Decision
Mr. X and Health Service Executive
From Office of the Information Commissioner (OIC)
Case number: OIC-142454-P4L7D0
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-142454-P4L7D0
Published on
Whether the HSE was justified in refusing access to certain information in Controls Assurance Statements signed by HSE Clinical Directors under sections 15(1)(a) and 30(1) of the FOI Act
20 June 2024
In a request dated 8 March 2023, the applicant sought copies of Controls Assurance Statements signed by HSE Clinical Directors. He said he was seeking only a specific part of the statements that refer to “key relevant sections” as referenced by the then Director General of the HSE in a letter of 7 February 2017 which he sent to the Secretary General of the Department of Health. He specified that he was seeking the relevant extracts from the Controls Assurance Statements of the Clinical Directors of 32 named hospitals for each year from 2015 to 2021.
In a decision dated 5 July 2023, the HSE explained that it co-ordinated a national response on behalf of the hospitals listed in the request. It provided a schedule of records containing details of the records that were found in the hospitals and deemed to fall within the scope of the request. It refused access to all of the records identified under sections 30(1)(a) and 30(1)(b) of the FOI Act.
On 6 July 2023, the applicant sought an internal review of the HSE’s decision. He made submissions in respect of the HSE’s refusal and also noted that “the schedule of records looks very incomplete”. As the HSE failed to issue an internal review decision within the relevant timeframe, the applicant sought a review by this Office of the deemed refusal of the request. On 18 September 2023, the HSE issued a late internal review decision wherein it affirmed its refusal of the request under sections 30(1)(a) and 30(1)(b) and it responded to the applicant’s assertion that further relevant records should exist. On 20 September 2023, the applicant applied to this Office for a review of the HSE’s decision.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the submissions made by the HSE and arguments advanced by the applicant in his correspondence with the HSE. I have also examined the records at issue. I have decided to conclude this review by way of a formal, binding decision.
The HSE initially identified 12 records as coming within the scope of the applicant’s request. It refused access to all 12 records in full. In communications with this Office, the applicant confirmed that the scope of his request is limited to the parts of the Controls Assurance Statements which refer to the “key relevant sections” listed in his original request, as well as the name and location of the Clinical Directors who signed any such statements. The records identified as relevant to the request contain various other sections which are outside the scope of the applicant’s request and which I will not consider further. During the course of the review and in light of background information provided by the HSE in respect of the now-digitalised nature of relevant processes, the applicant confirmed that he is seeking the relevant parts of controls assurance statements from Clinical Directors, whether submitted electronically or completed in hard copy. While I note that the applicant’s request referenced signed statements, it seems to me that a digital signature would suffice to bring any relevant record within scope.
The applicant also confirmed that he was seeking a review of the HSE’s effective refusal of any further records on the basis of section 15(1)(a) of the FOI Act. The applicant’s position is that further records should exist. This review therefore also involves a search issue under section 15(1)(a).
I am of the view that section 37(1) is also of relevance in this case. That section provides for the mandatory refusal of a record the disclosure of which would involve the disclosure of third party personal information. A review by this Office is considered to be “de novo”, which means that it is based on the circumstances and the law as they pertain at the time of the decision. Accordingly, in light of the “de novo” nature of our reviews, I consider it appropriate to consider the applicability of section 37(1) to the information at issue, notwithstanding the fact that the provision has not been relied upon by the HSE as a ground for refusing the request.
During the course of the review, the HSE submitted that record 11 should be considered outside scope. The record is a copy of an Internal Controls Questionnaire from 2018. The record does not include a Controls Assurance Statement though it references same. The HSE said that the section of the record which refers to the Controls Assurance Statement “would appear not to have been signed in this instance”. It said, however, that a central repository includes the particular submission and it could only have been submitted if the relevant section was responded to. It said that it appears that the particular record, which was held locally, is not the fully complete ICQ that was submitted. I note the HSE’s reference to a central repository which is relevant to my analysis in respect of section 15(1)(a) and will be considered below. I am satisfied that record 11 does not include a Controls Assurance Statement and therefore falls outside the scope of the applicant’s request. I will not consider it further.
