Decision
Ms A and Health Service Executive
From Office of the Information Commissioner (OIC)
Case number: OIC-147510-Y5G6R1
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-147510-Y5G6R1
Published on
Whether the HSE was justified in refusing access to information in records relating to the applicant on the basis of section 37(1) and in refusing access to further records on the basis that they do not exist or cannot be found
18 November 2024
In a request dated 7 September 2023, the applicant, a HSE employee, sought access to information/records relating to her, both in paper and electronic format, within a specified Mental Health service from 2017 to the date of the request. She referenced eight named HSE staff members. She specified that the named staff members would not have been directly involved with her consistently since 2017, so she “would envision that the emails being requested would be more periodical”. She further specified that she was not requesting rosters, COVID-19 information, HSE circulars or policy/procedure updates.
On 18 September 2024, the HSE wrote to the applicant and outlined its understanding of her request. It said that it understood that she was “seeking direct peer to peer correspondence between the aforementioned staff members that meets the scope” of her request. The HSE asked that the applicant inform the body if there was an error in its understanding of the scope of her request or if the applicant would like to correct any detail. On 25 September 2024, the applicant responded to the HSE. She said that she was writing to clarify the scope of her request. She stated that she was seeking “direct peer to peer correspondence”, “correspondence sent by these staff members to other HSE personnel, ER, IR or vice versa” and “attachments sent by these staff members to any other HSE personnel, ER, IR, or vice versa, and also including undersigned personal time sheets returns”.
I understand that the HSE sought an extension of time to process the request on 4 October 2024. On 7 November 2023, the applicant wrote to the HSE noting the earlier extension and stating that the request was now overdue. She said that the lack of correspondence and the HSE’s non-adherence to its FOI policy was causing her undue stress. She asked that the HSE engage with her in a meaningful way as per FOI guidelines and her legal right under FOI. On 8 November 2023, the HSE responded and apologised for the delay in getting the documents to her in a timely manner. It said that, regrettably, there were delays in receiving some portions of the records. It said that it was also processing an extremely high volume of requests. It updated the applicant in respect of the parts of the request completed, referencing five named staff members. It said that it was working on completing email files in respect of two other named staff members.
In a decision dated 9 November 2023, the HSE part-granted access to the records identified. It referenced seven email files which were “ready for release”. It said that access to some of the records was being refused on the basis of section 37(1) of the FOI Act. It said that the documents exempted under that section contained personal information relating to third parties.
It said that one of the named staff members was on extended leave meaning that the HSE had no access to the emails being sought. It said that it consulted with the HSE ICT department in respect of the feasibility of accessing the staff member’s emails and that it was determined that the only option was for an external company to undertake a search of the backup tapes, referring to this as eDiscovery. It said that each month a new backup tape is generated for HSE emails and that, given the scope of the applicant’s request, this would equate to 72 tapes. It said that the service costs 500 euro per tape which would need to be paid by the requester upfront before a purchase order was raised. It said that this cost would obviously be an excessive amount for either the service or the applicant to pay. It said that while it acknowledged that there were in all likelihood documents relevant to her request, it could not provide them at this time.
On 1 December 2024, the applicant sought an internal review of the HSE’s decision. She stated that she was seeking a review of “information received and information not received that I have an awareness of”. She sought further information in respect of the eDiscovery process referenced. She then listed five of the named staff members and referenced particular emails and other records which were not provided.
The HSE did not issue an internal review decision. On 11 January 2024, the applicant applied to this Office in respect of the FOI body’s failure to respond to her internal review request. This Office sought an effective position from the HSE in respect of the request. On 29 January 2024, the HSE issued its effective position and upheld its original decision. On 19 March 2024, the applicant applied to this Office for a review of the HSE’s decision.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the submissions made by the applicant and the HSE. I have also examined the records at issue. I have decided to conclude this review by way of a formal, binding decision.
