Decision
Ms A and the Department of Social Protection (the Department)
From Office of the Information Commissioner (OIC)
Case number: 130307
Published on
From Office of the Information Commissioner (OIC)
Case number: 130307
Published on
Whether the Department's decision to refuse to release certain records to the applicant, relating to inappropriate accesses to her and her family's personal records by a staff member of the Department, was justified in line with the provisions of sections 10(1)(a), 21(1)(a), 21(1)(b) and 28(1) of the FOI Act
9 July 2014
On 3 July 2012, the applicant made a request to the Department under the FOI Act for certain records relating to unauthorised accesses made to her and her family's personal records, which she was aware were carried out by a Department staff member. Based on previous correspondence with the applicant related to the matter of the unauthorised data accesses, the Department detailed its understanding of her requirements in its response to the request (which did not issue until 17 April 2013) which can be summarised as follows:
In its response, the Department granted access to some of the records it understood to have been requested by the applicant. In doing so, it pointed out that full records pertaining to the unauthorised data accesses had already been supplied to her. It stated that it had previously explained to her that there was no report made to the ODPC, as it had not sought such a report. However, the Department stated that the ODPC had been kept fully appraised of the position in relation to the data accesses, and the Department also pointed out that it had previously supplied records pertaining to the Department's correspondence with the ODPC to the applicant. In addition, the Department refused access to records pertaining to the internal investigative and disciplinary processes pertaining to the matter, citing sections 21(1)(a) and 21(1)(b) of the FOI Act as the basis for doing so. In its decision the Department also released details of the actions taken to secure and recover the compromised personal data, including contacts with external agencies and the Gardaí, although, in doing so, it redacted personally identifiable information pertaining to third parties.
The applicant submitted a request for an internal review of the Department's decision on 16 May 2013. In her submission, she claimed that the Department's summary of the records sought by her was incomplete, and she raised issues regarding a lack of clarity in the original FOI decision as to what records were withheld from her, and the basis for those records being withheld. She further objected to the withholding of documents under sections 21(1)(a) and 21(1)(b) of the FOI Act. She also said that certain information that the Department had claimed it had supplied to her had not, in fact, been supplied in full.
In its internal review response dated 4 June 2013, the Department explained in detail what information had previously been provided to her, pertaining to the data accesses. The Department's reviewer affirmed the previous decision to refuse certain records under sections 21(1)(a) and 21(1)(b) of the FOI Act, but acknowledged a failure to provide explanations regarding material issues relevant to the decision perviously, and provided a list of the material issues in question, including matters pertaining to the relevant public interest test. In addition, the Department provided the names of certain officials which had previously been redacted from the records under section 28 of the FOI Act.
The inappropriate data accesses at issue in this case had been carried out by a named official of the Department, who was alleged to have subsequently passed the information on to an employee of Teagasc. The Department had withheld the name of the Teagasc official in question, in response to the original FOI request, and it affirmed that decision in the internal review. Notwithstanding that the Teagasc employee was a public official, this was done on the grounds that:
The applicant submitted a request to this Office for a review of the Department's decision on 3 December 2013. In subsequent correspondence between this Office and the Department, the Department acknowledged that the applicant should have been given an opportunity to reapply for material relevant to the investigation at the conclusion of the investigation, and stated that substantial additional information pertaining to the investigation had, in fact, been released to the applicant in response to a separate, but related, FOI request.
In carrying out my review, I have had regard to correspondence between the Department and the applicant as set out above; to details of various contacts between this Office and the Department; to details of various contacts between this Office and the applicant, and, in particular, the 'preliminary views letter' dated 20 May 2014 sent to her by Mr. Richie Philpott, Investigator in this Office, in which he presented a summary of the reasons why no further records should be released to her. In response, the applicant submitted an email dated 26 June 2014, indicating her disagreement with the preliminary views letter, and I have therefore decided to conclude the review by way of a formal binding decision. In her email, the applicant also submitted a number of queries regarding matters pertaining to the review, and I have also had regard to that email in formulating this decision, along with the relevant provisions of the FOI Act. Furthermore, in considering the public interest at section 28(5)(a), I have had regard to the judgment of the Supreme Court issued in July 2011 in the case of The Governors and Guardians of the Hospital for the Relief of Poor Lying-In Women v The Information Commissioner(which I will refer to below as "the Rotunda judgment").