This review is therefore concerned solely with whether the HSE was justified in refusing access to the relevant parts of the remaining identified records on the basis of sections 30(1)(a), 30(1)(b) and 37(1) and in effectively refusing access to any further records on the basis of section 15(1)(a) of the FOI Act.
Before I address the substantive issues arising, I wish to make a number of preliminary comments. Firstly, I must note that the manner in which the HSE processed the applicant’s request fell short of the required standards and was unsatisfactory. Both the original and internal review decisions were issued late. I note that the HSE provided this Office with explanations in respect of the delays and said that the requester was kept informed and agreed to extend relevant timeframes in respect of the original decision. While the HSE also apologised to the applicant for the considerable delay in its issuing of an internal review decision, the fact is that more than two months passed before a response was received and this appears to have only occurred on foot of an application for review made to this Office. While I accept that staffing difficulties can arise, the administration of FOI is a statutory function which should be afforded due weight. I expect the HSE to have regard to these comments and to ensure that the FOI function is adequately resourced to ensure compliance with the relevant statutory timeframes as set out in the Act.
Secondly, although I am obliged to give reasons for my decision, section 25(3) of the FOI Act requires me to take all reasonable precautions in the course of a review to prevent the disclosure of information contained in an exempt record. This means that the extent to which I can describe the contents of the records is limited.
Finally, it is important to note that section 22(12)(b) of the FOI Act provides that a decision to refuse to grant a request under section 12 shall be presumed not to have been justified unless the head of the relevant FOI body shows to the Commissioner's satisfaction that its decision was justified. This means that the onus is on the HSE to satisfy this Office that its decision to refuse access to the records sought, either in whole or in part, was justified.
While I am limited in the extent to which I can describe the records at issue, I believe it would be useful to provide some high-level context in respect of the Controls Assurance Statements and the applicant’s request.
In its submissions, the HSE said that it is required to complete a formal review of the effectiveness of its system of internal controls. It outlined the role of the HSE board in that regard. It said that the Controls Assurance Review Process (CARP) is one of several tools used to assess the adequacy of the controls framework. It said that the CARP includes a self-assessment Internal Control Questionnaire (ICQ) and a Controls Assurance Statement (CAS). It said that HSE staff at grade VIII or equivalent and above, including clinical staff, are requested to complete the CARP. It said the CARP has undergone enhancements in recent years to encourage increased participation and provide meaningful controls data. It said the process has been completed online since 2018.
As noted above, the applicant is seeking only particular sections of the CAS records. In his original request, he referred to a letter sent from the then Director General of the HSE to the Secretary General of the Department of Health in which the annual CARP was referenced. The Director General referred to three particular statements described as “key relevant sections”, outlined below:
• I have discussed and reviewed the HSE Code of Governance and confirm that it is implemented in my area of responsibility.
• I as a Manager and all staff under my responsibility are aware of their responsibility to supply Statements of Interest to the DG in compliance with the Ethics in Public Office Acts 1995 and 2001.
• I as a Manager and all staff under my responsibility are aware of the obligations placed upon me/them by NFR-17 Voluntary Donations, Gifts, Bequests.
The applicant stated that he is seeking only the part of the statements that refer to the above “key relevant sections”. He said that he was seeking copies of the actual statements themselves and that the names and locations of the Clinical Directors who signed the statements should not be redacted.
In respect of the scope of the applicant’s request, a number of the records identified by the HSE do not include the full text of the “key relevant sections” sought by the applicant. Rather, the records contain a general statement that the respondent has read and understood the CAS and a link is provided to a separate document. The HSE provided this Office with copies of the questions asked for the respective years. It said that the suite of questions pertaining to this assurance can change, but they always reference the “key relevant sections”. It said that a “yes” response to the CAS section denotes compliance, while a “no” response denotes non-completion.
In its submissions, the HSE said that the questions included in the CARP are annually “appraised with relevant subject matter experts to reflect changing control requirements and relevant topical matters”. It said that the questions included in the records are not standardised, and there are “slight differences in the questions year on year”. More generally, the HSE said that the CARP has undergone enhancements to encourage increased participation and provide meaningful controls data. It said that participation in the process has grown, ensuring participation from all faculties across the HSE, clinical and non-clinical.
