Decision
Mr M & The Health Products Regulatory Authority (the HPRA)(FOI Act 2014)
From Office of the Information Commissioner (OIC)
Case number: 180030
Published on
From Office of the Information Commissioner (OIC)
Case number: 180030
Published on
Whether the HPRA was justified in refusing to grant access to additional information/records in the format sought by the applicant relating to adverse reaction reports concerning the vaccine Gardasil, and relating to the database maintained by the HPRA containing these reports, on the basis of sections 15(1)(a), 35(1) and 37(1) of the FOI Act
28 August 2018
On 29 September 2017, the applicant sought access under FOI to a database extract comprising all records generated by submissions to the Human Medicines Adverse Reaction Report page on the HPRA's website, as well as equivalent reports submitted in any other way, in relation to any form of the vaccine Gardasil. The HPRA indicated that the records sought were routinely made available outside of FOI, and that it would proceed on that basis. The HPRA released a record containing some of the information the applicant requested, and attached what was described as a "caveat document" which it said should be included where the information was used or published. While the applicant had sought access in a machine-readable format the record was released as a PDF.
In response, the applicant again sought a machine-readable copy of the record with additional fields and made a second FOI request seeking access to a list of database type(s) used by the HPRA to store adverse reaction reports; a list of software used by the HPRA in relation to such data; a list of the column headings in such data; confirmation whether data in each column is populated and confirmation whether data in each column is accessible to HPRA staff.
On 17 November 2017, the HPRA provided another copy of the report previously provided, this time in Excel format. In relation to the additional information sought, its position was that the information withheld had been provided in confidence and that release of further details could allow for patients to be identified. It stated that the applicant's second request was not a valid FOI request, as he had sought access to information, rather than records. However, nonetheless in an apparent attempt to answer his question relating to the column headings, it provided screenshots of the questions asked when reporting an adverse reaction as well as answers to the other queries. It did not refer to the FOI Act in either response. On 29 November 2017, the applicant requested an internal review in relation to both requests. He also indicated that the format of the report provided was not machine-readable.
On 28 December 2017, the HPRA issued an FOI decision on his requests. It stated that they had originally been dealt with outside FOI, but that it was now considering these as requests under the FOI Act. It also stated that it had made a decision to part-grant his requests, and identified three records, two of which related to his first request (records 1.1 and 1.2), and one to his second request (record 2). It released records 1.1 and 2 in full and record 1.2 in part. It relied on sections 35 (information given in confidence) and 37 (personal information) to withhold access to some information contained in record 1.2. It indicated that he could appeal to the HPRA if he was unhappy with its decision.
On the basis that the HPRA had not made an internal review decision as requested, the applicant applied to this Office on 4 January 2018 for a review of the HPRA's decision in both cases. This Office accepted the application on the basis of deemed refusals at internal review stage. Following correspondence from this Office, the HPRA issued an effective position letter to the applicant on 18 January 2018, wherein it varied its original decision. It referred to the same three records as above but broke down Record 1.2 using the headings specified by the applicant in his request for more information. It again relied on sections 35 and 37 of the FOI Act in its refusal to grant access to most of the additional information sought and stated that the public interest had been met by the information already released. In relation to his second request, the HPRA again set out the information it had provided in response to his queries.
The applicant applied to this Office for a review of the HPRA's effective position on 26 January 2018. This Office's Investigator contacted the applicant and outlined her view that section 15(1)(a) of the FOI applied in this case, insofar as it seemed to her that the HPRA did not hold a record containing all of the information sought by the applicant in relation to the first part of his request. She also informed him of her view that his second request was not valid under FOI, as he had sought information which was not contained in a record. She invited him to comment in this regard. The applicant has indicated that he does not agree with her views and contended that it was possible for the HPRA to export the information sought in his first request, as well as a list of the column headings in the database, into an electronic record/database extract.
During the course of this review, the HPRA released an updated version of the original report provided to the applicant in respect of his first request. The applicant has indicated that he is not satisfied with the format of this record. In essence, his view is that none of the information released by the HPRA to date meets the particulars of his request. Having completed my review, I have decided to bring this case to a close by way of a formal, binding decision.
In conducting this review, I have had regard to the correspondence between the HPRA and the applicant as set out above. I have also had regard to the communications between this Office and both the applicant and the HPRA, as well as the contents of the records concerned.
