Decision
X and Health Service Executive
From Office of the Information Commissioner (OIC)
Case number: OIC-103054-W6J6X8
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-103054-W6J6X8
Published on
Whether the HSE was justified in refusing access to records relating to a named nursing home and Covid-19, under sections 35, 36 and 37 of the FOI Act
30 August 2021
On 16 September 2020, the applicant made an FOI request to the HSE for records relating to the HSE Area Crisis Management teams and HSE Covid Response teams. On 25 September 2020, he refined his request to minutes of HSE Area Crisis Management team meetings and the records of HSE Covid Response teams regarding nine named nursing homes. On 14 December 2020, the HSE issued a decision. It granted access to certain information and refused access to the remaining records under section 36 of the FOI Act. On 16 December 2020, the applicant applied for an internal review. On 4 January 2021, the HSE issued an internal review decision. It granted access to certain information and refused access to the remaining records under section 35(1)(a) and 37(1) of the FOI Act. On 28 January 2021, the applicant applied to this Office for a review of the HSE's decision to refuse access to records regarding one named nursing home (the nursing home).
In conducting my review, I have had regard to the correspondence between the applicant and the HSE as outlined above and to the correspondence between this Office and both parties, and the content of the records provided to this Office by the HSE for the purposes of this review. I have also had regard to submissions obtained from the nursing home during this review.
The scope of this review is confined to whether the HSE was justified in refusing access to records regarding the nursing home (the records) under sections 35, 36 and 37 of the FOI Act.
Section 38
I note that the HSE consulted the nursing home by letter of 30 November 2020. The nursing home replied on 4 December 2020, objecting to release of the records. In its letter of consultation, the HSE referred to section 38 of the FOI Act. Section 38 applies to cases where, at some stage in the decision making process, the public body has formed the view that the record(s) in question qualify for exemption under one or more of the relevant exemptions in the FOI Act (i.e. sections 35, 36 and 37) but that the record(s) should be released in the public interest. Where section 38 applies, the public body is required to notify an affected third party before making a final decision on whether or not the exemption(s), otherwise found to apply, should be overridden in the public interest.
The Commissioner takes the view that the form of notification to the third party is very important. Section 38 provides that the notification should tell the person that, apart from section 38, the request falls to be granted in the public interest. The Commissioner takes the view that it would, therefore, be misleading to write to a third party implying that the decision maker had formed no opinion on the matter and was merely considering whether the third party would prefer if the information would not be disclosed.
In its letter of consultation, the HSE did not inform the nursing home that apart from section 38, the request fell to be granted in the public interest. It did not indicate that it had formed the view that it was in the public interest to grant access to the records. Furthermore, it progressed the case to an internal review, which is not in accordance with the procedure under section 38.
In the circumstances, I do not consider that this is a case to which section 38 applies.
Section 37 - Personal information
Section 37(1)
The HSE claims that the records are exempt under section 37(1) of the FOI Act. Section 37(1) provides that access to a record shall be refused if it would involve the disclosure of personal information. The FOI Act defines the term “personal information” as information about an identifiable individual that would, in the ordinary course of events, be known only to the individual or his/her family or friends, or information about the individual that is held by a public body on the understanding that it would be treated as confidential. The FOI Act details fourteen specific categories of information which is personal without prejudice to the generality of the foregoing definition, including “(i) information relating to the educational, medical, psychiatric or psychological history of the individual”. Information which comes within any of the fourteen categories specified at paragraphs (i) to (xiv) is personal information - there is no requirement for it to also meet the requirements of paragraphs (a) or (b).
Paragraph I of section 2 of the FOI Act excludes certain matters from the definition of "personal information", including the names of staff members of an FOI body and information relating to their office.
The HSE says that due to the nature of the information that is specifically related to a nursing home and the information being associated with a date, it may be possible to identify a resident or staff member who may be suspected or confirmed as having Covid-19, as those individuals would be known to staff, residents and immediate contacts. It says that the HSE holds this information confidentially. It says that the public interest factors against release outweigh those in favour of release, as the right to privacy is a very strong right and the HSE has a duty to maintain the confidentiality of personal information.
The nursing home says that the information is associated with the dates of minutes and this could enable the requester to identify the residents or staff and their medical history, which constitutes personal information.
The records comprise excerpts from the minutes of 15 meetings of the Strategic Outbreak Control Team. They disclose the numbers of suspected and confirmed cases of Covid-19, hospitalisations and deaths, as they relate to the nursing home. They do not name the individuals concerned. They also disclose the names of those who attended the meetings. The HSE confirmed to this Office that all members of the Crisis Management Team are or were direct HSE employees.
