Decision
Company P and Health Service Executive
From Office of the Information Commissioner (OIC)
Case number: OIC-132996-W9H2W9, OIC-132990-Y9D7T0
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-132996-W9H2W9, OIC-132990-Y9D7T0
Published on
Whether the HSE was justified in refusing, under section 15(1)(a) of the FOI Act, the applicant’s request for records containing numbers of Covid-19 cases reported in specified locations between March and June 2020
19 September 2023
This decision is a composite decision in respect of two requests the applicant company made to the HSE through its legal representatives. For convenience, I will refer in this decision to communications with the applicant as including communications with the applicant’s legal representatives.
For the purposes of this decision, it is relevant to note that I issued a decision on 19 December 2022 following my review of two decisions taken by the HSE on requests made by the same applicant company for certain details of recorded and reported Covid-19 cases within a one-mile radius of a number of specified Eircodes on six specified dates during the period March 2020 to June 2020. In my decision (Cases OIC-127853/OIC-127844), I found that the HSE was justified in refusing the requests under section 15(1)(a) of the FOI Act on the ground that the records sought did not exist.
The requests that are the subject of this review were for details of the numbers of Covid-19 cases recorded for six specified dates between March 2020 and June 2020 for eight specified areas identified by Eircode routing keys (the first 3 characters of an Eircode) and eight specified Dublin postal districts. The information sought comprised;
(i) the cumulative number of Covid-19 cases now known to have been in existence as of each of the relevant dates, including, for example, those who may have been awaiting test results on each of the relevant dates but whose test results subsequently confirmed that the individual(s) had contracted Covid-19 as of each of the relevant dates, and
(ii) the cumulative number of reported confirmed Covid-19 cases known to have been in existence on each of the relevant dates, excluding, for example, Covid-19 cases which had not been confirmed as of each of the relevant dates.
In its decisions of 22 August 2022, the HSE’s Health Protection Surveillance Centre (HPSC) refused both requests under section 15(1)(a) of the FOI Act on the ground that the records sought do not exist. The applicant sought internal reviews of those decisions on 5 September 2022, following which the HSE affirmed its refusal of the requests under section 15(1)(a). On 7 December 2022, the applicant applied to this Office for a review of the HSE’s decisions.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the correspondence between the applicant and the HSE as outlined above and to the correspondence between this Office and both parties on the matter.
This review is concerned solely with whether the HSE was justified in its decision to refuse, under section 15(1)(a) of the FOI Act, the applicant’s request for certain statistical information relating to number of recorded and reported Covid-19 cases within the areas specified on the dates specified, on the ground that the records sought do not exist.
Section 15(1)(a) of the FOI Act provides that a request for access to records may be refused if the records sought either do not exist or cannot be found after all reasonable steps to ascertain their whereabouts have been taken.
It is important to note at the outset that while the purpose of the Act is to enable members of the public to obtain access to information held by public bodies, the mechanism for doing so is by accessing records held by those bodies. In other words, a person wishing to obtain information from a public body must make a request for records that contain the information sought. Requests for information, as opposed to requests for records, are not valid requests under the Act, except to the extent that a request for information can reasonably be inferred to be a request for a record containing the information sought.
It is also important to note that the Act does not require FOI bodies to create records to provide the information sought if none exist, apart from a specific requirement, under section 17(4), to extract records or existing information held on electronic devices. Section 17(4) provides as follows:
Where an FOI request relates to data contained in more than one record held on an electronic device by the FOI body concerned-
a. subject to paragraph (b), the FOI body shall take reasonable steps to search for and extract the records to which the request relates, being steps that involve the use of any facility for electronic search or extraction that existed on the date of the request and was used by the FOI body in the ordinary course, and
b. if the reasonable steps referred to in paragraph (a) result in the creation of a new record, that record shall, for the purposes of considering whether or not such new record should be disclosed in response to the request, be deemed to have been created on the date of receipt of the FOI request.
