(3) of the FOI Act. Section 11(3) provides that an FOI body must have regard to the need to achieve greater openness in the activities of FOI bodies and to promote adherence by them to the principles of transparency in government and public affairs and the need to strengthen the accountability and improve the quality of decision making of FOI bodies. It is important to note that in The Minister for Communications, Energy and Natural Resources and the Information Commissioner & Ors [2020] IESC 57, the Supreme Court found that a general principle of openness does not suffice to direct release of records in the public interest and “there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure”. Although the Court’s comments were made in cases involving confidentiality and commercial sensitivity, I consider them to be relevant to the consideration of public interest tests generally.
In relation to the issue of the public interest, it is also important to have regard to the comments of the Supreme Court in The Governors and Guardians of the Hospital for the Relief of Poor Lying-In Women v. the Information Commissioner [2011] IESC 26. It is noted that a true public interest should be distinguished from a private interest.
The FOI Act recognises the public interest in the protection of the right to privacy both in the language of section 37 and the Long Title to the Act (which makes clear that the release of records under FOI must be consistent with the right to privacy). It is also worth noting that the right to privacy has a constitutional dimension, as one of the unenumerated personal rights under the Constitution. Moreover, unlike other public interest tests provided for in the FOI Act, there is a discretionary element to section 37(5)(a), which is a further indication of the very strong public interest in the right to privacy. Privacy rights will therefore be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy.
In considering where the balance of the public interest lies in this case, it is important to note that the release of records under FOI is regarded, in effect, as release to the world at large, given that the Act places no constraints on the uses to which a record released under the Act may be put. I accept that there is a public interest in ensuring that Revenue ensures that only authorised staff can access the personal details of taxpayers. However, it seems to me that the release of the records sought in this case would not necessarily shed much light on whether adequate measures were in place, as the records themselves do not indicate why a particular individual had accessed the applicant’s file or whether they were properly authorised to do so. Furthermore, it also seems to me that the release of the audit logs concerned might inadvertently reveal more information about Revenue’s internal procedures and processes than intended. In any event, having regard to the context and content of the records concerned, I have not been able to identify any sufficiently specific, cogent and fact-based reason for finding that the public interest that the request should be granted outweighs the right to privacy of the individuals to whom the information relates. I find, therefore, that section 37(5)(a) does not apply.
As I have found section 37(1) to apply to the records concerned, I do not need to consider the application of section 30.
Having carried out a review under section 22(2) of the FOI Act, I hereby affirm Revenue’s decision. I find that Revenue was justified in refusing to grant access to the records sought on the basis of section 37(1) of the FOI Act, and that the public interest, on balance, did not favour their release.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Sandra Murdiff, Investigator