Decision
Mr. Y and The Health Service Executive
From Office of the Information Commissioner (OIC)
Case number: OIC-151019-K3S4G8
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-151019-K3S4G8
Published on
Whether the HSE was justified, under section 15(1)(a) of the FOI Act, in refusing access to any records held about the applicant in a specific staff members email account, on the basis that the records sought do not exist or cannot be found after all reasonable steps to ascertain their whereabouts have been taken
22 April 2025
This case has its background in a previous review by this Office (Case OIC-140328) of a decision by the HSE on a request made by the applicant in February 2023 for records relating to him. In case OIC-140328, the applicant queried whether a new email account of the named staff member was also searched. In our decision in that case we noted,
“With regard to the applicant’s query as to whether one of the staff members referred to in his request was provided with a new email account, the HSE stated that the individual in question only has one email account and the email account referred to by the applicant does not appear on the HSE’s Global Address List.”
On 16 May 2024, the applicant submitted a new FOI request to the HSE, referring to our decision in the above referenced case, requesting the HSE to search a specific email account of a named staff member for any information in any way related to him or his complaints against the named staff member, or regarding any FOI requests. The applicant also requested any other information that exists in the specified email account relating to communications with other individuals about him. The applicant stated that he was aware the email account in question is active, and attached a copy of an email dated 17 September 2022 to the account in question which he said demonstrated that the email account exists, which he said was contrary to the position taken by the HSE in the previous review by this Office, where it stated that no such email account existed.
On 19 June 2024, the applicant applied for an internal review as the HSE did not issue a decision within the 4 weeks prescribed in the FOI Act. On 11 July 2024, the applicant subsequently applied to this Office for a review on the basis that the HSE had not issued an internal review decision on his request within the prescribed timeframe. On 1 August 2024, following a request by this Office, the HSE issued its effective position decision to the applicant, in which it refused the applicant’s request under section 15(1)(a) of the FOI Act. The HSE stated that it was unable to confirm or deny whether records existed in the specific email account mentioned by the applicant, as the email account in question is not available for access. On 6 August 2024, the applicant applied to this Office for a review of the HSE’s decision.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the correspondence outlined above and to the submissions made by both the HSE and the applicant during the course of this review. I have decided to conclude this review by way of a formal, binding decision.
This review is concerned solely with whether the HSE was justified in refusing access under section 15(1)(a) of the FOI Act to any records relating to the applicant contained in the specified email account on the basis that no relevant records exist or can be found after all reasonable steps have been taken to ascertain the whereabouts of any relevant records.
Section 15(1)(a) of the FOI Act provides for the refusal of a request where the records sought do not exist or cannot be found after all reasonable steps to ascertain their whereabouts have been taken. Our role in a case such as this is to review the decision of the FOI body and to decide whether that decision was justified. This means that I must have regard to the evidence available to the decision maker and the reasoning used by the decision maker in arriving at their decision and also must assess the adequacy of the searches conducted by the FOI body in looking for relevant records. The evidence in “search” cases generally consists of the steps actually taken to search for the records along with miscellaneous and other information about the record management practices of the FOI body, insofar as those practices relate to the records in question.
In its submissions to this Office, the HSE said it is important to note that the named staff member’s treatment/engagement with the applicant ceased in July 2019. It said, whilst the applicant submitted FOI requests post 2019, the staff member was not assigned to or engaged in the applicant’s care plan post July 2019. The HSE said that the staff member had a different email account at the time of treating the applicant. The HSE said that the email address that is the subject of this review is the current email address of the named staff member and that this email account was created in June 2022. The HSE stated that it is not the case that the HSE is refusing access to the email account. It said that HSE staff are unable to access the account as it is dormant at present. The HSE said, given that the named staff member has not treated the applicant since 2019, it is reasonable to conclude that staff member does not hold any information relevant to the applicant. The HSE also said that when processing the applicant’s request in the previous case referenced above, the HSE’s Global email address book was searched and the email address in question did not appear as the address is ‘dormant’ and therefore is not visible or accessible.
The HSE said that a dormant account is one where a domain account has been disabled for a specific reason. The HSE stated that in this scenario emails will still deliver to the account’s mailbox, however the ability to log in to the domain account is disabled. In contrast, the HSE stated that a deleted account is one where the domain account and mailbox is removed, and no emails will deliver to such an account. The HSE provided details of the process to deactivate an email account once a HSE employee is no longer employed by it and said a specialist company would have to be engaged, at significant cost, to search back-up tapes in that scenario.
When asked whether a dormant account can be accessed in order to allow for searches to be carried out, the HSE stated that it does not have a set procedure or policy for accessing dormant accounts. It stated that what is being called a “dormant” account here is where a domain account has been disabled. The HSE stated that once a mailbox has been disabled, it remains disconnected for 30 days before being purged from the system. It said this is a Microsoft configured default. The HSE said that during this 30-day window the disconnected mailbox can be reattached to the domain account, and beyond this 30-day window a new, clean mailbox would need to be created to reactivate an email address. The HSE stated that the process for reactivating a dormant account is managed by the National Service Desk Account Management team, who would need to either enable the disabled domain account or create a new domain/email account.
