Decision
Ms K and Medical Council
From Office of the Information Commissioner (OIC)
Case number: OIC-53888-W8X4Y9
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-53888-W8X4Y9
Published on
Whether the Council was justified in refusing access to records relating to its investigation of a complaint made by the applicant, and her medical records, under sections 35 and 37 of the FOI Act
28 May 2021
This review has its background in a complaint the applicant made to the Council regarding her treatment by a named consultant, Dr. A, in a public hospital. On 23 April 2019, the applicant made a request to the Council for all records held pertaining to her, including any correspondence between the Council and Dr. A in relation to her.
On 27 May 2019, the Council issued its decision, in which it part-granted the applicant’s request, refusing access to information and records under sections 35 (confidential information) and 37 (third party personal information) of the FOI Act. On 28 May 2019, the applicant sought an internal review of that decision, following which the Council affirmed its original decision. On 1 July 2019, the applicant sought a review by this Office of the Council’s decision.
I have decided to conclude this review by way of a formal, binding, decision. In conducting the review, I have had regard to the correspondence between the Council and the applicant as outlined above and to correspondence between this Office and both the Council and the applicant on the matter. I have also had regard to the contents of the records at issue. In referring to the records at issue, I have adopted the numbering system used by the Council in the schedule of records it prepared when processing the request. I must apologise for the lengthy delay in finalising the review, which was due to unforeseen staff absences.
The Council first identified 674 pages as coming within the scope of the review. In its internal review decision, it noted that eight pages were duplicates of other records, 140 pages were refused in full under section 37(1), and 399 records were refused in full under section 35(1). It granted access, in full or in part, to 127 pages, claiming exemption under section 37(1) over the redactions in those pages.
While I acknowledge that a large number of records fell within the scope of the applicant’s request, there was a considerable amount of duplicate pages in the records prepared by the Council. In addition, certain pages, while not exact duplicates, contained some or all of the information as other pages. Furthermore, there were inconsistencies in some of the information redacted. When this Office’s Investigator queried this matter with the Council, it said this was due to the source of the pages. In any event, I am satisfied that many pages are included in the schedule more than once.
Furthermore, following an additional request by this Office for clarifications during the course of the review, the Council also revised its position on a number of records. The Council informed this Office that, on reflection, it had determined that some relevant records could be released in full or in part, with certain information withheld under section 37(1).
Accordingly, this review is concerned solely with whether the Council was justified in its decision to refuse access to the remainder of the withheld records under sections 35 and 37 of the FOI Act and to redact information from the pages identified above under section 37(1).
In light of the submissions made by the parties, I wish to make the following preliminary points. First, this Office has no role in examining the administrative actions of the Council in relation to the manner in which it conducts investigations. Our role is confined to whether the Council has properly applied the provisions of the FOI Act.
Second, section 18 of the FOI Act provides that if it is practicable, records may be granted in part, by excluding exempt material. Section 18 does not apply if the copy of the record provided would be misleading. This Office takes the view that the provisions of section 18 do not envisage or require the extracting of particular sentences of occasional paragraphs from records for the purpose of granting access to those particular sentences or paragraphs. Generally speaking, therefore, the Commissioner is not in favour of the cutting or “dissecting” of records to such an extent.
Third, section 13(4) of the Act provides that, subject to the Act, in deciding whether to grant or refuse an FOI request, any reason that the requester gives for the request and any belief or opinion of the FOI body as to the reasons for the request shall be disregarded. Thus, while certain provisions of the Act implicitly render the motive of the requester relevant, as a general rule, the actual or perceived reasons for a request must be disregarded in deciding whether to grant or refuse an access request under the FOI Act.
Finally, although I am obliged to give reasons for my decision, section 25(3) requires that all reasonable precautions be taken in the course of a review to prevent disclosure of information contained in an exempt record. This means that I am limited in the description I can provide of the records at issue and the material I can refer to in my analysis in this decision.