As noted above, the applicant’s position is that further records relevant to his request should exist. This review therefore also involves a search issue under section 15(1)(a) of the FOI Act. Section 15(1)(a) provides that a request for access to a record may be refused where the record does not exist or cannot be found after all reasonable steps to ascertain its whereabouts have been taken. The role of this Office is to review the decision of the FOI body and decide whether that decision was justified. This means that I must have regard to the evidence available to the decision maker and the reasoning used by the decision maker in arriving at their decision and must assess the adequacy of the searches conducted by the FOI body in looking for relevant records. The evidence in “search” cases generally consists of the steps actually taken to search for the records along with miscellaneous and other information about the record management practices of the FOI body, insofar as those practices relate to the records in question.
In his application for internal review, the applicant said that the schedule of records provided looks “very, very limited”. He said that even if records from 2015-2017 have since been destroyed, while noting that the decision letter did not expressly state this, there should be “far more records relating to the different hospital groups/acute hospitals”. In submissions to this Office, the applicant referred to the correspondence from the then Director General of the HSE referenced in his original request. He said that the letter stated that staff above Grade 8 are required to take part in a process in which they confirm that they understand certain obligations under Ethics legislation and HSE rules. The applicant said that given how few records were identified, representing just a handful of Clinical Directors when “this is supposed to be essentially a national policy”, his position is that the schedule is “woefully incomplete”.
In light of the applicant’s confirmed position, the Investigator sought submissions from the HSE detailing the steps taken to search for relevant records. The HSE duly provided submissions and the Investigator provided the applicant with an outline of the details provided. While I do not propose to repeat the details in full, I confirm that I have had regard to them for the purposes of this review.
The HSE referenced previous related FOI requests and said that while they had been processed by the National Finance and National HR divisions, because the current request sought copies of statements potentially held in local hospitals it was handled by the Office of the National Director, Acute Operations. It said that this office coordinated the request and noted that the records in question belong to the hospitals, rather than the Office of the National Director. It said that communication and input was sought from regional Consumer Affairs, who act as an FOI central office for Hospital Groups.
The HSE provided background information in respect of the CAS and the CARP. It said that the CAS is a confirmation of awareness/assurances in place and forms part of the ICQ. It said that while the CARP is an instrument used to discharge a regulatory requirement that the CEO and board must fulfil, the completion of the CARP return is not a mandated requirement. It said that designated staff are requested and actively encouraged to make an annual return. It said that since 2020, the process has been completed fully online on an annual basis, without the need for a handwritten signature. It said that prior to this, completed surveys and signed Controls Assurance Statements were held locally.
The HSE said that on foot of the Investigator’s request for focused submissions, it issued communications to relevant hospitals and hospital groups and sought their input in respect of searches undertaken and the questions raised by this Office. The collective position was that no further records exist or can be found. Specific details in respect of individual hospital positions were provided to this Office and in turn to the applicant.
The HSE said that all records are maintained in line with the HSE data retention policy. It provided a copy of the relevant documentation and directed this Office’s attention to a particular section which relates specifically to CARP responses. The stated retention period is four years, at which point records are destroyed as per the HSE Information Classification and Handling Policy. In respect of the number of records identified, as compared to the number of hospitals listed in the applicant’s request, the HSE again referenced the non-mandatory nature of the CARP. As noted above, details of the HSE’s submissions were provided to the applicant and he was invited to make any further submissions in response. No submissions have been received to date.
During the course of the review, and by way of background information, the HSE referenced an earlier FOI request relating to the CARP which was submitted by the applicant. It provided this Office with a copy of the earlier internal review decision and the record which was released to the applicant in that case. It said that this was provided to support the context of its response in the current case. In the earlier case, the applicant sought copies of controls assurance statements from clinical directors and agreed to receive a spreadsheet of responses. An anonymised spreadsheet was released. In its internal review decision, the HSE said that from 2016 to 2021 an annual excel spreadsheet was created compiling all CARP responses for that year to facilitate a review of findings. It said that all responses from staff who included the description of clinical director within their job title on the returns were extracted and anonymised.