The scope of my review is confined to the question of whether the Department has justified its decision to refuse certain records to the applicant in accordance with the provisions of sections 10(1)(a), 21(1)(a), 21(1)(b) and 28(1) of the FOI Act.
Section 10(1)(a) of the FOI Act states as follows: "10.—(1) A head to whom a request under section 7 is made may refuse to grant the request if— (a) the record concerned does not exist or cannot be found after all reasonable steps to ascertain its whereabouts have been taken...”. In her application to the Information Commissioner, the applicant specified that she believed that more records should have been available to her. In its response to the internal review request, dated 4 June 2013, the Department informed the applicant that the records she is seeking no longer exist.
The Commissioner's role, in cases such as this, is to review the decision of the public body and to decide whether that decision was justified. This means that I must have regard to the evidence available to the decision maker and the reasoning used by the decision maker in arriving at his/her decision. The relevant evidence in cases of this type is evidence about the record management practices of the public body which formed the basis for the public body's conclusion that the steps taken to locate records were reasonable. The Office's understanding of its role in such cases was approved by Mr Justice Quirke in the High Court case of Matthew Ryan and Kathleen Ryan and the Information Commissioner (2002 No. 18 M.C.A. available on this Office's website,www.oic.ie).
The applicant contends that certain 'screen shots' of data, as it existed on the Department's computer system at the time it was inappropriately accessed, would have been taken by the Department staff investigating the matter. The Department made a submission to this Office, dated 16 January 2014, in which it clarified why the records the applicant is seeking can no longer be located. It explained how the records in question comprised of data entries on computer screens which may have, in the ordinary course of business, been changed after they were originally viewed and accessed in 2011, prior to the matter of the inappropriate accesses coming to light at a later date. I have carefully considered the explanations provided by the Department concerning the records sought by the applicant, and I am satisfied that the Department was justified in refusing access to any records other than those already considered by it for release, in accordance with the provisions of section 10(1)(a) of the FOI Act. I find accordingly.
Section 28(1) of the FOI Act provides that, subject to other provisions of section 28, a public body shall refuse a request for a record where granting it would "involve the disclosure of personal information" about an identifiable individual. The FOI Act defines personal information as “information about an identifiable individual that— (a) would, in the ordinary course of events, be known only to the individual or members of the family, or friends, of the individual, or (b) is held by a public body on the understanding that it would be treated by it as confidential..." and goes on to list 12 types of information which are included in the definition, including, pertinently in this case "(x) the name of the individual where it appears with other personal information relating to the individual or where the disclosure of the name would, or would be likely to, establish that any personal information held by the public body concerned relates to the individual, ".
The material which has been withheld in this case consists of the names of certain members of the public and certain public officials, in the context of an investigation of allegations made against an employee of the Department. While the definition of personal information in the Act excludes information pertaining to the name, terms of employment or the work performance of employees of public bodies, the Information Commissioner has previously found that records relating to investigations of allegations of misconduct by such employees do not fall within this exclusion, and they therefore constitute personal information. A relevant case is case no. 080050 Philip Boucher-Hayes, RTÉ and County Council X (decision date 19 August 2008; available on this Office's website,www.oic.ie) and a pertinent extract from the decision is as follows:
"..... the records sought by the requester (if they exist) pre-suppose mis-conduct or a breach of discipline at work; they suggest the likelihood of complaints having been made, of an investigative process and of action within the terms of the Council's Grievance and Disciplinary Procedures. If it were the case that the employee had been involved in mis-conduct, and that this mis-conduct arose in the course of the employee's work, I do not accept that any such mis-conduct could be characterised as being for the purpose of the performance of the employee's functions. While mis-conduct may sometimes occur while at work, and indeed may be facilitated by virtue of the work position held by an individual, it cannot be said to be something done for the purposes of performing one's work functions. Accordingly, the qualification on the definition of "personal information" cited above does not apply to the type of information sought by the requester.
