Decision
Mr X and Health Protection Surveillance Centre
From Office of the Information Commissioner (OIC)
Case number: OIC-129525-B1W0T1
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-129525-B1W0T1
Published on
Whether the HPSC was justified in refusing access to a record relating to the vaccination status of patients on ICU wards under sections 15(1)(a) and 17(4) of the FOI Act
6 March 2023
On 21 April 2022, the applicant made an FOI request to the HPSC requesting records relating to the vaccination status of patients on “admissions and death, leaving/entering ICU” from 1 January 2022 to 31 March 2022. The applicant provided examples of the types of information he sought including a link to a report previously published by the HPSC/the HSE.
On 17 May 2022, the HPSC refused the applicant’s request under section 15(1)(f) of the FOI Act as it intended to publish the record within six weeks. On 16 June 2022, the applicant requested an internal review of this decision.
On 8 July 2022, the HPSC refused his request under section 15(1)(a) of the FOI Act on the grounds that the record sought did not exist. The HPSC also noted that the FOI Act does not require public bodies to create records if none exist under section 17(4) of the FOI Act. On 6 October 2022, the applicant applied to this Office for a review of the HPSC’s decision. In his correspondence with this Office the applicant indicated that he would accept the data in its “raw form and compile [the report himself]”.
During the course of this review, the HPSC generated a record containing some of the information sought by the applicant, which it provided to him. Additionally, during the course of the review the Investigating Officer provided the applicant with details of the HPSC’s submissions wherein it outlined its reasons for concluding that additional records relating to his request do not exist. The applicant was invited to make further submissions on the matter, which he duly did.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the submissions made by the applicant, and by the HPSC in support of its decision. I have also had regard to the record released by the HPSC during the review. I have decided to conclude this review by way of a formal, binding decision.
This review is concerned solely with whether the HPSC was justified in refusing, under section 15(1)(a) of the Act, to release additional records relating to the applicant’s request for information relating to the vaccination status of individuals admitted to the ICU during the period from 1 January 2022 to 31 March 2022.
For the benefit of the applicant, I wish to explain that while the purpose of the Act is to enable members of the public to obtain access to information held by public bodies, the mechanism for doing so is by accessing records held by those bodies. In other words, a person wishing to obtain information from a public body must make a request for records that contain the information sought. Requests for information, as opposed to requests for records, are not valid requests under the Act, except to the extent that a request for information can reasonably be inferred to be a request for a record containing the information sought.
Secondly, I note that during the course of the review the applicant expressed dissatisfaction with the time being taken by the public body to generate and/or publish the report he sought, as to date the report has still not been published. It is important to note that this Office has no role in examining the administrative actions of FOI bodies in the performance of their functions. Our role is confined to reviewing the decision taken on the applicant’s FOI request.
Section 15(1)(a) of the FOI Act provides that a request for records may be refused if the records sought either do not exist or cannot be found after all reasonable steps to ascertain their whereabouts have been taken.
It is important to note that the Act does not require FOI bodies to create records if none exist, apart from a specific requirement, under section 17(4), to extract records or existing information held on electronic devices. Section 17(4) provides that where a request relates to data contained in one or more record held on an electronic device by the FOI body concerned, the body must take reasonable steps to search for and extract the records to which the request relates. Where these reasonable steps result in the creation of a new record, that record is, for the purposes of considering whether or not such a new record should be disclosed in response to the request, deemed to have been created on the date of receipt of the request. Section 17(4) defines reasonable steps as steps that involve the use of any facility for electronic search or extraction that existed on the date of the request and was ordinarily used by the FOI body.
If the body does not hold a record containing the information sought and cannot search for and extract the electronically held records by taking reasonable steps, it is entitled to refuse the request under section 15(1)(a) on the ground that the record sought does not exist. The question I must consider in this case, therefore, is whether the HPSC was justified in finding that it does not hold records containing the additional specific information sought and/or that it cannot search for and extract the relevant electronically held records by taking reasonable steps.
Submissions from the HPSC
In its submissions to this Office, the HPSC stated that the original decision maker refused the applicant’s request under section 15(1)(f) in the expectation that it would be available for publication within the relevant timeframe. The HPSC also stated that while the applicant’s internal review request was being processed, it was clear that the data would not be published within the 6-week time period, so the decision was varied to refuse the applicant’s request under section 15(1)(a).
The HPSC provided this Office with details of the electronic systems which hold information relating to the applicant’s request. It stated that the first system is the Computerised Infectious Disease Report system (CIDR), which it described as a centrally controlled system which collects epidemiological information relating to notifiable infectious diseases in Ireland such as COVID-19. It said that this system collects data relating to such matters as ICU admissions, exposures, symptoms and vaccination status. However, while the HPSC said that detailed data on vaccinations received may have been manually entered on CIDR for some cases during the relevant time period, its position is that this information was not routinely or consistently entered.