Having considered the detail provided in the earlier FOI request, the relevant Investigator contacted the HSE. She noted that the information provided raised further questions in respect of whether the HSE had taken all reasonable steps to locate requested records. The Investigator noted that the spreadsheet released on foot of the earlier request appears to detail responses submitted by Clinical Directors between 2016 and 2021 and also appears to contain far more responses than were identified in respect of the current request and review. The spreadsheet contains responses in respect of the CAS and notes that such responses comprise a digital sign-off. The Investigator noted that it appears that the HSE holds further records coming within the scope of the applicant’s request, albeit centrally and in an electronic format and she sought further information.
The HSE did not make substantive submissions in respect of the Investigator’s stated position. In a limited response, it said that the spreadsheet previously provided to the applicant includes responses from participants that declared themselves as Clinical Directors. It said that the HSE holds the names and location of such Clinical Directors. It also said that individual responses can be extracted from the system and that such records are managed and compiled by the National Finance Division.
I have carefully considered the search details and background information provided by the HSE. As noted above, the applicant requested relevant records relating to 32 named hospitals between 2015 and 2021. A very limited number of records were originally identified; the 12 records listed on the schedule relate to only two named hospitals. However, the HSE stated that it sought responses from each of the relevant hospitals. It provided this Office with tables detailing the searches undertaken and confirmed that responses were received in respect of the 32 hospitals. The applicant’s position is that further records should exist. He expressed surprise at the number of records identified given the scope of his request.
It is important to note that the FOI Act provides for a right of access to records held by FOI bodies. A review by this Office is not concerned with the question of what records should exist. If a record does not exist, that is the end of the matter, regardless of the applicant's views as to the appropriateness or otherwise of the absence of certain records. It is also important to note that the test in section 15(1)(a) is whether searches have been reasonable. This Office takes the view that the FOI Act does not require absolute certainty as to the existence or location of records, as situations arise where records are lost or simply cannot be found.
I have had regard to the submissions made by the HSE, the search details and the contextual information provided. I note in particular the stated non-mandatory nature of the process in question and the HSE retention policy, as well as the responses provided in respect of individual hospitals. In the circumstances, while I am satisfied that the HSE has taken reasonable steps to ascertain the whereabouts of relevant records held by individual hospitals, I am not satisfied, having considered the spreadsheet provided by the HSE in respect of an earlier FOI request and further submissions received in respect of same, that it has taken all reasonable steps to locate relevant records which appear to be held centrally and in an electronic format. It may be that the HSE misunderstood the nature and scope of the applicant’s latter request and considered that electronic responses were not being sought. Nevertheless, it seems to me that such responses, given that they are now the only way in which controls assurance statements are submitted and collated, come within the scope of the request and should have been considered. Accordingly, I find that the HSE was not justified in refusing access to further relevant records on the basis of section 15(1)(a) of the FOI Act and I direct it to make a fresh decision on the matter.
In carrying out a fresh decision-making process, and considering the changing nature of the processes at issue, I would encourage the HSE and the applicant to discuss the specific scope of the request and the type of records in existence to ensure that the parties are clear about what is being sought.
Section 30(1)(a) provides that an FOI body may refuse to grant a request if it considers that access to the record concerned could reasonably be expected to prejudice the effectiveness of tests, examinations, investigations, inquiries or audits conducted by or on behalf of an FOI body or the procedures or methods employed for the conduct thereof. Where an FOI body relies on section 30(1)(a), it should identify the potential harm in relation to the relevant function specified in the paragraph that might arise from disclosure.
Having identified that harm, it should consider the reasonableness of any expectation that the harm will occur. The FOI body should explain how and why, in its opinion, release of the records could reasonably be expected to give rise to the harm envisaged. A claim for exemption under section 30(1)(a) must be made on its merits and in light of the contents of each particular record and the relevant facts and circumstances of the case. Section 30(1) is also subject to a public interest test under section 30(2).
The HSE has relied on section 30(1)(a) to refuse access to the records originally identified. In its submissions, it said that the HSE board has a statutory obligation to complete a formal annual review of the effectiveness of its system of internal controls. It said the board has a statutory requirement to review the controls and procedures adopted by the HSE and provide itself with reasonable assurance that they are adequate to secure compliance with statutory and governance obligations. It said that the CARP is one of the processes that informs the Statement of Internal Control. It said that the staff participation rate is core to the process. It said that in order to examine the effectiveness of the HSE control environment as represented by the questions in the CARP, respondents need to feel free to respond openly without fear of adverse consequence or publicity. The HSE said that any interference with the response rate would “seriously interfere with the HSE’s ability to measure the effectiveness of the HSE’s system of internal control”. It said that it would consequently have a detrimental effect on its ability to comply with statutory and governance obligations. It said that release of the records could reasonably be expected to result in significant harm to the HSE board’s effectiveness in carrying out its statutory requirements as they relate to the inquiries conducted as part of the CARP.