Having considered the matter carefully, I am satisfied that records of the type sought by the requester would, if they exist, constitute information held by the Council on the understanding that it would be treated as confidential. I believe this would be the case even if it were the situation that there was some public knowledge of allegations having been made or of a disciplinary process having been initiated. It would be unconscionable for a public body, engaged in a process of dealing with allegations of mis-conduct, not to treat information relating to the process as confidential. I am satisfied that this would be the case both while such a process is underway as well as following the conclusion of the process. This does not necessarily create an absolute prohibition on the release, under the FOI Act, of records of such a process. Confidential material may in certain instances be released in the public interest; but this does not change the fact that the material is held in confidence."
In this case, it is clear to me that all of the records which have been withheld by the Department are records to which section 28(1) applies, and I find accordingly.
Section 28(2) provides that Section 28(1) does not apply in certain circumstances. Having examined the records in question I am satisfied that Section 28(2) is not relevant because the information withheld does not relate to the applicant; the third party to whom the information refers has not given prior consent to the release of the records to the applicant; the information is not of a kind that is available to the general public; nor does it belong to a class of information that might be made publicly available; and disclosure of the information is not necessary to avoid a serious and imminent danger to the life or health of an individual.
Section 28(5) provides that a record containing the personal information of a third party may be released in certain limited circumstances. The exemption could be set aside if (a) on balance, the public interest that the request should be granted outweighs the public interest that the right to privacy of the individual to whom the information relates should be upheld, or (b) the grant of the request would benefit the individual. I do not consider section 28(5)(b) to be of relevance in this case as I do not consider that release of the information at issue would benefit the individuals to whom it relates as envisaged by section 28(5)(b) of the FOI Act.
In relation to section 28(5)(a) , in the Rotunda judgment referred to earlier, the Supreme Court outlined the approach that the Commissioner should take when balancing the public interest in granting access to personal information with the public interest in upholding the right to privacy of the individual(s) to whom that information relates. Following the approach of the Supreme Court, a public interest ("a true public interest recognised by means of a well-known and established policy, adopted by the Oireachtas, or by law") must be distinguished from a private interest for the purpose of section 28(5)(a). The language of section 28 and of the Long Title to the FOI Act recognise a very strong public interest in protecting the right to privacy (which has a Constitutional dimension, as one of the un-enumerated personal rights under the Constitution). Accordingly, when considering section 28(5)(a), privacy rights will be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy.
I consider that there is a public interest in ensuring openness, transparency and accountability in the public service and in ensuring openness and transparency in how a public body performs its functions. I accept that there is a public interest in the disclosure of information which will allow for increased transparency and accountability in how the Department deals with matters such as arise in this case. It is noteworthy that the Department has already released a significant number of relevant records pertaining to the appropriate data accesses which are central to this FOI review. In my view, the public interest in this matter (as opposed to any private interest of the applicant) is served to some extent by the release of records which show how the Department dealt with the allegations in question. While I accept that the release of further records may serve to increase the level of the Department's accountability in this matter, I am satisfied that the public interest in doing so is not sufficient to outweigh, on balance, the significant privacy rights of the individuals concerned. I therefore consider that the Department has justified its decision to refuse to release any further records in response to the applicant's FOI application, in accordance with section 28(1) of the FOI Act. I find accordingly.
As I have found that the remaining withheld information has been properly exempted in line with the provisions of sections 10(1)(a) and 28(1) of the FOI Act, I do not consider it necessary to examine the application by the Department of sections 21(1)(a) and 21(1)(b) to that information.
Having carried out a review under section 34(2) of the Freedom of Information Act 1997 (as amended) I hereby uphold the Department's refusal of the records concerned.
A party to a review, or any other person affected by a decision of the Information Commissioner following a review, may appeal to the High Court on a point of law arising from the decision. Such an appeal must be initiated not later than eight weeks from the date on which notice of the decision was given to the person bringing the appeal.
Sean Garvey
Senior Investigator