Decision
Mr L and Irish Prison Service
From Office of the Information Commissioner (OIC)
Case number: OIC-92646-Q8V1N8
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-92646-Q8V1N8
Published on
Whether the IPS was justified in refusing access to records relating to the applicant himself as well as records relating to the introduction of a biometric key vending system on the basis of sections 15, 30, 36 and 37 of the FOI Act
12 May 2021
The applicant in this case is an employee of the Irish Prison Service (IPS). On 20 December 2019 he sought access to the following:
1. All and any records relating to me personally, whenever created;
2. All and any records related to the introduction of a key vending system into the Irish Prison Service;
3. All and any records related to the use of employee biometric data in the Irish Prison Service;
4. All and any records related to policies and procedures for the electronic management of time and attendance in the Irish Prison Service;
5. All and any records related to any amendments made to the IPS data protection page on the IPS website since 1/3/19;
6. All and any records related to discussions and/or decision(s) taken around the IPS being governed by the Department of Justice & Equality Data Protection Policy instead of its own Data Protection Policy;
7. All and any records related to discussions and/or decision(s) taken around the IPS' use of the IPS Privacy Policy Document approved by the Director of Corporate Affairs on 14th August 2018, Policy Index No 57;
8. All and any records related to discussions and/or decision(s) taken around the validity or legality of the IPS Privacy Policy Document approved by the Director of Corporate Affairs on 14th August 2018, Policy Index No 57.#
On the same day he sent a further email seeking the following;
As the IPS failed to issue a decision on the request within the statutory time-frame, the applicant sought an internal review of the deemed refusal of his request on 25 March 2020. As the IPS also failed to issue an internal review decision within the statutory time-frame, the applicant sought a review by this Office of the deemed refusal of the request. Following correspondence with this Office, the IPS indicated that it would issue a response on the request.
On 28 April 2020, the IPS issued a decision to the applicant in respect of parts one and four of the applicant’s original request and in respect of additions subsequently provided via email. It identified 31 relevant records, of which 28 were released in full and the remaining three in part, with redactions under section 37(1) (personal information relating to third parties). The letter also made reference to the fact that due to the COVID-19 pandemic, it was not possible for the full copy of his personnel file to be provided at that time as staff in the HR Directorate were working from home. It said that digital records were provided and further records would be provided when staff were in a position to access their offices.
On 7 May 2020, the applicant sought a review by the IPS of that decision. On 19 May 2020, the IPS released further records relating to parts five and six of the request. Six pages of records were part-granted to the applicant with certain information omitted on the ground that it fell outside the scope of the applicant’s request. The mobile phone number of a staff member was also withheld, under section 37(1).
On 3 June 2020, the IPS contacted the applicant in relation to parts seven and eight of the request. It identified 16 pages of records, comprising a number emails. Parts of one chain of email correspondence were redacted under sections 36(1)(b) (commercially sensitive information) and 37(1).
On 11 June 2020, the applicant contacted this Office, wherein he sought a full review of the decisions taken on his request. Subsequently, on 7 July 2020, the IPS issued its decision on parts two and three of the applicant’s request. It identified five records, running to 29 pages, as falling within those parts of the request. Access was granted to one record and access to the four remaining records was refused, three under section 30(1)(b) and one under section 15(1)(d). It also forwarded a Draft Privacy Policy which it indicated should have been included in records released on 3 June 2020.
On 30 September 2020, the IPS issued a further decision to the applicant wherein it identified 119 pages of records comprising the applicant’s personnel file. When releasing these records to the applicant, access to parts of some records was refused under section 37(1). In addition, the associated schedule indicated that a further three pages of records were refused under section 15(1)(i) as they had already been released to the applicant in July 2010.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard the correspondence between the applicant and the IPS as set out above and to the correspondence between this Office and both the applicant and the IPS on the matter. I have also had regard to the contents of the records at issue. I have decided to conclude this review by way of a formal, binding decision.
For completeness, I note that with regard to the decision of 28 April 2020, there exists what are termed an ‘original’ and a ‘revised’ schedule of the 31 records identified. When queried about this, the IPS confirmed that the revised schedule is merely a re-ordering of the relevant records and no new records had been added to the revised schedule.
In addition, for the avoidance of any doubt, I am satisfied that the information deemed to be outside the scope of the applicant’s request in the decision which issued on 19 May 2020 was correctly excluded
It is the applicant’s position that the IPS has not identified all relevant records for release. Accordingly, this review is concerned with whether the IPS was justified in its decision to refuse access to any further records on the basis that no relevant records exist or could be found and to refuse access to parts of certain records under sections 15, 30, 36 and 37 of the FOI Act.
