Decision
Mr V and Department of Social Protection
From Office of the Information Commissioner (OIC)
Case number: OIC-143426-Y9Z6B8
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-143426-Y9Z6B8
Published on
Whether the Department was justified in refusing access, under sections 32(1)(a)(i), 32(1)(a)(ii) and 37(1) of the FOI Act, to records relating to applications for the Pandemic Unemployment Payment (PUP)
23 April 2024
The applicant acted through his solicitor in this case and references to the applicant may be taken as references to his solicitor, as appropriate.
In 2023, the Department of Social Protection contacted the applicant and said that he had been overpaid on the Pandemic Unemployment Payment (PUP) and would have to repay these monies to the Department. On 28 August 2023, the applicant sought access to his file, including “any claims made by him and on his behalf and any decisions made to include any PUP payment applications in particular any claims made to include period 14/07/2020 to 16/02/2021, paper based and online applications, to date”. In a decision dated 22 September 2023, the Department refused the FOI request. It identified 22 relevant records and refused access to all of them under sections 32(1)(a)(i) and (ii) of the FOI Act, stating that the applicant’s entitlement to a PUP was under investigation. The applicant sought an internal review of this decision on 28 September 2023, stating that a demand for funds to be repaid had been made, and in order to get legal advice he needed a copy of his file. On 18 October 2023, the Department affirmed the decision to refuse access to the records. It said that a criminal investigation was active and ongoing and that no documents would be released until such time as the criminal investigation was complete. On 27 October 2023, the applicant made an application to this Office for a review of the Department’s decision. He said that giving him access to his own records could not be expected to prejudice or impair matters where they are solely to be used to defend himself in a case made against him by the Department.
Following a request for submissions from this Office, the Department noted that there had been developments in the case. It said that representatives of the Department’s Special Investigations Unit (SIU) had met with the applicant in November 2023 and that a statement was taken. It said that it now believed the applicant to be the injured party in this case, and that it accepted that he did not receive any of the PUP awarded under his PPSN. It said that a criminal investigation into what appeared to be a fraudulent claim was ongoing. It said that the Department wrote to the applicant on 7 February 2024 notifying him that the PUP overpayment had been cancelled and that his revenue record would be subsequently amended. The applicant confirmed that, notwithstanding that the overpayment had been cancelled, he wished the review by this Office to continue.
Further to these developments, the Department revised its position on some of the records. While it continued to refuse access to records 1-11 under sections 32(1)(a)(i) and (ii), it released record 18 and part-released records 12, 13, 19 and 20, with some redactions under section 37 (personal information). It refused to release records 14 to 17 under section 37. In relation to records 14-16, the Department said that they contained emails received from email accounts that are not listed as verified on the Department’s systems but that they could be released if the applicant verified that these email accounts were linked to him. It said that record 17 contained information received by email from a third party and that if consent was received by the third party, the record could be released. The applicant was invited to comment on the Department’s revised position but no comments or submissions have been received to date.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the correspondence set out above, to the submissions made by the Department, and to the comments made by the applicant in his application for review. I have also examined the records at issue. I have decided to conclude this review by way of a formal, binding decision.
Records 19 and 20 are duplicates of the same record, so I will give no consideration to record 20.
This review is concerned with whether the Department was justified in refusing to release records 1-11 under sections 32(1)(a)(i) and (ii) of the FOI Act, and records 12-17 and 19, in full or in part, under section 37 of the FOI Act.
It is important to note that a review by this Office is considered to be “de novo", which means that it is based on the circumstances and the law as they pertain at the time of the decision and is not confined to the basis upon which the FOI body reached its decision.
Furthermore, although I am obliged to give reasons for my decision, section 25(3) of the FOI Act requires me to take all reasonable precautions in the course of a review to prevent disclosure of information contained in an exempt record.
Finally, it is important to note that the release of a record under FOI is, in effect, regarded as release to the world at large given that the Act places no constraints on the uses to which a record released under the Act may be put.