Section 11(8) of the FOI Act provides that the Act does not prohibit or restrict an FOI body from giving access to a record (including an exempt record) outside the Act "where such publication or giving of access is not prohibited by law." Accordingly, the HPRA is not precluded from granting access to records outside FOI. However, while the applicant in this case initially did not object to his request being processed in this manner, it was clear that he expected to a receive a copy of all the information sought, in the format he had requested. Furthermore, where a requester expressly states that he wishes to make a request under FOI, I would expect the relevant public body to process it as required by the Act, unless of course it was providing access to all of the records sought outside FOI. To be clear, I would expect the HPRA to have regard to its obligations under the FOI Act when dealing with future FOI requests. In this regard, I encourage decision makers to use the FOI resources available, including guidance on the FOI Act published by the Central Policy Unit of the Department of Public Expenditure and Reform and by my Office, to assist them in their decision-making and in ensuring that their decisions comply with their obligations under the Act.
It is important to note that with certain limited exceptions, the FOI Act does not provide for the limiting of access to records to particular individuals only. When a record is released under the FOI Act, it effectively amounts to disclosure to "the world at large" (H.(E.) v Information Commissioner [2001] IEHC 58). The Act places no restrictions on the type or extent of disclosure or the subsequent use to which the record may be put. While I note that a "caveat document" was not mentioned in the text of the HPRA's FOI decision on 28 December 2017 or its letter of 18 January 2018, it was included with the hardcopy of the records released to the applicant and in the amended record released during this review. The document purports to put the data in context, as well as giving "guidance on the interpretation" of adverse reaction listings. However, it also requests that a copy be added to the listings if the user intends to publish or circulate them, and clearly states that any proposed publication should be sent to the HPRA for "review/comment" before being published. For the avoidance of doubt, I would remind the HPRA that while it is open to an FOI body to provide further information so as to explain or clarify some aspect of records released under FOI, it cannot impose restrictions on how such records are used.
It is important to note that requests for information, such as the applicant's second request in most part, as opposed to requests for records, are not valid requests under the Act. The FOI Act does not generally provide a mechanism for answering questions, except to the extent that a question can reasonably be inferred to be a request for a record containing the answer to the question asked or the information sought. However, the applicant has contended that the HPRA should be able to export a list of field names or column headings from the database, so I will consider this below.
The applicant seems to be of the view that the HPRA did not dealt with his requests in good faith. Furthermore, he has requested that this Office make various rulings on aspects of this case. It is, however, important to note that in dealing with a section 22 review, this Office has no remit to investigate complaints, to adjudicate on how FOI bodies perform their functions generally, or to act as an alternative dispute resolution mechanism with respect to actions taken by FOI bodies.
Having regard to the above, this review is concerned with whether the HPRA was justified in refusing to grant access to additional electronic records in the format sought relating to adverse reaction reports and column headings in the HPRA's database, under section 15(1)(a) on the basis that no such records exist once all reasonable steps have been taken by the HPRA under section 17 of the Act.
It is also concerned with whether the HPRA was justified in refusing to grant access to additional fields contained in the record created by it in response to the applicant's request, on the basis of sections 35 and 37 of the FOI Act.
Section 15(1)(a) of the FOI Act provides that a request for access to records may be refused if the records do not exist or cannot be found after all reasonable steps to ascertain their whereabouts have been taken. The Commissioner's role in cases such as this is to review the decision of the FOI body and to decide whether that decision was justified. This means that I must have regard to the evidence available to the decision maker and the reasoning used by the decision maker in arriving at his/her decision.
It is also important to note that while the purpose of the FOI Act is to enable members of the public to obtain access to information held by public bodies, the mechanism for doing so is by accessing records held by those bodies. In other words, a person wishing to obtain information from a public body must make a request for records that contain the information sought. If the record sought does not exist, the body concerned is not required to create records to provide the information sought, apart from specific requirements under section 17(4). Furthermore, the FOI Act does not require public bodies to amend or add fields to existing records.