If an FOI body does not hold a record containing the information sought and cannot search for and extract the electronically held records by taking reasonable steps, it is entitled to refuse the request under section 15(1)(a). The issues I must consider, therefore, are;
It is not disputed that the HSE holds data on Covid-19 cases and that it can provide certain information along certain geographical breakdowns. Its position, however, is that it does not hold records that contain the specific data sought and that it cannot extract the relevant records by using any facility for electronic search or extraction that existed on the date of the request and was ordinarily used by it.
In its application for internal review, the applicant said the HSE and the HPSC maintain detailed records of the number of Covid-19 cases in Ireland, including the dates on which those cases were confirmed and the location of those cases. It referenced certain previously published information on Covid-19 cases that contain details of the locations of the cases, including detailed maps on which the location of individual cases is highlighted. It said one of the data points provided in respect of all Covid-19 cases (including both self –reported cases reported on the Antigen Positives Portal and cases confirmed following testing administered by the HSE) is the Eircode associated with the individual. It said it understands that this is what allows the HSE to maintain such detailed records of the location of cases.
The applicant also noted that Ireland’s Covid-19 Data Hub contains detailed interactive maps showing breakdowns of case numbers by county and by local electoral area (LEA). It said it is possible to search an Eircode to find out what LEA the Eircode is located within. It said this map, which is based on the HSE’s data, therefore contains the dates and locations of Covid-19 cases in Ireland and that this is what the requests sought.
The applicant further noted that the HPSC maintains the Computerised Infectious Disease Reporting (CIDR) database and that in response to a separate request made on 8 June 2020, the HSE previously provided details of the number of cases within particular defined geographic areas on a specified date in 2020 with the breakdown being by reference to specified counties and by specific Dublin postcodes. It said that in its response to that earlier request, the HSE said the data furnished had been extracted from the CIDR system at the HPSC.
In its internal review decision, the HSE said Eircode routing key area is not a field within CIDR. It said that for Covid-19, the postcode field was used in some cases to record Eircodes. It said, however, that the postcode field is a free text field and includes data in a variety of formats and is not a mandatory field. It said the records requested cannot therefore be produced in a manner which can be easily and reliably extracted. It said that to produce data by Eircode routing key area from existing geographic data, the HPSC would require data to be imported from CIDR into another software package and code written to extract cases based on certain text within the relevant geographic data field.
In its application to this Office, the applicant said records of identical information were provided on foot of the earlier request, the only difference being the reference dates. It provided a copy of the decision it had received on that request which contains details of the number of confirmed Covid-19 cases on or before a specified date, broken down in that case by Dublin postcode. It suggested the information had been extracted swiftly and with ease as the decision indicates that the request was received on 8 June 2020 and that the relevant data “was extracted from CIDR June 9th at 12:30 pm”.
In response to the HSE’s comment that the postcode field is a free text field and includes data in a variety of formats, the applicant further suggested that straightforward searches could be carried out using Microsoft Excel to gather the records of cases within the relevant postal district in light of the limited number of possible variations of postcodes that might be used, e.g. “Dublin 1”, “D1”, or “D01”.
The applicant again also referenced the various publications and reports it had referenced in its application for internal review. It highlighted that one of the particular data points provided in respect of all Covid-19 cases is the Eircode associated with the individual. It said Eircodes in Dublin largely correspond to the different Dublin postal districts. It said this suggested that records of the Dublin postal district in which Covid-19 cases are located are maintained by HPSC.
Further to this, the applicant made reference to the self-reporting facility on the HSEs website which includes the individual’s Eircode as a field to be completed. It said that the field/box in question only allowed Eircodes to be entered in two formats which the applicant said is completely at odds with the statement in the Internal Review that this data is maintained in ‘a variety of formats’ and it therefore ‘cannot be produced in a manner which can be easily and reliably extracted’. The applicant went on to say that entering something other than a valid Eircode into this field results in an error message stating ‘Eircode is invalid’, which it interprets to mean that this is not a ‘free text field’.
