Decision
Ms X and Health Service Executive
From Office of the Information Commissioner (OIC)
Case number: OIC-102121-X6G7P4
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-102121-X6G7P4
Published on
Whether the HSE was justified in refusing access to further records comprising correspondence to and from a named staff member relating to a named nursing home, under section 15(1)(a) of the FOI Act on the basis that it holds no further records coming under the scope of the request and whether the HSE was justified in refusing access to records relating to the nursing home under sections 30(1), 36(1) and 37(1) of the FOI Act
26 April 2022
On 10 August 2020, the applicant submitted a request to the HSE for all correspondence to/from, and all reports send to or created by the Chief Officer of the HSE Midlands, Louth/Meath Community Health Organisation 8 regarding a named nursing home from 1 April 2020 to 30 May 2020. The HSE failed to issue a decision on the applicant’s request, and on 6 October 2020 she requested an internal review of the deemed refusal of her request. The HSE again failed to issue a decision, following which the applicant sought a review by this Office of the HSE’s deemed refusal of her internal review request.
The HSE subsequently issued its position on the request on 8 January 2021. It released 25 records with the redaction of information from each record under sections 30, 36 and 37(1) of the FOI Act. It withheld one record, page 62, under section 30 of the FOI Act. On 11 January 2021, the applicant indicated that she wanted the review to proceed and she argued that the HSE ought to hold further records falling under the scope of her request.
During the course of the review, the applicant confirmed that she wished to remove the price quoted for cleaning of the nursing home from the review. She also confirmed that she did not wish for any information which had been dealt with in case 111267 to be reviewed again
I have now completed my review in accordance with section 22(2) of the FOI Act. In conducting my review, I have had regard to the correspondence between the HSE and the applicant as outlined above and to correspondence between this Office and the HSE and the applicant on the matter.
This review is concerned solely with whether the HSE was justified in refusing access to further records falling within the scope of the applicant’s request under section 15(1)(a) of the FOI Act and whether the HSE was justified, under sections 30(1)(b), 36(1) and 37(1) of the Act, in refusing access to further information contained in the records identified.
Section 15(1)(a)
Section 15(1)(a) of the Act provides for the refusal of a request where the records sought do not exist or cannot be found after all reasonable steps to ascertain their whereabouts have been taken. The Commissioner's role in a case such as this is to review the decision of the FOI body and to decide whether that decision was justified. This means that I must have regard to the evidence available to the decision maker and the reasoning used by the decision maker in arriving at his/her decision and also must assess the adequacy of the searches conducted by the FOI body in looking for relevant records. The evidence in “search” cases generally consists of the steps actually taken to search for the records along with miscellaneous and other information about the record management practices of the FOI body, insofar as those practices relate to the records in question.
During the course of this review, this Office sought details of the searches carried out by the HSE in order to identify records falling with the scope of the request. In short, the HSE stated that it conducted searches of the inbox, sent folder and archived folders of two relevant email accounts for the dates 1 April 2020 to 30 May 2020. The HSE stated that the only search term used was the name of the nursing home.
The HSE also explained that it searched the post register for relevant correspondence. That post register records the details of when correspondence was received, from whom and the nature of the correspondence. The HSE stated that the post register did not contain any relevant entries for the relevant dates and therefore it was satisfied that it holds no relevant hardcopy correspondence.
In her application for review to this Office, the applicant said she was aware that the Chief Officer was copied into correspondence that had not been identified in response to the current request. She also argued that the because of his role, the Chief Officer must have been aware of a major operational decision taken in respect of the nursing home in April 2020, but that this was not evidenced by the records released.
I note from the information released to the applicant that the matter to which the applicant drew attention in her application for review is discussed in some of the records already provided to her. I note, however, that the applicant is of the view that further records discussing the matter ought to exist.
This Office asked the HSE whether the searches undertaken would have captured correspondence into which the Chief Officer would have been copied. In response, the HSE stated that such correspondence would have been captured by the searches undertaken. I accept that the searches undertaken of the inbox and archive of the relevant email accounts would have included emails received as a copied party.
The HSE, quite reasonably in my view, limited its searches to relevant email accounts and used the date parameters agreed by the applicant. I note, however, that in searching for relevant records the only search term used by the HSE was the precise term “[Name] Nursing Home”. It seems to me that such a limited search cannot reasonably be described as the HSE having taken all reasonable steps to ascertain the whereabouts of relevant records. It seems to me to be quite possible that the senders of the emails could reasonably have referred to the home without using the full title as contained in the search used. Moreover, the HSE did not indicate if it had interrogated the emails returned in its initial search to determine if other relevant correspondence sent to or by the Chief Officer in the relevant period might exist.
In the circumstances, I find that the HSE has not taken all reasonable steps to ascertain the whereabouts of records falling within the scope of the applicant’s request. I find, therefore, that it was not justified in refusing access, under section 15(1)(a), to any further relevant records other than those already identified.