As set out above, the applicant's first request was for all records generated by adverse reaction reports relating to the drug Gardasil submitted online or otherwise. He also sought details of the various field names or headings under which the information submitted was collected. Under section 17(4), where a request relates to data contained in more than one record held on an electronic device by the body concerned, the body must take reasonable steps to search for and extract the records to which the request relates. The reasonable steps are those that involve the use of any facility for electronic search or extraction that existed on the date of the request and was ordinarily used by the FOI body. Where these reasonable steps result in the creation of a new record, that record is, for the purposes of considering whether or not such a new record should be disclosed in response to the request, deemed to have been created on the date of receipt of the request.
I should say at the outset that it is not in dispute that the HPRA holds additional information of relevance to the applicant's request. The form on the HPRA website is open to anyone reporting an adverse reaction to a drug and these reports feed into the database. The HPRA stated that its own staff enters adverse reaction reports provided in hardcopy onto the database. However, it also said that while the database was set up with a number of pre-programmed reports, the HPRA had no in-house expertise to generate wider reports such as that sought by the applicant. When asked what steps it would have to take to create a record like the one sought in his first FOI request, the HPRA stated that it would take the same steps as it took in this case, i.e. that it would generate a standard report from the database and manually add the rest of the information sought. In relation to the applicant's second request for access to a list of field names, the HPRA stated that a list of all of the fields in the database could not be automatically generated. It also stated that it had responded to the applicant's other queries in that request by providing information.
The applicant does not agree with the HPRA's responses in relation to the types of report available to it. He has argued that the generation of an electronic record containing the information sought in both of his requests is a “simple matter”, which could be done using software which "is in daily use by user-level employees in almost every government department". He has also offered to provide expert witnesses to support his arguments in this regard. The applicant further argued that FOI bodies should not be allowed to avoid their obligations under FOI simply because they fail to have the capacity to generate additional reports or records from databases. He said that is in contravention of the letter and the spirit of the FOI Act.
While I note his comments, this review is only concerned with whether records covered by his request exist and, if they do, whether such records are exempt. Whether or not the HPRA uses its databases in the most efficient or effective manner is not under consideration here. Furthermore, it seems to me that while public bodies collect, generate and use vast amounts of information as a matter of course, the maintenance of and access to such information relates to their own particular functions and reporting requirements. Simply put, FOI bodies are not required to design reports and systems in order to best answer FOI requests.
Having considered the HPRA's and the applicant's submissions, and having regard to the limitations on the steps required to extract data contained in records held electronically (i.e. the facility for electronic search or extraction must have existed on the date of the request and be a facility which is ordinarily used by the body), I accept that the HPRA does not hold a record containing all of the information sought by the applicant in his first request. In relation to his second request, which I consider to be mainly a request for information, rather than records, I accept the HPRA's explanation that it cannot export a list of field names/column headings relating to the database.
I find, therefore, that the HPRA was justified in refusing to release additional records in relation to the applicant's requests concerning details of adverse reactions reports, and details of the field names/headings used in its database, under section 15(1)(a) of the FOI Act.
The applicant originally sought a database extract in machine-readable format. He has indicated that he is not satisfied with the format of any of the records provided by the HPRA in response to his request and has stressed that he is seeking a database extract rather than records exported or generated from the database. In this regard, he referred to the Reuse of Public Sector Information (RPSI) regulations, amongst other things, although I have no informaiton as to whether he has made a request under this legislation. However, it is important to note that the RPSI regulations do not provide a right of access to records or information. Rather they provide for a right to reuse information held by a public body where a right of access already exists.
In any event, the HPRA has stated to this Office that no alternative report format is available to it. My understanding is that it has no facility in use to export database extracts and solely uses the standard reports set up on its system. Having considered the matter carefully, I find that the HPRA was justified in providing access to the record released in the format provided, on the basis that it has stated that it cannot export the information in any other manner.
The record provided to the applicant during this review contains two fields which were manually added by the HPRA: Age Range and Reporter Type. The applicant has indicated that he is not satisfied with the information in these columns and queried its accuracy. However, this Office has no role in assessing the accuracy or otherwise of records released by an FOI body. Furthermore, while I understand that the HPRA provided this information in an attempt to assist the applicant, as noted above, it is under no obligation to create a new record or add to a record already released.