As outlined above, the applicant’s complaint against Dr. A was investigated by the Council’s Preliminary Proceedings Committee (PPC). The role of the PPC is to investigate a complaint, decide whether it warrants further action and provide recommendations to the Council.
The records at issue in this review comprise records created during the Council’s investigation and the applicant’s medical records obtained by the Council in the course of its investigation.
Section 35 - Information Given in Confidence
The Council refused access to pages 131-326 under section 35 of the FOI Act. Pages 131-326 consist of the applicant’s medical records that were provided to the Council by the hospital where Dr. A practices. The Council said it was relying on both section 35(1)(a) and 35(1)(b).
Section 35(1)(a) provides for the mandatory refusal of a request if
All four requirements as outlined in section 35(1)(a) cited above must be satisfied in order for a record to be considered exempt from release under section 35 (1)(a).
Section 35(1)(b) provides for the mandatory refusal of a request if disclosure of the information concerned would constitute a breach of a duty of confidence provided for by a provision of an agreement or enactment or otherwise by law.
Section 35(2) provides that subsection (1) does not apply to record that is prepared by a member of the staff of an FOI body or a service provider in the course of the performance of his or her functions, unless disclosure of the information concerned would constitute a breach of a duty of confidence owed to a person other than an FOI body or a service provider or to a member of the staff of an FOI body or a service provider.
Both the Council and the hospital in question are FOI bodies. Furthermore, Dr. A is a member of staff of an FOI body. It is clear from my examination of pages 131-326 that these records were prepared by Dr. A and various other staff members of the hospital in the course of their duties.
Despite the fact that the hospital provided the applicant’s medical records to the Council, the Council appears to have taken the approach that the provision of these records formed part of Dr. A’s personal participation in the Council’s investigation.
The Council argued that the records had not been provided by an FOI body. When asked for the basis on which it had concluded that these records had been provided on the understanding that they would be treated confidentially, the Council argued that it had marked separate correspondence it had sent directly to Dr. A as “private and confidential”. The Council stated that this created the understanding of confidence necessary. The Council also argued that if doctors became aware that their candid responses in the course of a Council investigation could be released to the public at large, they might not provide information to the Council in future. The Council contended that that if its confidence in candid feedback was undermined, this would dramatically reduce its effectiveness in making informed decisions in the context of the complaint process. It also argued that disclosure of this personal information would constitute a breach of Article 17 of the General Data Protection Regulation, section 94(2)(a) of the Data Protection Act 2018 and Section 59(9)(a)(b) of the Medical Practitioners Act 2007.
The Council’s arguments in this respect appear to me to be completely divorced from the content of pages 131-326 and the manner and context in which they were provided to it by the hospital. The applicant’s medical records do not amount to feedback created for the purposes of the complaint process. Rather, the records were created in the context of the applicant’s attendances at the hospital in question over a particular period. No argument has been made by the Council that a duty of confidence is owed to any party other than an FOI body and a staff member of an FOI body. Having regard to the information before me and following my review of the records, I find that the disclosure of the information sought to the applicant would not constitute a breach of a duty of confidence owed to a person other than an FOI body or a service provider or to a member of the staff of an FOI body or a service provider. I find, therefore, that section 35(1) does not apply to the information at issue.
Given the nature of the contents of these records, I will consider whether they are exempt under section 37(1).
Section 37 - Personal Information
Section 37(1) provides for the mandatory refusal of a request where access to the record concerned would involve the disclosure of personal information relating to an individual or individuals other than the requester. Furthermore, section 37(7) provides for the refusal of a request where access to the record concerned would, in addition to involving the disclosure of personal information relating to the requester, also involve the disclosure of personal information relating to an individual or individuals other than the requester, and where it is not feasible to separate the personal information relating to the requester from that relating to the other party. Such information is commonly referred to as “joint personal information”.