The HSE identified 572 pages of records as coming within the scope of the request. The records comprise email correspondence held by seven of the HSE staff members referenced in the applicant’s request. The FOI body granted access in full to 497 pages of records. It part-granted access to 73 pages on the basis of section 37(1) of the FOI Act. It refused access in full to two pages of records on the same basis.
In her application to this Office, the applicant referenced the submissions she made in her request for an internal review. She said that she does not accept the HSE’s position. In further communications with this Office, the applicant confirmed that she is seeking a review of the HSE’s reliance on section 37 in respect of the records part-released and refused in full. She also confirmed that it is her position that further records exist which have not been identified by the HSE. As such, this review also concerns section 15(1)(a) of the FOI Act which provides that a request for access to a record may be refused if the record does not exist or cannot be found after all reasonable steps to ascertain its whereabouts have been taken.
Accordingly, this review is concerned with (i) whether the HSE was justified in refusing access to certain information and records on the basis of section 37(1) and (ii) whether it was justified in refusing access to any further relevant records other than those identified on the basis that no further relevant records exist or can be found after all reasonable steps have been taken to ascertain their whereabouts.
Before I address the substantive issues arising, I wish to make a number of preliminary comments, in particular in respect of the HSE’s processing of the applicant’s request. While FOI bodies are entitled to extend the time period for consideration of a request under section 14 of the Act in certain limited circumstances, the applicant experienced further delays in her dealings with the HSE. Furthermore, I note that an internal review decision was not issued. This Office had to engage with the FOI body in order to ensure an effective position was issued. The correspondence which subsequently issued merely stated that the HSE was upholding its original decision. As noted by the applicant, the HSE did not engage with the submissions and questions raised in her request for an internal review. The HSE’s processing of the applicant’s request fell short of the required standards and was unsatisfactory. While I fully accept that the HSE has to make difficult decisions in terms of the allocation of scarce resources, the administration of the FOI Act is a statutory function which should be afforded as much weight as any other such function. I expect the HSE to have regard to my comments and ensure compliance with the relevant statutory requirements set out in the Act.
More generally, although I am obliged to give reasons for my decision, section 25(3) of the FOI Act requires me to take all reasonable precautions in the course of a review to prevent the disclosure of information contained in an exempt record. This means that the extent to which I can describe the contents of the records is limited.
It is also important to note that a review by this Office is considered to be “de novo”, which means that in this case, it is based on the circumstances and the law as they pertain at the time of the decision and is not confined to the basis upon which the FOI body reached its decision.
Finally, I note that in her request for an internal review, the applicant referenced having official information relating to her amended where it is incomplete, incorrect or misleading and being given reasons for decisions affecting her. The amendment of records relating to personal information and access to information regarding acts of FOI bodies are distinct rights under sections 9 and 10 of the FOI Act. Applications under those sections are separate to requests for access to records under section 11. The applicant has been informed that such queries are therefore beyond the scope of this review, which concerns her original request for access to records.
Section 15(1)(a) of the Act provides for the refusal of a request where the records sought do not exist or cannot be found after all reasonable steps to ascertain their whereabouts have been taken. The role of this Office in a case such as this is to review the decision of the FOI body and decide whether that decision was justified. This means that I must have regard to the evidence available to the decision maker and the reasoning used by the decision maker in arriving at their decision. I must also assess the adequacy of the searches conducted by the FOI body in looking for relevant records.
The evidence in “search” cases generally consists of the steps actually taken to search for records along with miscellaneous and other information about the record management practices of the FOI body, insofar as those practices relate to the records in question. It is important to note that the FOI Act does not require absolute certainty as to the existence or location of records, as situations can and do arise where records are not created, are lost or simply cannot be found. Moreover, the Act is concerned with access to records that a public body holds as opposed to records that a requester considers ought to exist.
As noted above, in her request for an internal review, the applicant sought further information in respect of the HSE’s reference to the eDiscovery process and referenced further records which she said exist but which were not identified. I do not propose to outline the specific details included in her correspondence, though I note that I have had regard to same and have brought the submissions to the attention of the HSE. In the circumstances, this Office asked the FOI body to provide submissions detailing the steps taken to search for records. Specific queries were raised in respect of the HSE’s position in relation to the records of a named staff member on leave and the eDiscovery process.
