Decision
Mr Y and Enterprise Ireland
From Office of the Information Commissioner (OIC)
Case number: OIC-141912-G9B3V7
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-141912-G9B3V7
Published on
Whether Enterprise Ireland was justified in refusing, under sections 35(4) and/or 37(6) of the FOI Act, the applicant’s request for records relating to an investigation of the treatment of a group of female entrepreneurs by senior members of Enterprise Ireland
1 May 2024
In a request dated 16 June 2023, the applicant sought access to all records, from June 2018 to the date of his request, relating to an investigation carried out by a named Enterprise Ireland official regarding the treatment of a group of female entrepreneurs by senior members of Enterprise Ireland. On 30 June 2023, Enterprise Ireland refused the request under section 37(1) of the FOI Act which is concerned with the protection of third party personal information. The applicant sought an internal review of that decision on the ground that third party personal information can be redacted from any such records. On 25 July 2023, Enterprise Ireland affirmed its refusal of the request, and also cited sections 30(1)(a), 30(1)(b) and 35(1)(a) of the Act as additional grounds for refusal. On 29 August 2023, the applicant applied to this Office for a review of Enterprise Ireland’s decision.
During the course of the review, Enterprise Ireland explained in its submissions to this Office that, while not explicit in its decisions, it refused the applicant’s request pursuant to the “refusal to confirm or deny” provisions set out in sections 35(4) and 37(6) of the Act. The investigator notified the applicant of Enterprise Ireland’s position and invited him to make submissions, which he duly did.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the correspondence outlined above, and to the submissions made by both parties during the review. I have decided to conclude this review by way of a formal, binding decision.
This review is concerned solely with whether Enterprise Ireland was justified in refusing, under sections 35(4) and/or 37(6) of the FOI Act, the applicant’s request for records relating to a specified investigation.
Before I address the substantive issues arising in this case, I would like to make some preliminary comments. First, it is important to note that while I am required by section 22(10) of the FOI Act to give reasons for my decisions, this is subject to the requirement of section 25(3) that I take all reasonable precautions to prevent disclosure of information contained in an exempt record during the course of a review. Accordingly, in the analysis which follows, I must be careful not to disclose whether or not records of the type sought by the applicant exist in light of Enterprise Ireland’s reliance on the relevant refusal to confirm or deny provisions.
Secondly, it is important to note that a review by this Office is considered to be “de novo", which means that in this case, it is based on the circumstances and the law as they pertain at the time of the decision and is not confined to the basis upon which the FOI body reached its decision. As such, I deem it appropriate to consider the revised position of Enterprise Ireland in respect of the request at issue.
Before I consider Enterprise Ireland’s decision to refuse the applicant’s request under the neither confirm nor deny provisions of the Act, I wish to address the applicant’s argument that Enterprise Ireland has, by virtue of its original and internal review decisions on the request, already confirmed the existence of records. He said this new position does not tally with the rejection of his request, which explicitly listed the relevant provisions of the Act which Enterprise Ireland sought to rely on. He said the rejections included explicit reference to the existence of documents, stating for example: “the record concerned would involve the disclosure of personal information”. He said that relying on the other FOI provisions (rather than referring to or relying on the “neither confirm nor deny” provisions) is a clear confirmation of the existence of relevant records. Furthermore, the applicant said that disclosing documents confirming that an investigation of this nature took place does not automatically identify either the complainant or the individual about whom a complaint was made.
In its submissions to this Office, Enterprise Ireland said that at the original decision stage, it refused the request based on 37(1) of the FOI Act and stated that “All such records would contain the personal information of the parties involved or information which would facilitate the identification of those involved and therefore this could not be released under FOI”. Enterprise Ireland said that this was due to its position of neither confirming nor denying the existence of the records referenced in the request, given that to do so would, in its view, involve the effective disclosure of personal information of identifiable individuals. Enterprise Ireland said that when affirming its decision at the internal review stage, it cited additional exemption provisions that would be relevant to such records, namely, sections 30(1)(a), 30(1)(b) and 35(1)(a) of the FOI Act. Enterprise Ireland stated that while it did not specifically reference the ‘neither confirm nor deny’ provisions in sections 35(4) and 37(6) of the FOI Act in its decisions, the lack of reference to the particular provisions was an oversight. It said, however, it was a fundamental basis on which the decisions were made.
