Decision
Mr X and Health Service Executive
From Office of the Information Commissioner (OIC)
Case number: OIC-144344-D4R3W0
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-144344-D4R3W0
Published on
Whether the HSE was justified in refusing access, under section 15(1)(a) of the FOI Act, to certain records relating to a dignity at work complaint on the basis no further records exist and in refusing access to one record under section 31(1)(a)
6 August 2025
Following an exchange of correspondence between the parties, the applicant submitted a refined request to the HSE on 6 April 2023 for records relating to a dignity at work complaint. He sought copies of all records relating to him and to specified matters, for the period 30 November 2019 to the date of his request, and all correspondence from 30 November 2019 to 31 December 2020, sent to or received by a number of named individuals/sections relating to him and to the same specified matters. He said that in circumstances where it is clear to the parties concerned that a communication had been sent to him, there was no necessity to include such correspondence.
The HSE issued its decision on 4 May 2023, wherein it said it had decided to part-grant the request. Of the 16 records it identified as coming within the scope of the request, it released records 2 to 16 in full, as listed on the accompanying schedule, and refused access to record 1 under section 31(1)(a) on the basis of legal professional privilege. It said the email address of a named former staff member (‘Professor A’) had been decommissioned and no relevant records could be located. It said a search was also carried out in respect of the Clinical Director and that historic emails were lost due to a migration to another domain. It refused those parts of the request under section 15(1)(a) of the Act, on the ground that no relevant records were found.
The HSE further said that two named staff members had not provided a response and that other named staff members had not carried out searches as it would interfere with their clinical duties and commitments. It said it was refusing this part of the request under section 15(1)(c) of the Act.
Following a further exchange of correspondence, the applicant sought an internal review of the HSE’s decision on 15 June 2023. While he said he required an internal review in respect of the entire request, he said particular attention was required to five separate matters, as follows:
(1) the decision to refuse access to record 1 under section 31(1)(a);
(2) the decision to refuse access to records on the basis that the email account of Professor A had been decommissioned;
(3) the decision that no relevant records held by the Clinical Director could be found;
(4) the decision that three named individuals essentially did not have the time to comply with the request; and
(5) the decision that a named individual did not respond to the request for records.
The HSE issued its internal review decision on 12 September 2023. It affirmed the refusal of record 1 under section 31(1)(a). It affirmed the refusal of records held by Professor A under section 15(1)(a) on the basis that his email account had been decommissioned. It affirmed the refusal of records held by the Clinical Director under section 15(1)(a) on the ground that the records sought do not exist. In relation to the three staff members who had not carried out searches, it said searches had since been carried out and it refused access to any relevant records under section 15(1)(a) on the ground that no relevant records were found. It also said that the individual who did not previously respond to the request had since carried out searches and it was refusing that part of the request under section 15(1)(a) as no relevant records could be found.
On 1 December 2023, the applicant applied to this Office for a review of the HSE’s decision. He said he did not accept that the records of Professor A or the Clinical Director should be withheld. He said he did not accept that record 1 was privileged. He noted that the internal reviewer said that record 1 comprised advice relating to an “alleged letter” where the applicant was referenced and that a copy of the “alleged letter” was subsequently provided to him. He also said he wanted clarification as to which of the documents he received was that “alleged letter” and the subject of the advice. In the course of the review, the HSE provided the applicant with a copy of the “alleged letter”.
During the course of the review, the HSE provided submissions to this Office outlining the details of the searches conducted for certain relevant records and its reasons for concluding that the records cannot be found or do not exist. The applicant was provided with details of those submissions and invited to make further submissions, which he duly made.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the correspondence between the applicant and the HSE as set out above and to the communications between this Office and both parties on the matter. I have also had regard to the contents of the relevant records. I have decided to conclude this review by way of a formal, binding decision.
During the course of the review, this Office’s Investigator sought details of the correspondence that led to the issuing of record 1, which the HSE said was issued on foot of a request for legal advice and to which access was refused under section 31(1)(a). In response, the HSE provided this Office with an email thread which comprised five additional emails that had not been identified during the processing of the applicant’s request. It said that the emails are interactions between staff members, human resources and a HSE legal advisor seeking information and advices on an issue in relation to the management of a staff matter. It argued that the emails are exempt under section 30(1)(a) and 30(1)(b) of the FOI Act.