In its submissions, the HSE first addressed that matter. It said that it had previously been informed that the eDiscovery mechanism mentioned in its decision letter was the only suitable mechanism to access the staff member’s emails. It said that in preparing its submissions to this Office, it again sought advice from the HSE ICT department which has informed it of another mechanism for gaining access. The HSE said that the relevant forms have been completed by the Head of Service and the Human Resources department and have been forwarded to the ICT department. It said that as of the date of its submission, 12 November 2024, it has been informed of a technical issue that may delay the gaining of access to the staff member’s account. It said that in the last year the HSE has undertaken a migration of email accounts from local HSE regional servers to a national mail server. The account of the staff member in question is still hosted on a regional server. It said that ICT are prioritising the migration of the account and will then prioritise granting access to the relevant office.
In respect of section 15(1)(a) more generally, the HSE said that as the relevant searches were carried out some time ago, it regrettably does not feel that it is in a position to property justify the adequacy of its searches. It said that the vast majority of FOI requests processed by the Office are in respect of patient healthcare records. It said that this request is one of the very first requests wherein it had to search emails. It said that as a consequence of same, the documentation in respect of its search methodology was not recorded adequately. The HSE said that it has since changed its methodology for recording searches of emails. It did say that the relevant staff members were given clear instructions in respect of the information being sought. It provided this Office with a sample extract from a letter sent to a named staff member. However, in light of the issues identified in respect of the records of the staff member on leave and the adequacy of searches, the HSE respectfully suggested that it may be desirable for all parties if it considered the request afresh.
Having considered the submissions received by the HSE and in light of its revised position in respect of the records of the staff member on leave, I am not satisfied that its effective decision to refuse access to further records under section 15(1)(a) was justified. While noting that the HSE has already identified and granted access to a significant number of records coming within the scope of the request, the applicant’s position is that further records exist. She referenced specific records in her communications with the HSE. The HSE has acknowledged that it is unable to provide the assurances required to demonstrate that all reasonable steps were taken to search for the records. It has also revised its position in respect of records which it originally said it could not access without the involvement of an external company at considerable cost. In light of the submissions received, I am evidently not in a position to find that the HSE has taken reasonable steps to locate all relevant records. I find that the FOI body was not justified in refusing, under section 15(1)(a), access to any further records on the basis that they do not exist or cannot be found after all reasonable steps have been taken.
In the circumstances, I consider that the most appropriate course of action to take is to annul the HSE’s effective reliance on section 15(1)(a) to refuse access to any further relevant records and to direct it to make a fresh decision on the matter in accordance with the provisions of the FOI Act. In making its decision, I would direct the HSE to the submissions made by the applicant in her request for an internal review.
Section 37(1) of the FOI Act provides that, subject to the other provisions of the section, an FOI body shall refuse a request if access to the record concerned would involve the disclosure of personal information. This does not apply where the information involved relates to the requester (section 37(2)(a) refers). However, section 37(7) provides that, notwithstanding section 37(2)(a), an FOI body shall refuse to grant a request if access to the record concerned would, in addition to involving the disclosure of personal information relating to the requester, also involve the disclosure of personal information relating to an individual or individuals other than the requester (commonly known as joint personal information).
Section 2 of the FOI Act defines personal information as information about an identifiable individual that, either (a) would, in the ordinary course of events, be known only to the individual or members of the family, or friends, of the individual, or (b) is held by an FOI body on the understanding that it would be treated by that body as confidential. Section 2 goes on to specify 14 categories of information which, without prejudice to the generality of the above definition, constitute personal information.
Certain information is excluded from the definition of personal information. Paragraph (I) provides that where an individual is a member of staff of an FOI body, personal information does not include the name of the individual, or information relating to the position held or its functions, or the terms upon and subject to which the individual occupies or occupied that position, or anything written or recorded in any form by the individual in the course of and for the purpose of the performance of the functions of the position.