Before I address the substantive issues arising, I would like to make a number of preliminary comments. First, the piecemeal manner in which the IPS dealt with the applicant’s request in this case has unnecessarily complicated the entire process. While I appreciate that the COVID-19 pandemic has caused considerable difficulties for some bodies, the subsequent confusion could have been avoided had the IPS agreed with the applicant at the outset on an orderly arrangement for processing the various parts of the request.
Secondly, section 18(1) of the Act provides for the deletion of exempt information and the granting of access to a copy of a record with such exempt information removed. However, this should be done where it is practicable to do so and where the copy of the record thus created would not be misleading. The Commissioner takes the view that the provisions of section 18 do not envisage or require the extracting of particular sentences or occasional paragraphs from records for the purpose of granting access to those particular sentences or paragraphs. Generally speaking, therefore, the Commissioner is not in favour of the cutting or "dissecting" of records to such an extent.
Thirdly, section 22(12)(b) of the FOI Act provides that when the Commissioner reviews a decision to refuse a request, there is a presumption that the refusal is not justified unless the public body "shows to the satisfaction of the Commissioner that the decision was justified". Therefore, in this case, the onus is on the IPS to satisfy the Commissioner that its decision to refuse access to certain records, either in whole or in part, was justified.
Section 15(1)(a)
Section 15(1)(a) of the FOI Act provides that a request for access to records may be refused if the records sought either do not exist or cannot be found after all reasonable steps to ascertain their whereabouts have been taken. The Commissioner’s role in such cases is to review the decision of the FOI body and to decide whether the decision was justified. This Office must have regard to the evidence available to the decision maker in arriving at his/her decision. The evidence in “search” cases generally consists of the steps actually taken to search for the records along with miscellaneous other information about the record management practices of the FOI body, insofar as those practices relate to the records in question.
In his submissions to this Office, the applicant queried why the information released to him under Part 1 of his request; for ‘all and any records relating to me personally, whenever created’ did not include records relating to his biometric data as it is held on the automated key vending system in Castlerea prison. Amongst other things, he alleged that his biometric data was processed by the IPS from March 2019 up until the date on which he lodged his FOI request and as such should have been provided in response to his request. In addition, he alleged that his data continued to be processed up until a date in October 2020 when, on foot of a complaint he lodged with the Data Protection Commission, he asked for this information to be deleted. However, he also said he believed his data had not been in fact deleted and moreover that the IPS ‘actively sought to recommence processing of my retained biometric data again from a date in November 2020 but did not proceed to do so when reminded of an undertaking that had been given to me by their Data Protection Officer’. He therefore remains of the view that the IPS holds records relevant to his request which have not been released to him.
In light of the applicant’s submission on this matter, the Investigator in this case contacted the IPS and sought a submission in relation to searches undertaken on the automatic key vending system in relation to the applicant’s biometric data. In response, the IPS said that for each user of the system the following are recorded; the individual’s full name, department, PIN (which is not visible), category (a field which is not currently used) and what is referred to as a ‘hash’ of the individual’s fingerprint, which is described as a sequence of numbers and not the actual fingerprint itself. The IPS further indicated that the key vending system logs each time a user withdraws a key from the system. This logging includes the terminal/location and cabinet from which the key is withdrawn, the key tag (which includes the user name when the user withdraws the set of keys allocated to them), the user name, the event and the time and date. When the keys are returned only the event and time and date are recorded.
The IPS further indicated that it is possible to generate a readable paper format of the applicant’s profile on the key vending system and indeed it provided a copy of such a record to this Office. The Investigator subsequently asked the IPS if it was prepared to release this record to the applicant. In response, the IPS indicated that at the time of the applicant’s original application it was in the process of determining if this record could be made available in a readable paper format. It said there is no difference between this record and the record which the applicant sought to have deleted on foot of his complaint to the Data Protection Commission. It said that, contrary to what the applicant had indicated to this Office, no decision has been made by the Data Protection Commission on the matter.
However, the IPS also informed this Office that it sought clarification from the applicant in light of the competing applications; i.e. the request for access to this record under FOI and the request for the record to be deleted under data protection legislation. It said the applicant has sought the deletion of the record on the basis of article 18(1)(b) of the General Data Protection Regulation i.e. on the basis that the processing of the data is unlawful. The IPS contends that the processing has not been determined to be unlawful and that it is therefore seeking legal advice before the record can be deleted.