Having considered their contents, it seems to me that the additional five emails fall within the scope of the applicant’s request. It is not apparent to me why the HSE did not include those records in its decision. However, I do not consider it appropriate to simply direct the release of these records in circumstances where the HSE has subsequently argued that the records are exempt, nor is it appropriate for this Office to act as a first-instance decision-maker in respect of the records. Accordingly, I consider that the most appropriate course of action is to remit the matter back to the HSE so that it can make a new first-instance decision following examination of the records at issue. The applicant will have a right to an internal review and a review by this Office if he is not satisfied with the HSE’s decision.
Having regard to the application for review that was submitted by the applicant to this Office, the remaining matters to be addressed are (i) whether the HSE was justified in refusing access to record 1 under section 31(1)(a) of the Act and (ii) whether it was justified in refusing access, under section 15(1)(a) of the FOI Act, to the records of Professor A and the Clinical Director.
Section 31(1)(a) provides for the mandatory refusal of a request if the record concerned would be exempt from production in proceedings in a court on the ground of legal professional privilege. Legal professional privilege enables the client to maintain the confidentiality of two types of communication:
• confidential communications made between the client and his/her professional legal advisor for the purpose of obtaining and/or giving legal advice (‘advice privilege’), and
• confidential communications made between the client and a professional legal advisor or the professional legal advisor and third-party or between the client and a third-party, the dominant purpose of which is the preparation for contemplated/pending litigation (‘litigation privilege’).
The concept of ‘once privileged always privileged’ applies where privilege is based on legal advice privilege, but not where it is based on litigation privilege. Thus, unless otherwise lost or waived, legal advice privilege lasts indefinitely. This Office is also of the view that privilege attaches to records that form part of a continuum of correspondence that results from the original request for advice. Moreover, this Office accepts that provided the ingredients of the relevant type of privilege are present in any given case, the fact that the professional legal adviser concerned is employed as an in-house legal adviser does not prevent the client from being able to assert the privilege over the communications at issue.
In its submissions to this Office, the HSE said that the author of record 1 was employed as Legal Advisor and GDPR compliance officer. It said the Head of Human Resources asked for legal advice and that record 1 contains that advice. As I have outlined above, this Office’s Investigator sought details of the correspondence that led to the issuing of record 1, following which the HSE provided copies of a relevant email thread. Having regard to the contents of those emails and to the contents of record 1, I am satisfied that record 1 contains legal advice given on foot of a request. I find, therefore, that section 31(1)(a) applies to record 1.
Section 15(1)(a) of the Act provides for the refusal of a request where the records sought do not exist or cannot be found after all reasonable steps to ascertain their whereabouts have been taken. The role of this Office in a case such as this is to review the decision of the FOI body and to decide whether that decision was justified. This means that consideration is given by this Office to the evidence available to the decision-maker and the reasoning used by the decision-maker in arriving at his/her decision and an assessment is made of the adequacy of the searches conducted by the FOI body in looking for relevant records.
The evidence in ‘search’ cases generally consists of the steps actually taken to search for the records along with miscellaneous and other information about the record management practices of the FOI body, insofar as those practices relate to the records in question. It is important to note that the 2014 Act does not require absolute certainty as to the existence or location of records, as situations arise where the records are lost or simply cannot be found. Furthermore, this Office may find that an FOI body has satisfied the requirements of section 15(1)(a), even where records that an applicant believes ought to exist have not been located.
In her internal review decision, the HSE’s internal reviewer said that having reviewed the HSE’s Electronic Communications Policy and in particular section 4.2 of that Policy, which is concerned with the HSE’s monitoring of staff emails, she said she did not consider it reasonable or appropriate to gain access to a retired staff member’s email and that it does not fall within the HSE’s right to monitor a staff member’s email as set forward in section 4.2. She further referenced section 4.5 of that Policy, which is concerned with the question of accessing business related emails during a staff member’s unplanned periods of absence, such as ill health, or where a user has forgotten to divert their mailbox to one of their colleagues. She said that while Professor A’s retirement was not unplanned leave, there were no compelling reasons put forward that warrant access to his emails.