With reference to participation rates, the HSE said that involvement from all areas and participation by eligible staff is requested by HSE leadership to ensure the review is robust. It said that release of the records could prejudice future respondents’ willingness to partake in the process or respond candidly. The HSE said that the CARP guidelines encourage staff to discuss the process or any concerns with their line manager before submission. It acknowledged that the ICQ and CAS are not completed on a ‘confidential basis’ as defined in the FOI Act but said that it was implied that “participation and completion of the process is not then used for widespread distribution within the organisation and certainly not into the public arena”. It noted that release under FOI effectively amounts to release to the world at large. The HSE said that due to the subjective nature of the questions, an individual may be reticent to respond in an open and accurate manner if their identifiable responses were released to the world at large. It said it is “highly probable” that release of identifiable responses would have a harmful impact on the future CARP participation and response rate. It said that efforts have been made to increase participation and release of the documents is “likely to thwart such increased participation levels”.
In his application to this Office, the applicant referred to arguments advanced in his request for an internal review. In that request, he said that he did not see how the requested statements could possibly be classed as anyway confidential or controversial. He said that they simply confirm that Clinical Directors and the staff they manage are aware of their obligations under the Ethics Act and in relation to other HSE internal rules. He stated that “surely the public should be provided with this assurance”. He referenced differing statements in respect of whether staff completion of the CAS is a requirement or a voluntary undertaking. His position is that the records should be released either way. He said that it is “baffling” that the HSE is concerned that the release of such records could damage the organisation and jeopardise the future cooperation of its staff.
I have carefully considered the submissions received as well as the relevant records. The first question I must consider is whether the records relate to functions falling within the scope of section 30(1)(a). As noted above, section 30(1)(a) refers to “tests, examinations, investigations, inquiries or audits”. It applies in relation to functions specified in that subsection only. As noted by the HSE in its submissions, the records at issue in this case relate to a particular process (the CARP) which informs its Statement of Internal Control. It referred to this as a process whereby the effectiveness of the HSE control environment is examined. The HSE has argued that release of the records could result in harms to that process. I am satisfied that internal control processes are related to internal audit activities such that they fall within the scope of section 30(1)(a).
However, I must also consider whether release of the information at issue could reasonably be expected to prejudice the effectiveness of such audits. I have considered the submissions received by the HSE. In short, its position is that release could negatively impact future participation rates or the quality of responses received, therefore undermining the controls assurance processes in question.
It is important to note that the scope of the applicant’s request is limited to three “key relevant sections”, as well as the name and location of the Clinical Directors who signed the controls assurance statements. The “key relevant sections” are effectively tick-box confirmations in respect of certain codes, legislative responsibilities, and obligations. The applicant is not seeking any other information which may be contained in the records. It seems to me that the relevant sections relate to basic governance functions; they do not relate to specific controls issues identified. As per the applicant’s submissions, the information he is seeking “confirms that certain staff are aware of their obligations under the Ethics Act and under the HSE’s internal regulations”. I fail to see how the release of such limited information would discourage relevant staff from responding to future requests. I note that the process in question is not a mandated requirement. It seems to me that it is open to the HSE to make responding to such a process mandatory. Even as a discretionary process, given the limited information at issue, I do not accept that release could reasonably be expected to deter further participation.
I fail to see how the release of such limited information obtained as part of a controls assurance process could reasonably be expected to prejudice the effectiveness of any future audits or relevant procedures or methods. Accordingly, I do not accept that the release of the records could reasonably be expected to result in relevant harms to “tests, examinations, investigations, inquiries or audits” or the procedures or methods employed for the conduct thereof. I will consider the HSE’s arguments further in the context of subsection (b) below.