I consider the most appropriate course of action to take at this stage is to annul the decision of the HSE in respect of the searches carried out, the effect of which is that it must consider the applicant’s request afresh and make a new, first instance, decision in accordance with the provisions of the FOI Act. The applicant will have a right to an internal review and a review by this Office if she is not satisfied with the HSE’s decision.
Section 37(1)
The HSE relied on section 37 of the FOI in redacting two broad categories of information from the records falling within the scope of the applicant’s request. It redacted email addresses, telephone numbers and names from pages 1 to 19, 21 to 23, 25 to 28, 30 to 37, 39 to 40, 42, 43, 45 to 48, 50, 51, 53 and 56 to 58 of the records. It also redacted information from pages 7, 9 to 12, 16, 18 to 24, 27 to 29 ,35 to 38, 40 to 45, 48, 49, 52, 54 and 58 to 60 on the basis that it comprised information about identifiable individuals, including a personal opinion of the owner of the nursing home.
Section 37(1) provides that, subject to the other provisions of the section, an FOI body shall refuse a request if access to the record concerned would involve the disclosure of personal information relating to an individual other than the requester. Section 2 of the FOI Act defines the term “personal information” as information about an identifiable individual that either (a) would, in the ordinary course of events, be known only to the individual or members of the family, or friends, of the individual or (b) is held by an FOI body on the understanding that it would be treated by the body as confidential.
Certain information is excluded from the definition of personal information. Where the individual holds or held a position as a member of the staff of an FOI body, the definition does not include his or her name, or information relating to the position, the functions of the position, the terms upon and subject to which the individual holds or held that position, or anything written or recorded in any form by the individual in the course of and for the purpose of the performance of his or her functions (Paragraph I refers).
The vast majority of the emails addresses, telephone numbers and names redacted from the records relate to HSE staff members and appear in records created in the performance of their functions as HSE staff. In its submission to this Office, the HSE stated that those details were redacted as they would be considered personal information under the General Data Protection Regulation (GDPR).
This is a wholly unsatisfactory response. The HSE has been subject to the FOI for many years now and it is unacceptable that it continues to seek to redact the names and contact details of staff members under section 37(1), or that it can reasonably believe that it is appropriate to rely on the provisions of data protection legislation to redact such information on foot of an FOI request. This Office has commented upon the interplay between the FOI Act and data protection legislation in a number of previous decisions. For the benefit of the HSE, I will repeat those comments here but I sincerely hope and expect that the HSE will take heed of these comments and that I will not have to address any such arguments again in future decisions.
Article 86 of the General Data Protection Regulation provides that personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in the public interest may be disclosed by the authority or body in accordance with Union or Member State law to which the public authority or body is subject in order to reconcile public access to official documents with the right to the protection of personal data pursuant to the Regulation. Section 44 of the Data Protection Act 2018 provides that, for the purposes of Article 86, personal data contained in a record may be disclosed where a request for access to a record is granted under and in accordance with the FOI Act 2014 pursuant to an FOI request.
In short, data protection legislation does not prohibit public bodies from processing FOI requests where the records sought contain personal information relating to individuals other than the requester. The FOI Act is entirely independent of data protection legislation and FOI requests for access to records must be processed in accordance with the provisions of the FOI Act. Indeed, the FOI Act provides for the release of personal information of third parties in certain circumstances, including where the public interest in granting the request outweighs, on balance, the public interest in protecting the privacy rights of the individuals concerned. Any concerns a public body has about the release of personal information relating to individuals other than the requester can and should be addressed by considering the applicability of the exemption contained in section 37 to the records at issue.
Having examined the information at issue, I find that the names of HSE employees, including as the names appear in email addresses contained in the records, do not comprise personal information for the purposes of the Act and that section 37 does not apply to those names. I also find that section 37 does not apply to the work telephone numbers of HSE staff.
I am, however satisfied that the names of individuals who work for the other organisations and bodies, including as they appear in email addresses, contained in the records are personal information within the meaning of the Act. Accordingly, I find that section 37(1) applies to those names.
Paragraph III of section 2 of the FOI also specifically excludes from the definition of personal information, the views or opinions of an individual in relation to an FOI body, the staff of an FOI body or the business or the performance of the functions of an FOI body. The second category of information, which the HSE referred to as containing the personal opinions of the owner of the nursing home, comprises correspondence between the HSE, the nursing home and other parties outlining the situation in relation to the outbreak of Covid-19 and commenting on the HSE and the Department of Health’s response.
In its submissions to this Office, the HSE argued that the author of the comments had a right to privacy and had withdrawn the comments made. The HSE also argued that the information included the personal information of identifiable individuals including HSE and nursing home staff.