In the current case it is clear that, pending further consideration by the IPS, a record exists which records the applicant’s information on the automatic key vending system. Regardless of whether or not the applicant wants the record to be deleted, I simply cannot find that the IPS has released all records relevant to the applicant’s request and that no further relevant records exist. I find that I have no alternative but to instruct the IPS to release the record to the applicant if it remains in existence on the date of this decision.
Section 15(1)(d)
In its decision dated 7 July 2020, the IPS refused access to one record relating to part two of the applicant’s request on the basis that it is publicly available. The specific record is the Haddington Road Agreement 2013 and the IPS provided the website link to the applicant. The IPS also provided this link to the applicant on 7 July 2020. Section 15(1)(d) of the FOI Act provides that FOI bodies may refuse to grant a request where the information is already in the public domain. In light of the above I am satisfied that the IPS was justified in withholding access to the record under section 15(1)(d) of the FOI Act.
Section 15(1)(i)
Section 15(1)(i) of the FOI Act provides for the refusal of a request where the request relates to records already released, either to the same or a previous requester where the records are available to the requester concerned. For the section to apply, I would expect the public body to be in a position to show that (i) the records sought were already released and (ii) they are available to the requester.
The decision of 30 September 2020 relating to the applicant’s personnel file appeared to indicate that three pages of records had not been released to the applicant on the basis of section 15(1)(i) i.e. they had already been released to the applicant in July 2010. However, in its submissions to this Office, the IPS clarified its position in relation to the records which had been refused on the basis of section 15(1)(i). Contrary to what had been indicated in the letter of 30 September 2020, it explained that it should have referred to the fact that in July 2010 it released the applicant’s personnel file to the applicant, encompassing records from 2008 to 2010. These records were the ones which were refused to the applicant on the basis of section 15(1)(i).
The IPS provided this Office with a copy of the July 2010 letter which indicated that the applicant’s personnel file, as it then was, was being released to him. Parts of the relevant records were redacted on the basis of section 28 of the Freedom of Information Act 1997 relating to personal information of other individuals.
In the circumstances, I find that the IPS was justified in refusing access to all relevant personnel file records from 2008 to 2010 under section 15(1)(i) on the grounds that the records sought were previously released to the applicant. In making this finding, I accept that some information was not released to the applicant in 2010 on basis that it was personal information relation to other individuals. However, the applicant has not raised any specific arguments in relation to this matter before this Office so I am therefore assuming that he has no objection to the relevant information not having been provided to him in 2010. If he wishes to access that particular information, it is open to him to submit a fresh request for same.
Section 30(1)(b)
The IPS refused access to three records, comprising ten pages, in its decision of 7 July 2020 under section 30(1)(b). Record numbered 1-3 is a briefing note for the Executive Management Team of the IPS in relation to biometric clocking. Record 26 comprises an email dated 9 October 2018 from an official in the IPS Human Resources Directorate to representatives of the Prison Officers Association (the POA). Record 27-29 comprises an email dated 9 November 2018 between the same individuals and a copy of record 1-3.
Section 30(1)(b) provides for the refusal of a request if the FOI body considers that access to the record concerned could reasonably be expected to have a significant, adverse effect on the performance by an FOI body of any of its functions relating to management, including industrial relations and management of its staff.
When relying on section 30(1)(b) the Commissioner expects the FOI body to identify the potential harm to the performance of a public body’s functions relating to management etc. that might result from disclosure of these records. The FOI body must then make an assessment of the degree of significance attaching to the adverse effects claimed. Establishing “significant adverse effect” requires stronger evidence of damage than the “prejudice” standard in section 30(1)(a) and other sections of the Act. Having identified the significant adverse effect envisaged, the FOI body should then explain how release of the particular information in the records could cause the harm and consider the reasonableness of its expectation that the harm will occur.
In its submission to this Office, the IPS argued the information exempted is sensitive in the context of the industrial relations negotiations relating to the introduction of a biometric clocking system across the IPS. It argued that it is a function of management to promote and maintain stable industrial relations in the workplace. It said the IPS operates in a heavily unionised public sector environment where, over the years, industrial relations have remained challenging and to release the relevant information could compromise and undermine those ongoing industrial relations processes.
The IPS argued that breaching the confidentiality of the industrial relations process would have a significant negative effect which could destabilise industrial relations and lead to industrial unrest. It further argued that if there was a perception that the confidentiality of the negotiating process may be breached, future negotiations would be compromised and it would make it impossible to deliver on the significant change and reform agenda currently underway within the organisation.