Section 2 of the FOI Act defines the term "personal information" as information about an identifiable individual that either (a) would, in the ordinary course of events, be known only to the individual or members of the family, or friends, of the individual or (b) is held by an FOI body on the understanding that it would be treated by the body as confidential. Section 2 also details fourteen specific categories of information that is personal, without prejudice to the generality of the foregoing definition. These include “(i) information relating to the educational, medical, psychiatric or psychological history of the individual [and] (v) information relating to the individual in a record falling within section 11(6)(a) (that section refers to personnel records of members of staff of FOI bodies)”.
Paragraph I of section 2 excludes certain information from the definition of personal information, including the name of a staff member of an FOI body and information relating to his/her office or position or its functions, or anything written or recorded in any form by the individual in the course of and for the purpose of the performance of his or her functions. This exclusion is intended, in essence, to ensure that section 37 will not be used to exempt the identity of a public servant while carrying out his or her official functions. However, the exclusions to the definition of personal information do not deprive public or civil servants of the right to privacy generally. As noted above, the personnel records of staff members of FOI bodies are included within the definition of personal information.
The majority of the records at issue in this case were created in the context of a complaint against Dr. A and contain information directly relating to that complaint, with the important exception of the applicant’s medical records at pages 131-326. I do not accept that any alleged misconduct by Dr. A could be characterised as being for the purpose of the performance of their functions as a staff member of the hospital, an FOI body. Consequently, in this case I am of the view that the exclusion at Paragraph I does not apply to the information relating to Dr. A to which I find section 37(1) applies.
In considering whether information falls within section 2, paragraphs (a) or (b), this Office may consider the general facts and circumstances of the case and the circumstances in which the information was imparted to and received by the FOI body. The Commissioner accepts that information may fall within paragraph (b) even in situations where the FOI body has not given explicit assurances of confidentiality in relation to the information. He has accepted, for example, that, in certain circumstances, individuals may understand that the information is given to the FOI body for a limited purpose and that such information be held by the FOI body on the understanding that it will be treated as confidential.
In respect of its reliance on section 37, the Council argued generally that allegations of poor professional performance against a doctor are the personal information of that doctor. It argued that because there was no prima facie evidence stemming from the complaint following the conclusion of the investigation, it cannot confirm or deny that a doctor on its register was subject to a complaint. The Council contended that any information that would identify the location of the hospital in which Dr. A works, combined with the specialist field in which Dr. A practices, could reasonably lead to the doctor’s identity being revealed.
From my examination of the records and information refused by the Council, along with the Council’s submission to this Office, it appears to me that the Council has taken the position that any information that could be tangentially linked to Dr. A should be considered his/her personal information.
The pages the Council redacted or withheld under section 37 fall into a number of categories. I will address each category in turn.
Applicant’s medical records
As mentioned above, pages 131-326 consist of the applicant’s medical records that were provided by Dr. A’s hospital to the Council. While the Council did not specifically argue that section 37 applies to these records, bearing in mind my consideration of the contents of the records, as well as the Council’s arguments concerning section 35, and the mandatory nature of section 37, I have decided to consider that question.
Having carefully examined the records, I am satisfied that they solely contain personal information concerning the applicant and as such, that section 37(1) does not apply, given that the applicant is the requester. Although some of the records contain details of the applicant’s treatments and engagements with Dr. A, they do not contain any details of the nature of the complaint made by the applicant against Dr. A. Having regard to the exclusion to the definition of personal information in respect of staff members of FOI bodies, I am satisfied that none of the applicant’s medical records could be said to contain personal information of Dr. A, or any other staff member of the hospital. Consequently, I find that section 37(1) does not apply to pages 131-326.
Having found that sections 35 and 37 do not apply to pages 131-326, I direct their release.