Section 30(1)(b) of the Act provides for the refusal of a request where the FOI body considers that access to the record concerned could reasonably be expected to have a significant, adverse effect on the performance by an FOI body of any of its functions relating to management (including industrial relations and management of its staff). Where an FOI body relies on section 30(1)(b), it should identify the function relating to management concerned and it should identify the significant adverse effect on the performance of that function which is envisaged. The FOI body must then make an assessment of the degree of significance attaching to the adverse effects claimed. Establishing “significant adverse effect” requires stronger evidence of damage than the “prejudice” standard in section 30(1)(a) and other sections of the Act. Having identified the significant adverse effect envisaged, the FOI body should then explain how release of the particular information in the records could cause the harm and consider the reasonableness of its expectation that the harm will occur.
A claim for exemption under section 30(1)(b) must be made on its merits and in light of the contents of the particular record concerned and the relevant facts and circumstances of the case. In examining the merits of an FOI body’s view that the harm identified could reasonably be expected by the release of records, the Information Commissioner does not have to be satisfied that such an outcome will definitely occur. The test is not concerned with the question of probabilities or possibilities. It is concerned with whether or not the decision maker’s expectation is reasonable. It is sufficient for the FOI body to show that it expects an outcome and that its expectations are justifiable in the sense that there are adequate grounds for the expectations.
The HSE has relied on section 30(1)(b) to refuse access to each of the records identified. In its submissions, it again referenced the statutory requirement on its board to review the controls and procedures adopted and to provide itself with reasonable assurance that such controls and procedures are adequate to secure compliance by the HSE with its statutory and governance obligations. It said that release of the records would have a significant, adverse effect on the performance by the HSE of its functions relating to management, namely the completion of an effective formal annual review of the effectiveness of its system of internal controls. It referred specifically to compliance with provisions of the Health Act 2004 and the Code of Practice for the Governance of State Bodies. It said that release could reasonably be expected to cause interference with the CARP and thwart the board’s ability to comply with its statutory obligations.
The HSE said that as the nature of the relevant records relate to personal statements, an individual may be reticent to respond in an open and accurate manner if their identifiable responses were released to the world at large. It said that the records identify each Clinical Director by name and location and the response given to particular relevant sections of the CARP. It again said that any interference with the response rate or quality of responses would seriously interfere with the HSE’s ability to measure the effectiveness of its system of internal control. It said that it is highly likely that the release of identifiable responses would result in staff not responding, not responding in a timely manner or not feeling free to answer in an open and honest manner. It said that this impact would be highly probable in any organisation as a “universal natural response to the release of such identifiable records”, which it said all eligible staff are invited to complete and relate to the specific personal assurances given by these individuals. The HSE again noted that release of records under FOI is presumed to be release to the world at large. It said that release would have a harmful impact on the future response rate and the quality of responses, which are the fundamental cornerstones of the CARP process.
I have also considered the applicant’s submissions, outlined above, in respect of this exemption provision and the content of the records at issue and I would again point out the limited nature of the applicant’s request. The scope of the request is limited to three “key relevant sections”, as well as the name and location of the Clinical Directors who signed the controls assurance statements. The “key relevant sections” are effectively tick-box confirmations in respect of certain codes, legislative responsibilities, and obligations. The applicant is not seeking any other information which may be contained in the records.
I would also note that the Commissioner has found that management is a word of wide import and that it is apt to cover a variety of activities of an FOI body apart from management of staff and industrial relations. I am satisfied that the controls assurance process outlined by the HSE is included in the scope of the term “functions relating to management”. As such, the question I must consider is whether release of the information at issue could reasonably be expected to have a significant, adverse effect on that function.
Given the very limited scope of the applicant’s request, I find it difficult to accept that release of the relevant parts of the records could reasonably be expected to result in the harms outlined by the HSE. The HSE has effectively made two substantive arguments; that release could impact the quantity and quality of CAS responses. It argued that this in turn would undermine the CARP. I have considered the nature of the information at issue. As per my analysis in respect of subsection (a), it seems to me that the relevant sections relate to basic management functions rather than substantive controls issues identified. Again, the information the applicant is seeking “confirms that certain staff are aware of their obligations under the Ethics Act and under the HSE’s internal regulations”. I cannot see how the release of such limited information would discourage relevant staff from responding to future requests. While noting that the process in question is not a mandated requirement, given the limited information at issue, I do not accept that release could reasonably be expected to deter further participation.