In addition, the IPS argued that release of the relevant information would harm its ability to achieve its objectives under public sector pay agreements and have a detrimental effect on the Exchequer. In particular, it argued that the introduction of “an automatic key and radio disbursement facility” is an identified measure under the Haddington Road Agreement and this measure and others have contributed to securing Exchequer savings of €12.42 million. It argued that the release of the records at issue would significantly undermine the work of the IPS with the various staff representative bodies it engages with in order to maintain stable industrial relations and achieve the significant reform agenda.
Having examined the briefing note prepared for the Executive Management Team and considered the context of the management issues involved, I accept the IPS’s position that release of the information at this time could reasonably be expected to have a significant adverse effect on its industrial relations functions. It is evident from information provided in the submission from the IPS, that the introduction of biometric clocking is still very much a “live” issue in the management of the IPS and in its relations with staff. I find, therefore, that section 30(1)(b) applies to record 1-3 and to the copy of record 1-3 contained within record 27-29.
However, I do not accept that the release of the emails in records 26 or 27-29 as described above could reasonably be expected to give rise to the harms identified. It seems to me that the IPS is essentially arguing that the industrial relations process is confidential and that no records relating to that process should be released. If that is the case, I do not accept that argument. Each records must be considered in its own right. The email of 9 October 2018 is simply a clarification issued by the IPS to the POA of the mechanism through which discussions on biometric technology will take place, while the email of 9 November 2018 provides clarification on the operation of key vending cabinets. I find that section 30(1)(b) does not apply to these emails.
Having found that section 30(1)(a) applies to the briefing note contained in records 1-3 and 27-29, I must go on to consider whether the public interest would, on balance, be better served by granting than by refusing to grant access to the record (section 30(2) refers). In relation to the public interest test, I wish to emphasise that in carrying out any review, this Office has regard to the general principles of openness and transparency set out in section 11(3) of the FOI Act. In sum, section 11(3) recognises the need to enhance public scrutiny and accountability of government and public affairs, particularly the activities and decision making of FOI bodies.
However, in a judgment delivered on 25 September 2020 (The Minister for Communications, Energy and Natural Resources v The Information Commissioner & Ors [2020] IESC 57, available on our website), the Supreme Court held that general principles of openness and transparency do not provide a sufficient basis for directing the release of otherwise exempt information in the public interest. Rather, a “sufficiently specific, cogent and fact-based reason” is required “to tip the balance in favour of disclosure”. It also indicated that the public interest recognised by the exemption “may be normally served by the operation of the exemption itself, which provides for the refusal of an FOI request”. While the comments of the Supreme Court were made in the context of the public interest test in section 36, which is concerned with the protection of commercially sensitive information, I consider them to be relevant to the consideration of public interest tests generally.
In this case, in circumstances where I have found that the release of the records could reasonably be expected to have a significant adverse effect on the industrial relations functions of the IPS, I am aware of no sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure, as indicated by the Supreme Court. I find, therefore, that the public interest would not, on balance, be better served by release of the records. I find that the IPS was justified in its refusal to grant access to record 1-3 and to the copy of record 1-3 contained within record 27-29 under section 30(1)(b) of the FOI Act.
Section 36(1)(b)
On 3 June 2020, the IPS refused access to parts of one email under section 36(1)(b). The specific information (on page 13) contains a fee estimate, including an hourly rate, from a named firm of solicitors. Section 36(1) provides for the refusal of a request if the record sought contains financial, commercial, scientific or technical or other information whose disclosure could reasonably be expected to result in a material financial loss or gain to the person to whom the information relates, or could prejudice the competitive position of that person in the conduct of his or her profession or business or otherwise in his or her occupation.
The essence of the test in section 36(1)(b) is not the nature of the information but the nature of the harm which might be occasioned by its release. The harm test in the first part of subsection (1)(b) is that disclosure of the information could reasonably be expected to result in material financial loss or gain. The test to be applied is whether the decision maker's expectation of the identified harm arising is reasonable. The harm test in the second part of subsection (1)(b) is whether disclosure of the information "could prejudice the competitive position" of the person concerned. The standard of proof necessary to meet this test is considerably lower than the standard to meet the test of "could reasonably be expected to" in the first part of subsection 36(1)(b).
Having considered the matter, I accept that the disclosure of the fee estimate and hourly rate provided by the firm of solicitors could give rise to the harms outlined in section 36(1)(b) and I find that section 36(1)(b) applies.
Section 36(2) provides for the release of information to which section 36(1)(b) is found to apply in certain circumstances. I am satisfied that none of the circumstances identified at section 36(2) arise in this case. Under section 36(3), I must also consider whether, on balance, the public interest would be better served by granting than by refusing the information in question. In the particular circumstances, where the records contain nothing more than a fee estimate, I find that the public interest would not be better served by the release of the information. I find, therefore, that the IPOS was justified in refusing access to the information under section 36(1)(b) of the Act.