Records relating to Dr. A, including correspondence between the Council and Dr. A
Pages 52-55, 62-66, 70-74, 77-81, 89-94, 101-114, 118-120, 526-527, 531-538, 541-545, 547, 549-550, 552-554, 556-557, 559, 563-565, 576, 582, 587-589, 596-599, 612-622, 648-650, 653-657, 660, 663-664, 672-674 all broadly concern correspondence between the Council and Dr. A, including correspondence between the Council and representatives of Dr. A, relating to the applicant’s complaint. Page 32 consists of information concerning Dr. A. The majority of these pages were entirely refused by the Council under section 37(1). As noted, pages 547, 549-550, 552-554, 556-557, and 617 were partially released during the review, with certain information redacted under section 37(1).
Having carefully examined the correspondence records, I note that there are also indications in the records that the authors had expectations that the content of their responses ought to be treated as confidential. I accept that they provided their responses to the PPC for a limited purpose, i.e. to allow it to investigate the applicant’s complaint. I also accept that, having regard to the content of the records, they understood that the records would be treated as confidential.
Page 32 concerns educational and professional information relating to Dr. A. It is unclear whether the Council holds this record as a result of its other functions or whether it was provided in the course of its investigation of the complaint.
Regardless, having carefully considered the above referenced pages, I am satisfied that they fall within the definition of personnel records at section 11(6)(a) and therefore consist of either third party personal information or joint personal information of the applicant and others.
I am also cognisant of the provisions of section 18, as outlined above. In the circumstances of this case, I find that section 37(1) applies to the relevant correspondence between the Council and Dr. A or their representatives within the records, including, whether withheld in full or in part, pages 52-55, 62-66, 70-74, 77-81, 89-94, 101-114, 118-120, 526-527, 531-538, 541-545, 547, 549-550, 552-554, 556-557, 559, 563-565, 576, 582, 587-589, 596-599, 612-622, 648-650, 653-657, 660, 663-664, 672-674. I also find section 37(1) applies to page 32.
Documentation exchanged between the applicant and the Council, and the Council and the hospital, and other records
Remaining records concern correspondence and attachments exchanged between the applicant and the Council, and between the Council and the hospital.
The Council made a large number of redactions to these records and, in some cases, it refused access entirely.
As mentioned, the Council argued that any information that would identify the location of the hospital in which Dr. A works, combined with the specialist field in which Dr. A practices, could reasonably lead to the disclosure of the doctor’s identity. It is clear from the definition of personal information at section 2 that a record does not have to specifically name a particular individual for the information in the record to comprise personal information relating to that individual. It is sufficient that the individual is identifiable from the information in question.
I accept that Dr. A’s name, registration number, and professional position/speciality is his/her personal information in the context of a complaint against them. I also accept that the identity of Dr. A’s representatives is Dr. A’s personal information in this context. Furthermore, where the applicant has questioned the conduct of other named doctors and hospital staff, I accept that their names, in that context, are their personal information.
However, I do not accept the Council’s argument that, in the context of a complaint, any identifier that may lead to the disclosure of the location of a doctor’s work, combined with the specialist field in which that doctor practices, could reasonably be assumed to lead to the doctor’s identity being revealed.
I fail to see how the release, for instance, of the name of the hospital a doctor works in could possibly give rise to the identification of the doctor’s personal information in circumstances of a complaint, where the vast majority of the information about the doctor is withheld. While the Council has argued that the location of the hospital Dr. A works in could reasonably lead to his/her identity being revealed, it has not demonstrated how this might occur.
I will now address the specific information and records refused by the Council, beginning with the records the Council refused entirely.
Accordingly, I direct the release of pages 67, 327-328, 574, 575, 633, and 636-637.
The remaining records at issue were all part-granted with redactions made under section 37(1).
As noted, page 124 (a direction or “production summons”) has been released. Pages 126-127 comprise a cover letter from the Council to the hospital, enclosing the direction at page 124. Page 126 was released, apart from the name of a records officer to whom it was addressed. The second page of the letter was also released. Having regard to the definition of personal information, I am satisfied that section 37(1) does not apply to page 126.