The HPSC said that the second system in use is the National Covid-19 Immunisation system (COVAX), which it described as an electronic dataset which records all COVID-19 vaccinations for all residents in the State. The HPSC stated that COVAX is the “definitive source of data” concerning COVID-19 vaccinations received and on the vaccination history of confirmed cases of COVID-19.
Essentially, the HPSC said that reports relating to the vaccination status of ICU patients are generated by way of patient data from CIDR being uploaded to COVAX, where it is cross-referenced and updated to include further information. This is then transferred back onto CIDR and, as I understand it, at that point reports such as those sought in this case can be generated. The HPSC stated that the process of transferring data from COVAX to CIDR was paused from the end of December 2021. I understand that this was due to its ICT systems not being suitable for the volume of cases involved. I note that the last report published by the HPSC on the vaccination status of ICU cases covered the period up to 4 December 2021. The HPSC stated that the cases logged on CIDR after mid-December 2021 were not matched or cross-referenced to COVAX and no resulting updated data was uploaded to CIDR.
While reports similar to that sought by the applicant in this case are available on the HPSC’s website, it has stated that they are not in the format requested. The HPSC also stated that CIDR does not hold data on some of the categories of information sought by the applicant. The HPSC’s position, essentially, is that no records relating to the applicant’s request were generated covering the relevant timeframe and that the information sought cannot currently be extracted and provided to the applicant.
As noted above, during the course of this review the applicant indicated that he would accept raw data in order to compile the report sought himself. The HPSC stated that the raw data contained on COVAX and CIDR could not be released as it would need to be processed and anonymised in order to remove personal information relating to identifiable patients. However, as also noted above, the HPSC provided a copy of a record to the applicant during this review which it said was generated using a pre-existing electronic dataset which had been extracted from CIDR for another purpose. It stated that this dataset was imported into statistical software and filtered before being released. The HPSC stated that this record contained information that fell within the scope of the applicant’s request but that a “significant portion” of the data was missing.
Essentially, while the HPSC did not dispute that it holds a lot of information relating to the applicant’s request in this case, its position is that it cannot currently generate the report sought using the ICT systems in use without building new reports or transferring data manually between COVAX and CIDR. The HPSC stated that manually transferring the data concerned between the two systems would take between “several weeks to a number of months” to complete. It also stated that a step of the process to generate the records relating to the applicant’s request was currently missing. It further stated that the level of analysis available on CIDR is “limited” and it also provided details of the steps required to export, filter and collate reports such as that sought by the applicant in this case.
The HPSC also stated that it is currently developing an ICT solution, which, once tested and implemented, will enable the transfer of data from COVAX to CIDR. It said that following the transfer and subsequent validation of the backlogged data, a report will be produced and made available on its website.
Analysis
As I have outlined above, the question I must consider is not whether the HPSC holds the information sought but (i) whether it holds a record or records containing the additional information sought by the applicant, and/or (ii) whether it can extract this information by using any facility for electronic search or extraction that existed on the date of the request and was ordinarily used by it.
I accept the HPSC’s submissions that a step in the process of generating the record is currently unavailable, that an ICT solution is currently under development and that extracting data from COVAX and manually entering it on to CIDR would require a significant amount of time. Additionally, I accept the HPSC’s submission that raw data cannot be released on the grounds that generating this record would require additional steps of extraction and analysis. Furthermore, while the HPSC has previously published similar reports, I have no reason to doubt its submissions that the entry, cross-referencing and collation of more complete data relating to these matters was paused. In any event, I am satisfied that the steps required to generate the report sought at this point are beyond the reasonable steps envisaged by section 17 (4) of the FOI Act, which, as I have explained, comprise steps that involve the use of any facility for electronic search or extraction that existed on the date of the request and was ordinarily used by the FOI body.
In the circumstances, I am satisfied that the HPSC was justified in finding that records containing all of the information sought by the applicant do not currently exist. I find, therefore, that the HPSC was justified in refusing the applicant’s request under section 15(1)(a) of the Act on the basis that the record does not exist.
Having carried out a review under section 22(2) of the FOI Act, I hereby affirm the HPSC’s decision in this case. I find that the HPSC was justified in refusing, under section 15(1)(a) of the Act, the applicant’s request for access to a record relating to the vaccination status of ICU patients on the basis that the record as sought does not exist.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Sandra Murdiff, investigator