The HSE said that no cost is incurred during the reactivation process. However, in relation to whether costs would be incurred during the search process, the HSE were unable to provide this Office with a definitive answer as to whether any costs would be associated with searching the email account once it has been reactivated. In correspondence with this Office, the FOI Officer stated that they had made enquiries with HSE ICT, the National Service Desk, as well as other relevant individuals/units which they believed may have been able to provide clarity on the topic. However, the HSE stated that despite these enquires, it was unable to obtain a clear answer as to whether any costs would be associated. Additionally, the HSE stated that, at present, the email account in question has not been searched for records relating to the applicant’s request, its reasons for which are outlined below.
In its submissions to this Office, the HSE stated that it did not believe any records relating to the applicant’s request would be held in the email account in question, owing to the specific timeline of events regarding the applicant’s treatment. In its submissions to this Office the HSE stated that the specific staff member in question ceased treating the applicant in 2019. It said that whilst the applicant submitted FOI requests post 2019, the staff member in question was not assigned to or engaged in the applicant’s care plan post July 2019. The HSE stated that detailed searches of the email account of the staff member in question had been conducted in 2020 and 2021, and no further records had been found beyond those already released to the applicant. As such, the HSE stated its position was that adequate searches had been carried out, and it was reasonable to assume no further records would exist.
While extensive searches may well have been conducted of the named staff member’s previous email account, the applicant specifically requested any records held in the named staff member’s new email account. The applicant provided a copy of an email referencing him that had been sent to the email account that is the subject of this review. This email relates to an FOI request submitted by the applicant in 2022, where the named staff member in this case was asked to forward any internal correspondence they may have in relation to the applicant from February 2021 onwards. In its submissions to this Office, the HSE stated that such an email would be sent in the normal course of conducting searches for relevant records. The HSE stated that it is normal practice for relevant staff/FOI Officers to email any staff to conduct searches in circumstances where a staff member has been specifically mentioned in an FOI request. Additionally, the HSE stated that the staff member who sent the email would not be aware that the last contact the individual in question had with the applicant was in 2019.
While I appreciate the explanation provided by the HSE in respect of why such an email exists, I believe ultimately the most relevant fact to consider is that an email was sent to the specific email account in question that made reference to the applicant. The applicant’s FOI request is for all information/records held about him in the specific staff members email account and is not limited to a particular subject matter or the period when the staff member treated the applicant. As such, the existence of the email outlined above highlights
that at least one record falling within the scope of the applicant’s request is held in the email account in question. Furthermore, without the HSE having conducted any searches of the email account in question, it is unclear whether any further emails relating to the applicant’s request could be held in the account, despite the fact that the specific staff member ceased treating the applicant in 2019. It is worth noting that this does not mean that any further records falling within the scope of the applicant’s request are held in the email account in question. However, this review is concerned with the HSE’s reliance on section 15(1)(a) of the FOI Act, which in this case requires the HSE to demonstrate it has taken all reasonable steps to ascertain the whereabouts of any records falling within the scope of an applicant’s request.
It is important to note that the FOI Act does not require absolute certainty as to the existence or location of records, as situations can arise where records are lost or simply cannot be found. Furthermore, it is open to this Office to find that an FOI body has satisfied the requirements of section 15(1)(a), even where records that an applicant believes ought to exist have not been located. We do not generally expect FOI bodies to carry out extensive or indefinite general searches for records simply because an applicant asserts that records should or might exist. Notwithstanding this, based on the submissions provided by the HSE, it is evident that it has not conducted any searches of the relevant email account to ascertain whether it contains any records relating to the applicant. Taking into consideration that the applicant has provided a record which shows that at least one email falling within the scope of his request is held in the account in question, coupled with the fact that the HSE have stated that it is possible to reactivate the dormant email account in question without incurring any cost, I am not satisfied that the HSE has met the requirements set out in section 15(1)(a) of the Act. Given the HSE’s submissions in this case, it seems to me that the email account in question can be reactivated and searched, and that doing so is reasonable in the circumstances.
Accordingly, I find that the HSE was not justified in refusing access, under section 15(1)(a) of the FOI Act, to records relating to the applicant held in a specific staff member’s email account, on the ground that no searches were carried out of the email account in question, despite the HSE having the capability to do so.
Finally, as noted above while the HSE outlined the significant costs involved in searching back-up tapes after email accounts have been deactivated when a staff member leaves the organisation, the HSE were unable to ascertain what, if any, costs would be involved in searching a dormant email account once it has been reactivated. If it transpires there are significant costs associated with conducting a search of the email account at issue, it is open to the HSE to take this into consideration when making its new decision on the applicant’s request. As a general point, in considering whether all reasonable steps have been taken to ascertain the whereabouts of the records sought in this case, I would not consider it reasonable to expect the HSE to incur significant costs in order to search the email account in question.
Having carried out a review under section 22(2) of the FOI Act, I hereby annul the HSE’s decision. I find that it was not justified in refusing access to records relating to the applicant’s request, on the basis that no records exist or could be found.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
____________________
Richard Crowley
Investigator