The redactions made by the Council to the remaining records include the following types of information:
I accept that Dr. A’s name, registration number, and professional position/speciality is their personal information in the context of a complaint against them. Similarly, I accept that the identity of Dr. A’s representatives is Dr. A’s personal information in this context. Accordingly, I am satisfied that section 37(1) applies to any redactions containing that information.
The Council also redacted the names of doctors/staff that the applicant engaged with at other hospitals from emails the applicant sent to the Council. It did not explain the basis for its refusal of this information. From my examination of the records, it seems that in one email, at pages 578-580, the applicant was essentially questioning the competence of certain specific named doctors/staff mentioned. While it is not clear from the context of the email whether those doctors/staff are staff members of FOI bodies, I am satisfied that even if they are, their names, in connection with negative comments about their professional conduct, are their personal information.
Accordingly, I am satisfied that section 37(1) applies to names of certain doctors/staff present in pages 578-580.
I am further satisfied that the other names of doctors and staff in pages 578-580 and the remaining other records are not personal information within the meaning of section 2. It does not appear that the applicant is questioning the competence of any of the other doctors or staff mentioned. I cannot see how the names of those individuals, in connection with the rest of the content of the records in which they appear, would disclose information of a personal nature relating to them or anyone other than the applicant. I direct their release.
The remainder of the redactions at issue concern the following: the name, location, and address of the hospital where Dr. A works; the name and work email address of another staff member who works at the same hospital; the names of other hospitals; the name, work address, practice name and other contact information of a psychologist the applicant attended in the United Kingdom; the name and work address of a psychiatrist; the name and location of a medical practice attended by the applicant; and other information of a non-personal nature such as portions of emails sent by the Council to the applicant that contain no identifiable information.
The Council has not explained how release of any of this information would lead to the disclosure of personal information of Dr. A, or any other third party. I am satisfied that insofar as these redactions concern staff members of FOI bodies, the information is subject to the Paragraph I exclusion to the definition of personal information. Further to my comments concerning identifiable information, above, and having considered both the Council’s arguments and the content of the above mentioned redactions, with the exception of the U.K. based psychologist’s details (not FOI body staff), I do not accept that the disclosure of that information would give rise to the identification and disclosure of personal information of any third party. On that basis, I am satisfied that section 37(1) does not apply to the remainder of the redactions at issue. I direct release of that information.
In summary, I find that section 37(1) applies to the following pages and information, subject to the provisions of section 37(2) and section 37(5) which I examine below:
Section 37(2)
There are some further circumstances, provided for at section 37(2), in which the exemption at section 37(1) does not apply. Section 37(7) is also subject to sections 37(2)(b) to (e). I am satisfied that none is relevant in this case.
Section 37(5) - Public Interest
Section 37(5) provides that a request which would fall to be refused under section 37(1) may still be granted where the FOI body considers that, on balance, (a) the public interest that the request should be granted outweighs the public interest that the right to privacy of the individual to whom the information relates should be upheld, or (b) the grant of the request would benefit the individual concerned.
In my view, the release of the information to which I have found section 37(1) to apply would not benefit the third parties to whom the information relates. I am satisfied that section 37(5)(b) does not apply.
In relation to the public interest test contained in section 37(5)(a), I wish to emphasise that in carrying out any review, this Office has regard to the general principles of openness and transparency set out in section 11(3) of the FOI Act. In sum, section 11(3) recognises the need to enhance public scrutiny and accountability of government and public affairs, particularly the activities and decision making of FOI bodies.
However, on the matter of whether the public interest in granting access to the information at issue would, on balance, outweigh the privacy rights of the individuals concerned, I have had regard to the comments of the Supreme Court in The Governors and Guardians of the Hospital for the Relief of Poor Lying-In Women v The Information Commissioner [2011] 1 I.R. 729, [2011] IESC 26) (“the Rotunda case”). It is noted that a public interest (“a true public interest recognised by means of a well known and established policy, adopted by the Oireachtas, or by law”) should be distinguished from a private interest.