Section 37(1)
On 28 April 2020, the IPS refused access to parts of three records under section 37(1). In the first record the relevant information comprised the names of other employees and a prisoner. In the second record the information to which access was refused related to employee number of another individual which had been inadvertently included in the record. In the final record access to two third party names on a bereavement leave form was refused.
In addition, on 19 May 2020, the IPS refused access to a staff member’s mobile number under section 37(1). On 3 June 2020, it refused access to the names of individuals in a firm of solicitors and their email addresses as contained on pages 7-14 of the records released.
Finally, in the records released to the applicant on 30 September the IPS refused access to a number of records on the basis of section 37(1) as follows:
It is important to note that there is some overlap between the records released on 28 April 2020 and those released on 30 September 2020 and therefore in some cases the same information has been redacted a number of times.
Section 37(1) of the FOI Act provides that, subject to the other provisions of the section, an FOI body shall refuse a request if access to the record concerned would involve the disclosure of personal information. This does not apply where the information involved relates to the requester (section 37(2)(a) refers). For the purposes of the Act, personal information is defined as information about an identifiable individual that either (a) would ordinarily be known only to the individual or members of the family, or friends, of the individual, or (b) is held by an FOI body on the understanding that it would be treated by that body as confidential. The definition also details fourteen specific categories of information that is personal information without prejudice to the generality of the foregoing definition, including (iii) information relating to the employment or employment history of the individual.
Certain information is excluded from the definition of personal information. Where an individual is a member of staff of an FOI body, personal information does not include the name of the individual, or information relating to the position held or its functions, or the terms upon and subject to which the individual occupies or occupied that position, or anything written or recorded in any form by the individual in the course of and for the purpose of the performance of the functions of the position (Paragraph I refers).
The exclusion at Paragraph I does not exclude all information relating to staff members. The exclusion is intended, in essence, to ensure that section 37 cannot be used to exempt the identity of a public servant in the context of the particular position held or any records created by the staff member while carrying out his or her official functions, or information relating to the terms conditions and functions of positions. The exclusion does not deprive public servants of the right to privacy generally.
Bearing in mind the definition of personal information, I accept that the information in the records as outlined above can be regarded as personal information within the meaning of section 37. I find, therefore, that the IPS was justified in refusing access to the individuals named these records on the basis that the information withheld is exempt under sections 37(1) of the Act.
Section 37(2) of the FOI Act sets out certain circumstances in which section 37(1) does not apply. I am satisfied that none of those circumstances arise in this case. Section 37(5) of the FOI Act provides that a request that would fall to be refused under section 37(1) may still be granted where, on balance, (a) the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or (b) the grant of the information would be to the benefit of the person to whom the information relates.
I am satisfied that the release of the information at issue would not be to the benefit of the individuals concerned and that section 37(5)(b) does not apply. In relation to paragraph (a), I must consider whether the public interest in granting the request outweighs, on balance, the public interest in protecting the right of privacy of the individuals to whom the information relates.
The FOI Act also recognises the public interest in the protection of the right to privacy. This is evident both in the language of section 37 and in the Long Title to the Act (which makes clear that the release of records under FOI must be consistent with the right to privacy). It is also worth noting that the right to privacy has a constitutional dimension, as one of the unenumerated personal rights under the Constitution. Privacy rights will therefore be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy. It is also relevant to note that the release of records under FOI is, in effect, regarded as release to the world at large, given that the Act places no constraints on the uses to which the information contained in those records may be put.
Having regard to the nature of the information at issue, I am aware of no public interest factors in favour of the release of the information that, on balance, outweigh the right to privacy of the individuals to whom the information relates. I find, therefore, that subsection (5)(a) does not apply. I find, therefore, that the IPS was justified in refusing access to the individuals named in the records as outlined above under section 37(1) of the FOI Act.
Having carried out a review under section 22(2) of the FOI Act I hereby vary the decision of the Irish Prison Service. I direct the release of the printed version of the applicant’s profile as recorded on the key vending system, assuming this record remains in existence and has not been destroyed at the applicant’s request. I also direct the release of the emails of 9 October 2018 and 9 November 2018 as contained in records 26 and 27-29 that were identified by the IPS in its decision of 7 July 2020.
I affirm the remainder of the decisions taken by the IPS in relation to the applicant’s request.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated by the applicant not later than eight weeks after notice of the decision was given, and by any other party not later than four weeks after notice of the decision was given.
Stephen Rafferty
Senior Investigator