The HSE has also argued that respondents would be reticent to respond openly should the records be released. In respect of the sections at issue, it seems to me that the question is whether staff would respond accurately, rather than openly. Those sections do not allow for open-ended responses. As I have stated, they are effectively tick-box confirmations. While I note that other information is contained in the records, such information is outside the scope of this request and review. Any future hypothetical FOI requests for further information could be considered on their merits and in light of the specific information at issue. I do not accept that the release of the information at issue in this case, namely confirmation of compliance by the relevant Clinical Directors with certain managerial responsibilities, could reasonably be expected to deter them from answering accurately, or indeed openly. Indeed, it seems to me that one of the purposes of such processes is to remind relevant staff of their obligations and responsibilities. It seems to me that increased transparency in this regard could arguably improve the quality and quantity of responses.
In light of the above, and the relatively high bar associated with section 30(1)(b), I am not satisfied that the HSE has sufficiently justified its position that the release of such limited information could reasonably be expected to have a significant, adverse effect on its performance of the relevant processes.
Section 37(1) provides for the mandatory refusal of a request where access to the record concerned would involve the disclosure of personal information relating to an individual other than the requester. Personal information is defined in section 2 of the FOI Act as information about an identifiable individual that (a) would, in the ordinary course of events, be known only to the individual or their family or friends or, (b) is held by a public body on the understanding that it would be treated by it as confidential. The FOI Act also details 14 specific categories of information that is personal information without prejudice to the generality of the foregoing definition, including, for example, (iii) information relating to the employment or employment history of the individual or (v) information relating to the individual in a record falling within section 11(6)(a) (personnel records).
Certain information is excluded from the definition of personal information. Paragraph (I) provides that where the individual is or was a staff member, the definition does not include the name of the individual or information relating to the office or position or its functions or the terms upon and subject to which the individual holds or held that office or occupies or occupied that position or anything written or recorded in any form by the individual in the course of and for the purpose of the performance of those functions.
As noted above, the HSE has not relied on section 37 in respect of the records at issue. However, in its submission it referenced that the records relate to “a personal statement”. In addition, section 37 is a mandatory exemption provision. As such, for the avoidance of doubt, I will consider the application of section 37(1) to the relevant information at issue.
It seems to me that the information is captured by the exclusion to the definition of personal information in Paragraph (I). The records at issue are documents completed and signed by relevant staff members, in this case Clinical Directors. It seems to me that such documents clearly comprise something “written or recorded in any form by the individual in the course of and for the performance of the functions aforesaid”. It seems to me that the information in question also relates to the individual’s office or position or its functions.
This Office accepts that the exclusion at Paragraph (I) does not provide for the exclusion of all information relating to such staff. Rather, we consider that the exclusion is intended to ensure that section 37 will not be used to exempt the identity of a staff member or director of, or office/position holder in, an FOI body in the context of the particular position held or any records created by the staff member, director or office/position holder while carrying out his or her official functions. The records at issue relate to an internal process undertaken to provide assurances in respect of the HSE’s system of controls. As noted above, the sections relevant to this review relate to what I would consider basic management functions or responsibilities. It seems to me that such information falls squarely within the exclusion to the definition of personal information at Paragraph (I). I do not accept that the release of the information could be considered to deprive relevant staff members of the right to privacy generally.
Accordingly, I find that the release of the relevant information contained in the records at issue would not involve the disclosure of personal information and that section 37(1) does not apply, by virtue of the information being captured by the exclusion in Paragraph (I).
In summary, I find that the HSE was not justified in refusing access to the relevant information in the records identified and I direct its release. Furthermore, I find that it was not justified in its effective refusal of further relevant records on the basis of section 15(1)(a).
Having carried out a review under section 22(2) of the FOI Act, I hereby annul the HSE’s decision. I find that it was not justified in refusing access to further records on the basis of section 15(1)(a) and I direct it to undertake a fresh decision making process on the applicant’s request. I further find that it was not justified in refusing access to relevant information in the records located on the basis of sections 30(1)(a), 30(1)(b) or 37(1) of the FOI Act and I direct the release of such information.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Stephen Rafferty
Senior Investigator