On the matter of the type of public interest factors that might be considered in support of the release of the information at issue in this case, I have had regard to the findings of the Supreme Court in its judgment of 25 September 2020 in The Minister for Communications, Energy and Natural Resources v The Information Commissioner & Ors. (available on our website). In her judgment, Baker J. indicated that the public interest in favour of disclosure cannot be the same public interest as that broadly stated in the Act. She said the public interest in disclosure must be something more than the general public interest in disclosure and the reason must be found from the scrutiny of the contents of the record. She said there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure.
While the comments of the Supreme Court in both judgments cited above were made in relation to provisions of the FOI Act other than section 37, I consider them to be relevant to the consideration of public interest tests generally.
As noted, section 13(4) requires that, subject to the Act, any reasons a requester gives for making a request shall be disregarded. This means that in this case, the applicant's motivation cannot be considered except insofar as this might be relevant to the consideration of public interest provisions. The applicant argued in her internal review request that the Council had not been transparent or engaged with her in a comprehensive and equitable way. In correspondence with this Office, the applicant essentially questioned the fairness of the Council’s processes in dealing with her complaint. As I have indicated above, it is not a matter for this Office to consider the appropriateness, or otherwise, of the manner in which the Council performs its functions
Both the language of section 37 and the Long Title to the Act recognise a very strong public interest in protecting the right to privacy (which has a Constitutional dimension, as one of the un-enumerated personal rights under the Constitution). Unlike other public interest tests provided for in the FOI Act, there is also a discretionary element to section 37(5)(a), which is a further indication of the very strong public interest in the right to privacy.
It is also important to note that the release of records under FOI is, in effect, regarded as release to the world at large given that the Act places no constraints on the uses to which the information contained in those records may be put.
Having regard to the nature of the information at issue, I am aware of no public interest factors in favour of the release of the specific redacted information that, on balance, outweigh the right to privacy of the individuals to whom the information relates.
I find, therefore, that section 37(5)(a) does not apply and that the Council was justified in refusing access to the records under section 37(1).
Finally, for the benefit of the Council, I would like to make the following comments on two matters.
First, the Council argued that disclosure of personal information would constitute a breach of Article 17 of the General Data Protection Regulation and section 94(2)(a) of the Data Protection Act 2018. The Council should note that Article 86 of the General Data Protection Regulation provides that personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in the public interest may be disclosed by the authority or body in accordance with Union or Member State law to which the public authority or body is subject in order to reconcile public access to official documents with the right to the protection of personal data pursuant to the Regulation.
Section 44 of the Data Protection Act provides that, for the purposes of Article 86, personal data contained in a record may be disclosed where a request for access to a record is granted under and in accordance with the FOI Act 2014 pursuant to an FOI request.
Data protection legislation does not prohibit public bodies from processing FOI requests where the records sought contain personal information relating to individuals other than the requester. The FOI Act is entirely independent of data protection legislation and FOI requests for access to records must be processed in accordance with the provisions of the FOI Act.
Indeed, the FOI Act provides for the release of personal information of third parties in certain circumstances, including where the public interest in granting the request outweighs, on balance, the public interest in protecting the privacy rights of the individuals concerned. Any concerns a public body has about the release of personal information relating to individuals other than the requester can and should be addressed by considering the applicability of the exemption contained in section 37 to the records at issue.
Second, in relation to the Council’s contention that release of personal information would be a breach of section 59(9)(a) and (b) of the Medical Practitioners Act 2007, it has not explained why it considers that statutory provision to prohibit the release of personal information, nor is it apparent to me that it does.
Having carried out a review under section 22 (2) of the Freedom of Information Act 2014, I hereby vary the decision of the Council as follows.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than eight weeks after notice of the decision was given to the person bringing the appeal.
Stephen Rafferty
Senior Investigator