Having reviewed the information redacted from pages 7, 16, 19, 20, 21, 24, 44, 47, 49 and 54, it is clear that much of it falls under the exclusion at Paragraph III and does not fall under the definition of personal information, save for where the information relates to identifiable individuals.
With regard to the information redacted from pages 9 to 12, 18 to 24, 27 to 29 ,35 to 38, 40 to 45, 48, 49, 52, 54 and 58 to 60, the HSE argued that the information related to identifiable individuals or could allow an individual to be identified. Having reviewed the redacted information, I am of the view that some of the information cannot reasonably be said to relate to identifiable individuals and that section 37 does not apply.
In respect of the records that were refused in whole or in part under section 37(1), I find that the HSE was justified in refusing access only to the following information:
I find that section 37 does not apply to the remainder of the redactions made under that section.
Section 37(1) is subject to the other provisions of the section. Section 37(2) sets out certain circumstances in which section 37(1) does not apply. I am satisfied that none of those circumstances arise in this case. Section 37(5) provides that a request that would fall to be refused under section 37(1) may still be granted where, on balance, (a) the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or (b) the grant of the information would be to the benefit of the person to whom the information relates. I am satisfied that the release of the information at issue in this case would not be to the benefit of the individuals to whom the information relates.
In its submissions to this Office, the HSE did not address the applicability of section 37(5)(a). This notwithstanding, the public interest factors in favour of, and against, release of the information at issue must be considered in the course of this review.
In carrying out any review, this Office has regard to the general principles of openness and transparency set out in section 11(3) of the FOI Act. Section 11(3) provides that an FOI body must have regard to the need to achieve greater openness in the activities of FOI bodies and to promote adherence by them to the principles of transparency in government and public affairs and the need to strengthen the accountability and improve the quality of decision making of FOI bodies. It is important to note that in The Minister for Communications, Energy and Natural Resources and the Information Commissioner & Ors [2020] IESC 57 (“the Enet Case”), the Supreme Court found that a general principle of openness does not suffice to direct release of records in the public interest and “there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure”. Although the Court’s comments were made in cases involving confidentiality and commercial sensitivity, I consider them to be relevant to the consideration of public interest tests generally.
In relation to the issue of the public interest, it is also important to have regard to the comments of the Supreme Court in The Governors and Guardians of the Hospital for the Relief of Poor Lying-In Women v. the Information Commissioner [2011] IESC 26 (“the Rotunda case”). It is noted that a public interest ("a true public interest recognised by means of a well known and established policy, adopted by the Oireachtas, or by law") should be distinguished from a private interest.
The FOI Act recognises the public interest in the protection of the right to privacy both in the language of section 37 and the Long Title to the Act (which makes clear that the release of records under FOI must be consistent with the right to privacy). It is also worth noting that the right to privacy has a constitutional dimension, as one of the unenumerated personal rights under the Constitution. Moreover, unlike other public interest tests provided for in the FOI Act, there is a discretionary element to section 37(5)(a), which is a further indication of the very strong public interest in the right to privacy. Privacy rights will therefore be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy.
Having regard to the nature of the information at issue and to fact that the release of information under the FOI Act is, in effect, release to the world at large, I find no relevant public interest in granting access to the information to which I have found section 37(1) to apply that, on balance, outweighs the public interest in upholding the right to privacy of the individuals to whom the information relates. I find that section 37(5)(a) does not apply in this case.
Consequently, I find that the HSE was justified in redacting the information outlined above under section 37(1) of the FOI Act.
Section 30(1)(b)
The HSE withheld information from pages 2, 6, 8, 9, 29, 38, 41, 44 and withheld all of page 62 under section 30(1)(b). That section provides for the refusal of a request where the FOI body considers that access to the record concerned could reasonably be expected to have a significant, adverse effect on the performance by an FOI body of any of its functions relating to management (including industrial relations and management of its staff).
Where an FOI body relies on section 30(1)(b), it should identify the function relating to management concerned and it should identify the significant adverse effect on the performance of that function which is envisaged. The FOI body must then make an assessment of the degree of significance attaching to the adverse effects claimed. Establishing “significant adverse effect” requires stronger evidence of damage than the “prejudice” standard in section 30(1)(a) and other sections of the Act. Having identified the significant adverse effect envisaged, the FOI body should then explain how release of the particular information in the records could cause the harm and consider the reasonableness of its expectation that the harm will occur.
The records at issue in this case consist of internal emails between HSE staff members and other parties concerning the outbreak of the Covid-19 pandemic in a named nursing home and information from reports on the situation facing the nursing home in the crisis.