Having examined the decisions letters in question, the applicant’s comments are understandable. The decisions are poorly drafted and I can think of no reason why Enterprise Ireland could not have cited the relevant provisions it now seeks to rely on for refusing the request. Nevertheless, I accept its statement that its failure to do so was simply an oversight. I also accept that the poorly drafted decisions do not definitively state, one way or another, whether relevant records coming within the scope of the applicant’s request exist. Accordingly, I deem it appropriate to consider Enterprise Ireland’s claims that section 35(4) and37(6) apply.
Having regard to the wording of the applicant’s request and the nature of the records sought, I believe section 37(6) to be of most relevance in this case and I will consider its applicability first.
Section 37 of the FOI Act
Section 37(1) provides, subject to the other provisions of the section, for the mandatory refusal of a request where it considers that access to the record concerned would involve the disclosure of personal information relating to an individual or individuals other than the requester. Section 37(6) provides that where a request relates to a record that would fall to be refused under section 37(1) if it existed and the FOI body considers that the disclosure of the existence or non-existence of a record would involve the disclosure of personal information relating to an individual or individuals other than the requester, it must refuse the request and must refuse to disclose whether or not the record exists. This provision of the Act is intended to protect the personal information of a third party in situations where knowledge of the existence, or non-existence, of particular records would effectively disclose that party's personal information.
The usefulness of section 37(6) depends upon it being invoked both in instances in which relevant records do not exist as well as in cases in which relevant records do exist. In short, for section 37(6) to apply, the following requirements must be satisfied:
Section 2 of the FOI Act defines personal information as information about an identifiable individual that either (a) would ordinarily be known only to the individual of his/her family or friends or (b) is held by an FOI body on the understanding that it would be treated by the body as confidential. The Act details fourteen specific categories of information which are included in the definition without prejudice to the generality of the forgoing definition, including iii) information relating to the employment or employment history of the individual, (v) information relating to the individual in a record falling within section 11(6)(a)’ (a personnel record), (xii) the name of the individual where it appears with other personal information relating to the individual or where the disclosure of the name would, or would be likely to establish that any personal information held by the FOI body concerned relates to the individual, and (xiv) the views or opinions of another person about the individual.
Certain information is excluded from the definition of personal information. Where the individual holds or held a position as a member of the staff of an FOI body, the definition does not include his or her name, or information relating to the position, the functions of the position, the terms upon and subject to which the individual holds or held that position, or anything written or recorded in any form by the individual in the course of and for the purpose of the performance of his or her functions (Paragraph I refers). The exclusion at Paragraph I does not exclude all information relating to staff members. The exclusion is intended, in essence, to ensure that section 37 cannot be used to exempt the identity of a public servant in the context of the particular position held or any records created by the staff member while carrying out his or her official functions, or information relating to the terms, conditions and functions of positions. The exclusion does not deprive public servants of the right to privacy generally.
The applicant’s request was for records commencing from a particular year in the past and relating to an investigation regarding the treatment of a group of female entrepreneurs by senior members of Enterprise Ireland. Enterprise Ireland said if such records existed, their disclosure would identify key individuals connected to the complaints and investigation, specifically the complainant and the accused. It said that at the time, nationally the community of female entrepreneurs was low, and Enterprise Ireland had a strategic ambition to increase this number. It said it engaged with female entrepreneurs through the High Potential Start Up funding programme, which was managed by the High Potential Start Up Team. It said that without any further information, a staff member or external client / stakeholder could identify this group. It added that the female entrepreneurs received High Potential Start Up funding, which was the underpinning basis of the agency’s relationship with these individuals. It said that at this time, Enterprise Ireland approved annually approximately 90 High Potential Start Up, of which 20 to 25 were led by female entrepreneurs. It said the names of all funded High Potential Start Up are published by the agency annually.