The Commissioner accepts that an individual may not be named in a record, yet may still be identifiable. That said, section 37 provides for the refusal of a request where access to the record concerned would involve the disclosure of personal information (my emphasis). It seems to me that the mere possibility of such disclosure occurring, no matter how remote, is insufficient for section 37 to apply. The question I must consider is whether the disclosure of the records would involve the disclosure of personal information about an identifiable individual. Having examined the content of the records and considered the parties’ submissions, I am not satisfied that access to the records would involve the disclosure of personal information about identifiable individuals. Regarding the numbers of suspected and confirmed cases, hospitalisations and deaths, as I observed, the mere possibility of such disclosure occurring, no matter how remote, is insufficient for section 37 to apply. Regarding the names of those who attended these meetings, as they are members of staff of, or service providers to, FOI bodies, I find that this information falls into the exclusion at Paragraph I of section 2 of the FOI Act.
I find that section 37(1) does not apply. I am therefore not required to consider sections 37(2) or (5) of the FOI Act. I find that the HSE was not justified in refusing access to the records under section 37 of the FOI Act.
Section 35(1) – Information obtained in confidence
The HSE claims that the records are exempt under section 35(1) of the FOI Act. Section 35(1)(a) applies to a record containing information given to an FOI body in confidence. Four requirements must be satisfied for a record to be exempt under section 35(1)(a):
Section 35(1)(b) of the FOI Act provides that an FOI body shall refuse to grant an FOI request if disclosure of the information concerned would constitute a breach of a duty of confidence provided for by a provision of an agreement or enactment (other than a provision specified in column 3 in Part 1 or 2 of Schedule 3 of an enactment specified in that Schedule) or otherwise by law.
Section 35(2) disapplies section 35(1) to a record which is prepared by a head or any other person (being a director, or member of the staff of, an FOI body or a service provider) in the course of the performance of his or her functions unless disclosure of the information concerned would constitute a breach of a duty of confidence that is provided for by an agreement or statute or otherwise by law and is owed to a person other than an FOI body or head or a director, or member of the staff of, an FOI body or of such a service provider. As section 35(1) does not apply where the records fall within the terms of section 35(2), I should consider section 35(2) at the outset. The records are minutes of meetings which were prepared by the HSE. The HSE is an FOI body. Therefore, section 35(1) will not apply to the records unless disclosing them would constitute a breach of a duty of confidence owed to a person other than an FOI body/service provider etc. under an agreement or statute or otherwise by law. The persons to whom the duty of confidence is said to be owed are the nursing home and its staff and residents, who are not an FOI body or a service provider.
The HSE says that the nursing home provided this information to assist with the management of Covid-19 infection outbreaks in private nursing homes. It says that the information has a necessary quality of confidence, was provided in circumstances imposing a duty of confidence and disclosure would be an unauthorised use of information to the detriment of the nursing home.
The nursing home says that the information was furnished to enable the HSE to coordinate its response to coronavirus outbreaks in nursing home facilities in an unprecedented national health emergency. It says that the information was furnished pursuant to the HSE’s statutory powers and on the understanding that it would remain confidential. It says that it is indisputably important that such public health related information is given to the HSE, but disclosure is likely to prejudice the giving of such information without seeking to impose clarifications and qualifications. The nursing home says that disclosure could also affect the speed with which future figures are furnished to the HSE. It says that this is due to inaccuracies in the information. The nursing home says that it was not possible to ascribe Covid-19 as a cause of death in certain cases. It specifies three dates on which it says the numbers of deaths cited are inaccurate and one date on which it says the number of cases cited is inaccurate.
Given my finding under section 35(2), for section 35 to apply, disclosure would have to constitute a breach of a duty of confidence under an agreement or statute or otherwise by law. Accordingly, I am not required to consider the provisions of section 35(1)(a). For the avoidance of doubt, if I had been required to consider it, I am not persuaded that the third requirement could be met. According to the nursing home’s own submissions, it gave this information pursuant to a statutory duty. I do not find it feasible to suggest that the nursing home would not comply with its statutory duty in this ongoing public health emergency if these records were disclosed under FOI.