The exclusion at paragraph (I) does not provide for the exclusion of all information relating to such directors, staff or office holders. This Office considers that the exclusion is intended to ensure that section 37 will not be used to exempt the identity of a staff member or director of, or office/position holder in, an FOI body in the context of the particular position held or any records created by the staff member, director or office/position holder while carrying out his or her official functions. The exclusion does not deprive such individuals of the right to privacy generally.
As noted above, the HSE has relied on section 37(1) in support of its decision to withhold certain information from 73 pages of records and to refuse access in full to two pages. In its submissions, the HSE said the records identified contain personal information relating to third parties. It said that such information includes patient details, information relating to third party COVID-19 close contacts, and certain information relating to staff members and their employment.
In respect of information relating to patients and other third parties, the HSE said that it was satisfied that such information met the definition of personal information in section 2. In respect of staff details, the HSE acknowledged that the applicant may have been aware of some staffing changes and transfers as part of her duties within the service. However, it said that it must consider the fact that release under FOI is considered to be to the world at large. It said that such information would not be known to the world at large and would be considered personal to the individual concerned as it relates to their employment. It additionally noted that the information arguably does not meet the scope of the applicant’s request as it does not specifically relate to her. The HSE said that as it did not have the permission of the third parties referenced in the records to release their data, the information in question was withheld.
I have considered the contents of the records and the information withheld on the basis of section 37. I am satisfied that the information at issue comprises personal information relating to identifiable individuals other than the applicant. While the information is included in records which relate to the applicant, the information itself relates to other individuals. As evidenced by the HSE’s redactions, the majority of the information at issue can be sufficiently separated from other information in the records, which the HSE has released. In respect of the information relating to staff of the HSE which has been withheld, I am satisfied that such information relates to what could be termed personnel-type matters. The information is not, in my view, of a type that is captured by the exclusion to the definition of personal information. It seems to me that staff members of an FOI body are entitled to expect that such information is held by the body on the understanding that it will be treated as confidential and that it will not be disseminated widely, potentially to the world at large. I am satisfied that the disclosure of the information would involve the disclosure of personal information relating to the staff members in question.
Accordingly, I find that section 37(1) of the Act applies to the records and information withheld by the HSE on that basis. However, that is not the end of the matter as section 37(1) is subject to the other provisions of section 37.
Section 37(2) provides that section 37(1) does not apply in certain circumstances. In particular, subsection (a) provides that section 37(1) does not apply if the information concerned relates to the requester concerned. I am satisfied that the information at issue, while contained in records relating to the requester, relates to other individuals. I am therefore satisfied that section 37(2)(a) does not disapply section 37(1). I am further satisfied that no circumstances arise such that any of the other subsections of section 37(2) apply.
Section 37(5) provides that a request that would fall to be refused under section 37(1) may still be granted where, on balance (a) the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or (b) the grant of the information would be to the benefit of the person to whom the information relates. There is no evidence to suggest that the individuals to whom the information relates would benefit from its release and I find that section 37(5)(b) does not apply in this case.
Before I consider the applicability of section 37(5)(a), I wish to note a number of points. Firstly, section 13(4) provides that, subject to the Act, in deciding whether to grant or refuse an FOI request, any reason that the requester gives for the request and any belief or opinion of the FOI body as to the reasons for the request shall be disregarded. In relation to the question of the public interest, this means that I cannot have regard to the applicant's motives for seeking access to the records at issue, except in so far as those motives reflect what might be regarded as true public interest factors in favour of release of the records, for example where matters raised in relation to the request may also be regarded as matters of general concern to the wider public.
Secondly, as noted previously, release of records under the FOI Act must be regarded, in effect, as release to the world at large, given that the Act places no constraints on the uses to which a record released under the Act can be put. With certain limited exceptions provided for under the Act, which do not apply in this case, records are not released under FOI for any limited or restricted purpose. All of this means that in considering whether a right of access exists to records under section 37(5)(a) of the Act, any decision to grant access would be on the basis that there is an overriding public interest in the release of the records effectively to the world at large that outweighs the privacy rights of the third party individuals concerned.