In his application for review to this Office, the applicant said he did not believe that the HSE’s decision was compatible with the HSE data retention policy. In its submissions to this office during the review, the HSE said Professor A in question retired in 2020. It said the IT Manager was consulted in 2023 and 2024 for advice regarding the possible retrieval of the email account and confirmed that standard domain accounts are disabled after 90 days of inactivity and the mailbox is removed after 1 year of inactivity. It said the IT manager confirmed that the relevant account was disabled in September 2022 and that the mailbox was removed one year after it was disabled, “as per policy”.
Following further correspondence with this Office, the HSE provided this Office with a copy of a policy document entitled ‘Access Control Policy’. While it said the policy was further updated in May 2024, the copy provided to this Office at the outset of the review contained a “Review Date” of February 2014. The HSE said that Professor A’s account was disabled and removed pursuant to section 4.7 of the 2014 policy entitled “Monitoring & Review”. That section provides as follows:
“Information owners or their nominees must continually monitor access to their information systems. They must perform quarterly reviews of the systems they are responsible for to ensure:
1) That each user access account and the privileges assigned to that account are appropriate and relevant to that user’s current role or function;
2) That the information system and the information processed by the system is only accessed and used by authorized users for legitimate reasons.
System administrators and network administrators must conduct a system/network domain review at least once every quarter. User access accounts which have been inactive for 60 consecutive days or more must be suspended unless instructed otherwise by the user’s line manager. Suspended user accounts which have not been reactivated within a 12-month period should be marked for deletion, unless instructed otherwise by the user’s line manager.”
As I have outlined above, the applicant was provided with details of the HSE’s submissions and invited to comment. While the applicant provided two further submissions, he made no comment on the HSE’s submissions in respect of Professor A’s emails. Rather his responses were essentially concerned with an email thread that the HSE located during the course of the review, which I have addressed above in the “Scope of Review” section of this decision.
The question this Office must consider in a case where an FOI body refuses a request under section 15(1)(a) is whether the body has taken all reasonable steps to ascertain the whereabouts of the records sought. While it is not the role of this Office to examine the appropriateness or otherwise of the HSE’s records management policies or its implementation of those policies, we can have regard to the policies in determining whether the steps taken to locate the record sought were reasonable. Having regard to the HSE’s submissions, I accept that Professor A’s email account was decommissioned and that the records sought no longer exist. Accordingly, I find that the HSE was justified in refusing access, under section 15(1)(a) of the Act, to any relevant records of Professor A.
On the matter of records potentially held by the Clinical Director, the HSE said in its internal review decision that due to a system migration to another domain in January 2023, emails were lost. It said due to the Clinical Director’s email account being accessible to both the Clinical Director and their Executive PA, emails were not archived. It said that by holding an account with cross-access to emails, archiving emails would have been problematical for storing and retrieving and archiving was not therefore carried out by either the Clinical Director or his PA. In his application to this Office for review, the applicant said I do not believe that the HSE’s decision to be compatible with the HSE data retention policy. In its submissions to this Office, the HSE said ICT assistance was sought at the time of the applicant’s request to retrieve all emails lost in migration but they were not retrievable.
Having considered the matter, I have no reason to dispute the HSE’s assertion that any relevant emails that might have been held in the Clinical Director’s email account no longer exist on the basis that they were lost during the migration in question. Accordingly, I find that the HSE was justified in refusing access, under section 15(1)(a) to any relevant records that might have been held by the Clinical Director on the ground that the emails no longer exist.
Having carried out a review under section 22(2) of the FOI Act, I hereby vary the HSE’s decision. I find it was justified in refusing record 1 under section 31(1)(a) of the FOI Act. I find that it was justified in refusing access, under section 15(1)(a) of the FOI Act, to any relevant records that may have been held in the email accounts of Professor A and the Clinical Director on the ground that the records sought no longer exist. I find that it was not justified in failing to consider for release the five additional records located during the course of the review and I direct it to carry out a fresh decision-making process on those records.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Stephen Rafferty
Senior Investigator