I have outlined the HSE’s submissions above. The nursing home says that section 35(1)(b) applies, on the basis of the breach of an “implied obligation of confidence”. It says that the information is private and inherently confidential. It does not point to a duty of confidence provided for by a provision of an agreement or enactment. I must therefore consider whether a duty of confidence provided for "otherwise by law" arises. Such a duty is generally accepted to include a duty of confidence arising in equity. The Commissioner accepts that breach of an equitable duty of confidence is comprehended by section 35(1)(b). In Mahon v Post Publications Ltd [2007] 3 IR 338, the Supreme Court summarised the requirements of the equitable duty of confidence as follows: the information must in fact be confidential or secret: it must have the necessary quality of confidence about it; it must have been communicated by the possessor of the information in circumstances which impose an obligation of confidence or trust on the person receiving it; it must be wrongfully communicated by the person receiving it or by another person who is aware of the obligation of confidence. To establish that an equitable duty of confidence exists, it should be shown that the information has the necessary quality of confidence. Factors relevant for consideration in this regard include, for example, whether the information is confidential or secret or concerns private matters. The nursing home gave information to the HSE under a statutory obligation to enable it to coordinate its response to a public health emergency. I am not satisfied that the information concerned has the necessary quality of confidence for an equitable duty of confidence to arise or that it was communicated in circumstances which imposed an obligation of confidence or trust on the HSE. I am not satisfied that section 35(1)(b) applies.
Accordingly, I find that the HSE was not justified in refusing access to the records under section 35 of the FOI Act.
Section 36(1) - Commercial Sensitivity
The HSE claims that the records are exempt under section 36(1)(b) of the FOI Act. Section 36(1)(b) provides that an FOI body shall refuse to grant an FOI request if the record concerned contains financial, commercial, scientific or technical or other information whose disclosure could reasonably be expected to result in a material financial loss or gain to the person to whom the information relates, or could prejudice the competitive position of that person in the conduct of his or her profession or business or otherwise in his or her occupation. The harm test in the first part of section 36(1)(b) is that disclosure "could reasonably be expected to result in material loss or gain". This Office takes the view that the test to be applied is not concerned with the question of probabilities or possibilities but with whether the decision maker's expectation is reasonable. The harm test in the second part of section 36(1)(b) is that disclosure of the information "could prejudice the competitive position" of the person in the conduct of their business or profession. The standard of proof to be met here is considerably lower than the "could reasonably be expected" test in the first part of this exemption. However, this Office takes the view that, in invoking "prejudice", the damage which could occur must be specified with a reasonable degree of clarity. Section 36(1) does not apply if the public interest would, on balance, be better served by granting rather than refusing the request (section 36(3) refers).
The HSE says that disclosure would prejudice the competitive position of a private third party in the conduct of their business. It says that the information is open to interpretation if read in isolation and not in conjunction with publicly available information. It says that this may reflect poorly on the nursing home, which works in the competitive private sector. It refers to the availability of a HIQA inspection report, which it says fulfils the public interest in openness and accountability and negates the weight attached to the information in the records.
The nursing home says that the records contain inaccurate figures, which do not distinguish between conclusive and possible cases of deaths as a result of Covid-19. It says that the records could give a negative, false and inaccurate impression of how the nursing home addressed the Covid outbreak. It says that the nursing home industry is a highly competitive market. It says that when read in isolation, the records could negatively impact on a decision to choose the nursing home. It says that disclosure could thereby prejudice the nursing home’s competitive position and reasonably be expected to result in material loss to it. The nursing home points to a HIQA inspection report from 2020, which it says provides a detailed and accurate account of the COVID outbreak at the nursing home.
As the Supreme Court observed inUniversity College Cork and the Information Commissioner & Ors 2020 [IESC] 58, it is not sufficient for the FOI body to merely assert that disclosure could prejudice its competitive position; an FOI body must also have a reasonable basis for that position. I have examined the content of the record and considered the parties’ submissions. For section 36(1)(b) to apply, there must be a link between disclosure and the harms alleged. However, I am not satisfied that such a link exists.
I fully acknowledge that the nursing home has concerns about the accuracy of the numbers of cases and deaths which were recorded in four of the fifteen meeting minutes. However, I believe that it would be open to the HSE and the nursing home to clarify the position in respect of the relevant minutes, if that were necessary. Furthermore, the nursing home refers to a HIQA inspection report from 2020, which found that the nursing home was compliant or substantially compliant with 13 regulations, including infection control. I can see that this report is publicly available and makes those findings. I also note that the report gives a detailed picture of the nursing home concerned and measures taken in response to Covid-19. It comments positively on the nursing home. I am not persuaded that current or prospective residents and their relatives would base a decision solely on the information in these minutes, without any regard to HIQA inspection reports or indeed their own enquiries.
Accordingly, I am not satisfied that disclosing this information could give rise to the harms alleged. I find that section 36(1)(b) does not apply. Given my finding, I do not need to consider sections 36(2) or (3). I find that the HSE was not justified in refusing access to the records under section 36(1)(b) of the FOI Act.
Having carried out a review under section 22(2) of the FOI Act, I annul the HSE’s decision and direct the release of the records.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Deirdre McGoldrick
Senior Investigator