On the matter of whether the public interest in granting access to the information at issue would, on balance, outweigh the privacy rights of the individuals concerned, I have had regard to the comments of the Supreme Court in The Governors and Guardians of the Hospital for the Relief of Poor Lying-In Women v. The Information Commissioner [2011] 1 I.R. 729, [2011] IESC 26) (“the Rotunda case”). In this regard, I note that a public interest should be distinguished from a private interest.
In considering where the balance of the public interest lies in this case, I have had regard to section 11(3) of the Act which provides that in performing any functions under the Act, an FOI body must have regard to, among other things, the need to achieve greater openness in the activities of FOI bodies and to promote adherence by them to the principles of transparency in government and public affairs and the need to strengthen the accountability and improve the quality of decision making of FOI bodies. However, in doing so, I have also had regard to the judgment of the Supreme Court in The Minister for Communications, Energy and Natural Resources and the Information Commissioner & Ors [2020] IESC 57 (“the Enet case”). In that case, the Supreme Court found that a general principle of openness does not suffice to direct release of records in the public interest and “there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure”. Although the Court’s comments were made in cases involving confidentiality and commercial sensitivity, I consider them to be relevant to the consideration of public interest tests generally.
In its submissions, the HSE identified various public interests served by the release of the information, as well as those served by withholding same. In favour of releasing the record, it referenced the public interest in knowing how a public body performs its functions, in members of the public knowing what information public bodies hold about them, and in members of the public exercising their rights under the FOI Act. In favour of refusal, it referenced the public interest in protecting the right to privacy, in members of the public being able to communicate in confidence with public bodies without fear of disclosure in relation to personal and sensitive matters, in public bodies being able to perform their functions effectively, and in safeguarding the flow of information to public bodies. It said that based on the above, it was decided that the public interest in preserving the privacy of the relevant third parties outweighed the public interest that would be served by the release of the information to the applicant.
The applicant has not made specific submissions to this Office in respect of the public interest test at section 37. Her application to this Office referenced her internal review request and stated that she does not accept the HSE’s position. Her internal review request centred on records which had not been identified by the FOI body. I cannot identify any public interest argument inherent in those submissions which relates to the release of personal information about other individuals, nor is any such argument evident to me from a consideration of the withheld information. While I accept that the applicant has an interest in being able to access information relating to her which is held by the FOI body, I am not satisfied that release of the limited information withheld from the records would sufficiently engage that general public interest such that release is justified.
On the other hand, the FOI Act recognises the public interest in the protection of the right to privacy both in the language of section 37 and the Long Title to the Act (which makes clear that the release of records under FOI must be consistent with the right to privacy). It is also worth noting that the right to privacy has a constitutional dimension, as one of the unenumerated personal rights under the Constitution. Privacy rights will therefore be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy. Moreover, even where an overriding public interest in granting the request exists, there is a discretionary element to the application of section 37(5)(a).
I have considered the records at issue and the submissions received. I would note that in the vast majority of records, the HSE has redacted certain personal information therein but has released the remainder of the record. It seems to me that by doing so the FOI body sought to release as much information as possible to the applicant. Given the strong public interest in protecting the right to privacy, I am not aware of any public interest in release of the withheld information which would serve to outweigh the right to privacy of the individuals to whom it relates. I find, therefore, that section 37(5)(a) does not apply. Accordingly, I find that the HSE was justified in refusing access to the information at issue on the basis of section 37(1) of the FOI Act.
Having carried out a review under section 22(2) of the FOI Act, I hereby vary the HSE’s decision. I find that it was justified in refusing access to information withheld from the records on the basis of section 37(1) of the FOI Act. I find that it was not justified in its effective reliance on section 15(1)(a) in respect of any further records which may exist. I annul the decision of the HSE to refuse access to any further records and direct it to consider this aspect afresh.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Alison Connolly
Investigator