In response to the applicant's initial request. the HPRA released a limited report generated from its system which it manually added to. As noted above, the HPRA released an updated version of this record to the applicant during the course of this review, which included an amended Age Range column and Reporter Type details. It refused to grant access to information contained the following fields contained in the report: Patient Age, Patient Weight, Reporter Organisation and Reporter County on the basis of sections 35 and 37 of the FOI Act. Having carefully examined the record in question, it appears to me section 37 is of most relevance. Accordingly, I will consider its applicability to the information withheld in the first instance.
Section 37(1) of the FOI Act provides that access to a record shall be refused if access would involve the disclosure of personal information.
The FOI Act defines the term "personal information" as information about an identifiable individual that either (a) would, in the ordinary course of events, be known only to the individual or members of the family, or friends, of the individual or (b) is held by an FOI body on the understanding that it would be treated by the body as confidential. The definition also contains a list of 14 specific types of information including (i) information relating to the educational, medical, psychiatric or psychological history of the individual and (viii) information relating to the religion, age ... of the individual.
The information withheld comprises the age and weight of individual patients, as well as the specific organisation (e.g. clinic, GP, pharmacy etc) and county of the person making the report. In most cases, if not all, the reporter is based in the same county as the patient.
The HPRA stated that while many adverse reaction reports contain limited information (as not all fields are mandatory or have to be completed), they all contained personal and sensitive personal health information. It also stated that this information is submitted in confidence, on the understanding that it will be treated as confidential, for the sole purpose of safety monitoring. The HPRA further stated that it had seen examples of adverse reaction reports being matched to individuals based on limited information and that anonymising the data was not a matter of simply removing fields which identify patients by name or initials. It also made the point that most of the adverse reports relating to Gardasil concerned children, as the majority of the patients were between 12-17 years old.
The applicant does not agree with the HPRA's views (or those of this Office's Investigator) as to what constitutes the personal information of the individuals concerned. He said that he sought the records at issue suitably anonymised. However, the use of the particular drug in this case has been controversial and a number of social media pages and websites contain detailed information about patients and their experiences with Gardasil. Having examined the record created by the HPRA in detail, it is clear that some counties have very few reports, and that many of the reported symptoms are quite detailed and specific. I am aware that many cases involving the Gardasil vaccine have also been reported in the media, and a brief online search using the information in the record provided by the HPRA to this Office for the purposes of this review allowed me to match one adverse reaction report with a named patient. I have no reason to believe that others could not be similarly identified. As explained above, release to the applicant under FOI must be taken as release to the world at large.
In the circumstances of this case, I am satisfied that the information withheld from release (age, weight, reporter organisation and county) comprises the personal information of identifiable individuals and falls under the definition of personal information in the FOI Act. Accordingly, I find that section 37(1) applies to the information contained in the record concerned.
Section 37(2) of the FOI Act sets out certain circumstances in which 37(1) does not apply. However, I am satisfied that none of those circumstances arises in this case. Section 37(5) provides that a request that would fall to be refused under section 37(1) may still be granted where, on balance:
"(a) the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or
(b) the grant of the information would be to the benefit of the person to whom the information relates."
As I find no basis for concluding that the release of the information concerned would be to the benefit of the third party individuals to whom it relates, I find that section 37(5)(b) does not apply.
In considering the public interest test contained in section 37(5)(a), it is important to have regard to the comments of the Supreme Court in The Governors and Guardians of the Hospital for the Relief of Poor Lying-In Women v. the Information Commissioner[2011] IESC 26. It is noted that a public interest ("a true public interest recognised by means of a well known and established policy, adopted by the Oireachtas, or by law") should be distinguished from a private interest. In this case, I consider that the public interest in openness and transparency in how the HPRA monitors and collects adverse reaction reports has been satisfied to some extent by the information already released to the applicant. Furthermore, I find that the public interest in granting access to the remaining information at issue (age, weight, reporter organisation and county) does not, on balance, outweigh the public interest in upholding the right to privacy of the individuals concerned.
Accordingly, I find that the HPRA was justified in refusing to release any additional information contained in the report it created in response to the applicant's request on the basis of section 37(1).
As I have found the decision of the HPRA to refuse access to additional information in the record at issue to be justified under section 37, I do not have to consider the application of section 35 to the withheld record.
Having carried out a review under section 22(2) of the Freedom of Information Act 2014, I hereby affirm the decision of the HPRA to refuse to release any additional records to the applicant on the basis of sections 15(1)(a) and 37(1).
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Elizabeth Dolan
Senior Investigator