Having considered Enterprise Ireland’s submission and having regard to the request made and the nature of the records sought, I am satisfied that the disclosure of such records, if they existed, would involve the disclosure of personal information relating to identifiable individuals, namely the individuals under investigation and the individuals who may have been the subject of the treatment under investigation. For the avoidance of doubt, such information in respect of Enterprise Ireland staff members would not, in my view, be captured by the exclusion to the definition of personal information. I find, therefore, that the disclosure of the records sought, if they existed, would involve the disclosure of third party personal information and that section 37(1) would apply to such records.
Section 37 provides for certain circumstances where subsection (1) does not apply. Subsection (2) sets out certain circumstances in which the exemption at section 37(1) does not apply. I am satisfied that none of the circumstances provided for in subsection (2) apply to the information concerned. Subsection (5) provides that a request that would fall to be refused under section 37(1) may still be granted where, on balance, (a) the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or (b) the grant of the request would benefit the person(s) to whom the information relates. I am satisfied that subsection (5)(b) does not apply in this case.
In relation to the applicability of subsection (5)(a), the applicant said in his submissions that an internal investigation into the treatment of a group of female entrepreneurs by senior members of a public body, responsible for the distribution of public funds, with an extensive Gender Equality Plan highlighting the importance of its own compliance with gender equality programmes, is of significant public importance.
In considering where the balance of the public interest lies in this case, I have had regard to section 11(3) of the Act which provides that in performing any functions under the Act, an FOI body must have regard to, among other things, the need to achieve greater openness in the activities of FOI bodies and to promote adherence by them to the principles of transparency in government and public affairs and the need to strengthen the accountability and improve the quality of decision making of FOI bodies. However, in doing so, I have also had regard to the judgment of the Supreme Court in The Minister for Communications, Energy and Natural Resources and the Information Commissioner & Ors [2020] IESC 57 (“the Enet case”). In that case, the Supreme Court found that a general principle of openness does not suffice to direct release of records in the public interest and “there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure”. Although the Court’s comments were made in cases involving confidentiality and commercial sensitivity, I consider them to be relevant to the consideration of public interest tests generally.
Both the language of section 37 and the Long Title to the FOI Act recognise a very strong public interest in protecting the right to privacy (which has a Constitutional dimension, as one of the un-enumerated personal rights under the Constitution). Unlike other public interest tests provided for in the FOI Act, there is also a discretionary element to section 37(5)(a), which is a further indication of the very strong public interest in the right to privacy. Privacy rights will therefore be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy.
It is also important to note that the release of information under FOI is, in effect, regarded as release to the world at large as the Act does not make any provision for restricting the use of information released pursuant to an FOI request. The essence of the applicant’s argument is that there is a significant public interest in disclosing details of an investigation of an FOI body’s compliance with gender equality programmes. While this may be the case, that public interest must be balanced against the privacy rights of the individuals concerned, which rights are afforded significant protection under the FOI Act. Having regard to the specific nature of the applicant’s request, this is not a case where records can be released whilst protecting privacy rights, if such records exist. Rather, release of the records would necessarily disclose personal information relating to identifiable individuals. In the circumstances, I am satisfied that the public interest in granting the request would not, on balance, outweigh the privacy rights of the individuals whose personal information would be disclosed.
I therefore find that the records sought are of a type whose release, if they existed, would involve the disclose of personal information of third parties and would be exempt from release by virtue of section 37(1). The final issue I must consider is whether the disclosure of whether or not relevant records exist would, of itself, disclose personal information relating to third parties. Having regard to the wording of the applicant’s request and the nature of the records sought in this case, I am satisfied that it would. I find, therefore, that Enterprise Ireland was justified in refusing the request under section 37(6) of the Act. Having found section 37(6) to apply, it is not necessary for me to consider the applicability of section 35(4) in this case.
Having carried out a review under section 22(2) of the FOI Act, I hereby affirm Enterprise Ireland’s decision to refuse, pursuant to section 37(6) of the FOI Act, the applicant’s request for records relating to an investigation of the treatment of a group of female entrepreneurs by senior members of Enterprise Ireland.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Stephen Rafferty, Senior Investigator