In its submissions to this Office, the HSE explained that while it has data of Covid-19 cases, it refused the applicant’s requests under section 15(1)(a) on the grounds that it does not hold records that match the requests. It said CIDR includes the following address fields:
It said the postcode is filled manually by surveillance staff, or filled through a process which transfers Eircodes from the CovidCare tracker to CIDR. It reiterated that the postcode field on CIDR is not mandatory and is a free text field. It said data in the field can take a variety of formats and data entered does not always correspond with a Dublin postal district or an Eircode. It said that similarly, in the CovidCare tracker, the Eircode field is free text and can take a variety of formats e.g. mix of upper and lower case, spaces between characters. It said examples of the variety of entries in this field include: ‘DX’, ‘Dublin’, ‘Dublin X’, ‘Finglas’, ‘DOX YZWV’, ‘d0Xyzwv’, and blanks. It said the Dublin post code may be included in any of the address fields from ‘Address Line 1’ to ‘Town’ as these are all free text fields.
The HSE added that for cases that do have an Eircode in the postcode field, the following steps would be required to create the record sought:
The HSE said the above steps are not carried out as part of routine HPSC work and the HPSC does not consider them to be reasonable steps to respond to an FOI. It said, in particular, that the validation and cleaning required would be considerable.
When specifically asked about the details entered on the self-reporting facility, the HSE stated that this portal is not under the governance of the HPSC and the original request related to cases which are held on CIDR by the HPSC.
When asked to comment on the applicant’s suggestion that the information for the earlier request had been extracted swiftly and with ease, the HSE commented that the date of the previous request would have involved approximately 1,700 cases whereas the relevant dates in the latest requests would involve approximately 25,000 cases and the cleaning step described above would be far more onerous and go beyond reasonable steps. As such it refused this request under section 15(1)(a) of the FOI Act on the grounds that it would require work beyond what could be considered reasonable steps under section 17(4) of the Act.
When asked if it considered the steps taken to fulfil the June 2020 request to be reasonable, the HSE said that it now did not consider them reasonable, going on to say that it was early in the Covid pandemic and it was not as experienced in answering FOIs as it is now. The HSE said it now understands that the steps involved are too onerous and time consuming to be considered reasonable.
In correspondence with this Office, the applicant stated that he believes the HSE is required to provide copies of any records of Covid-19 cases within the relevant areas as of the relevant dates which it does hold even if, by reason of limitations in the manner in which such data was reported to the HSE, such records may not constitute a fully comprehensive catalogue of all cases which may potentially have existed within the relevant parameters. The Investigator contacted the HSE in relation to this and while the HSE confirmed it was able to produce the records it does hold, it was able to provide Covid-19 case numbers on a national level and not broken down as per the applicant’s request. The Investigator informed the applicant of this and advised him that as he felt this did not address the original request he would be progressing to a decision. The applicant reiterated his stance that the HSE should be able to produce more detailed records in a manner similar to that which was produced for the earlier FOI request from 8 June 2020.
Having regard to the submissions of the HSE, I am satisfied that it does not holds records containing the specific information sought. On the matter of whether the information sought is contained in more than one record held on an electronic device by the HSE that it can search for and extract by taking reasonable steps as defined in section 17(4), I am satisfied that it is not. Having regard for the HSE’s submissions regarding the steps required to create records in order to grant the applicant’s request, I am satisfied the processing of the information that would be required to do so would involve steps that go beyond the use of any facility for electronic search or extraction that existed on the date of the request and that was used by the FOI body in the ordinary course.
Accordingly, I find that the HSE was justified in refusing the applicant’s requests under section 15(1)(a) of the FOI Act on the grounds that the records sought do not exist and that it is not required to search for and extract the records pursuant to section 17(4) as to do so would go beyond the taking of reasonable steps.
Having carried out a review under section 22(2) of the FOI Act, I hereby affirm the HSE’s decision in this case. I find the HSE was justified in refusing, under section 15(1)(a) of the FOI Act, the applicant’s requests for records relating to the numbers of Covid-19 cases within certain Eircodes/Dublin postal districts on the basis that the records as sought do not exist.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Stephen Rafferty, Senior Investigator