In its submissions to this Office, the HSE said it has a role in the management of support and resources, including the provision of volunteering staff to the private nursing home in crisis during the pandemic. It said that a consideration in refusing the information was its duty to react to the evolving crisis in nursing homes. It said it considered a real potential harm which could reasonably be expected to occur in the release of the identified records, specifically the impact on staff continuing to volunteer to work within the private nursing homes in a crisis response. It said it needed to ensure the continued support of volunteer nurses and health care assistants. It also argued that it needed space to consider all information in developing a management response to an unprecedented crisis.
Having examined the contents of the records at issue, it is not clear to me how their release could reasonably be expected to result in the adverse outcome envisaged. The HSE pointed to the fact that the Covid-19 pandemic remains ongoing, arguing that the free flow of information between private nursing homes and the HSE, and the continued support of volunteer nurses and health care assistants to nursing homes, could be jeopardised by the release of the records. While it is of course true that Covid-19 continues to present very significant challenges to healthcare services generally, the situation in Ireland today in respect of the pandemic is very different to that which prevailed at the time the records were created. Generally speaking, there has been huge progress made in terms of knowledge and treatment of Covid-19. While the records undoubtedly reveal the depth of the challenges facing the nursing home in the early days of the pandemic, the scenario facing nursing homes is markedly different at this point in time. Moreover, the extremely difficult situation faced by nursing homes across the country in the early days of the pandemic has been extensively publicised in the media and is undoubtedly a matter of public record.
This being the case, I cannot see how the release of the records could reasonably be expected to result in the significant adverse outcomes posited by the HSE. The HSE has made a general prediction that the outcomes it envisages may come to pass, but to my mind has not linked this forecast to the specific content of the records, and has not provided any evidence to support its assertions. As such, I find that the HSE has not justified its refusal of the records at issue under section 30(1)(b).
Section 36(1)(b)
The HSE also redacted information from page 38 of the records under section 36(1)(b) of the FOI Act. Section 36(1)(b) provides that an FOI body shall refuse to grant a request if the record concerned contains “financial, commercial, scientific or technical or other information whose disclosure could reasonably be expected to result in a material financial loss or gain to the person to whom the information relates, or could prejudice the competitive position of that person in the conduct of his or her profession or business or otherwise in his or her occupation.”
Section 36(1) does not apply if the public interest would, on balance, be better served by granting than by refusing the request (section 36(3) refers).
The essence of the test in section 36(1)(b) is not the nature of the information but the nature of the harm which might be occasioned by its release. The harm test in the first part of subsection (1)(b) of section 36 is whether disclosure of the information “could reasonably be expected to result in material financial loss or gain”. This Office takes the view that the test to be applied is not concerned with the question of probabilities or possibilities, but with whether the decision maker’s expectation is reasonable. The nature of the harm envisaged and a basis for a claim that such harm could reasonably be expected to result from disclosure of the particular information in the record(s) at issue should be shown by a party relying on this provision.
The harm test in the second part of subsection (1)(b) of section 36 is whether disclosure of the information “could prejudice the competitive position” of the person in the conduct of his or her profession or business or otherwise in his or her occupation. The Supreme Court confirmed in University College Cork v The Information Commissioner [2020] IESC 58 that the standard of proof in relation to the second limb is “very low”. Nevertheless, it is not sufficient for a party relying on section 36(1)(b) to merely restate the provisions of the section, list the documents and say that they are commercially sensitive. A party opposing release should explain why disclosure of the particular records could prejudice its competitive position. Bare assertions do not provide an adequate basis for meeting even the low test in section 36(1)(b).
The redacted information relates to a quote for cleaning services provided to the private nursing home. The applicant, during the course of the review, stated that she was happy to remove the price quoted from the scope of the review. The information, which remains at issue, is a sentence relating to a quote for cleaning of the nursing home.
In its submissions to this Office, the HSE stated that it considered the information redacted from page 38 had a potential risk of prejudicing the competitive position of a private business, presumably the nursing home in question. The HSE argued that the FOI Act was not intended to open to scrutiny the internal management of private entities.
Given that the price quoted is no longer at issue, it seems to me to be highly unlikely that disclosing the fact that a quote for cleaning was sought by the nursing home could possibly give rise to the harms identified by the HSE. Accordingly, I find that the HSE has not justified its refusal of the information redacted from page 38 under section 36(1)(b).
Having carried out a review under section 22(2) of the FOI Act, I hereby vary the decision of the HSE in this case. I direct the HSE to undertake a fresh decision making process in respect of the searches carried out in response to the applicant’s request.
I find that the HSE was not justified in refusing access to any of the information at issue under sections 30(1)(b) or 36(1)(b).
In respect of the records that were refused in whole or in part under section 37(1), I find that the HSE was justified in refusing access only to the information outlined above. I direct the release of the remaining records and information withheld under section 37(1).
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated by the requester not later than eight weeks after notice of the decision was given, and by any other party not later than four weeks after notice of the decision was given.
Stephen Rafferty, Senior Investigator