Section 32: Law enforcement and public safety
Section 32(1)(a)(i) provides for the refusal of a request where the FOI body considers that access to the record concerned could reasonably be expected to prejudice or impair the prevention, detection or investigation of offences, the apprehension or prosecution of offenders or the effectiveness of lawful methods, systems, plans or procedures employed for the purposes of the matters aforesaid. Section 32(1)(a)(ii) provides for the refusal of a request where the FOI body considers that access to the record concerned could reasonably be expected to prejudice or impair the enforcement of, compliance with or administration of any law.
Where an FOI body relies on section 32(1)(a), it should identify the potential harm in relation to the matters specified in the relevant sub-paragraph that might arise from disclosure. Having identified that harm, it should consider the reasonableness of any expectation that the harm will occur. The FOI body should explain how and why, in its opinion, release of the record could reasonably be expected to give rise to the harm envisaged. A claim for exemption under section 32(1)(a) must be made on its merits and in light of the contents of the particular record concerned and the relevant facts and circumstances of the case.
Submissions
As I have outlined above, I am required by section 25(3) of the FOI Act to take all reasonable precautions in the course of a review to prevent disclosure of information contained in an exempt record. Accordingly, I am limited in the extent to which I can describe the records or the Department’s submissions.
I do not believe I am in breach of section 25(3) by stating that the Department’s position is that it appears that fraudulent claims for the PUP were made by a third party or third parties using elements of the applicant’s Public Service Identity (PSI) dataset. While the Department is satisfied that the applicant did not receive the payments in question, a criminal investigation is ongoing pursuant to sections 4, 6 and 18 of the Criminal Justice (Theft and Fraud Offences) Act, 2001, and section 262(9)(a) of the Social Welfare Consolidation Act 2005. The Department stated that records 1-11 are of evidential value in this investigation, and that the unconditional public release of this evidence may prejudice or impair the outcome of the investigation before it is complete.
The applicant made no specific submissions on section 32, apart from stating in the application for review that access to his own records could not be expected to prejudice or impair matters where they are solely to be used to defend himself in a case made against him by the Department.
Analysis
Records 1-11 contain the details of claims made for the PUP using elements of the applicant’s Public Service Identity (PSI) dataset, including his PPSN. The records also disclose details such as the address and email address used for the claims, the bank account details, and employer details that were given. It has not been disputed by the applicant that these claims were made not by him, but by a third party or parties, now under investigation for potential fraudulent claims. It seems to me to that release of these records, in effect to the world at large, could disclose to an individual that they are under investigation and that, armed with that knowledge, they could take steps to undermine subsequent interventions or evade the Department’s attention. For these reasons, I accept that the release of such information could reasonably be expected to prejudice or impair the Department’s ability to prevent, detect, or investigate possible offences and could reasonably be expected to prejudice or impair its enforcement of, compliance with or administration of the law, specifically sections 4, 6 and 18 of the Criminal Justice (Theft and Fraud Offences) Act, 2001, and section 262(9)(a) of the Social Welfare Consolidation Act 2005. I am therefore satisfied that sections 32(1)(a)(i) and 32(1)(a)(ii) apply to records 1-11.
Section 37: Personal information
Section 37(1) of the FOI Act provides that, subject to the other provisions of the section, an FOI body shall refuse a request if access to the record concerned would involve the disclosure of personal information.
Section 37(2)(a) provides that section 37(1) does not apply where the information concerned relates to the requester concerned. However, section 37(7) provides that, notwithstanding section 37(2)(a), an FOI body shall refuse to grant a request if access to the record concerned would, in addition to involving the disclosure of personal information relating to the requester, also involve the disclosure of personal information relating to an individual or individuals other than the requester (commonly known as joint personal information). Section 37(2)(b) provides that section 37(1) does not apply if any individual to whom the information relates consents, in writing or such other form as may be determined, to its disclosure to the requester.
Section 2 of the FOI Act defines personal information as information about an identifiable individual that, either (a) would, in the ordinary course of events, be known only to the individual or members of the family, or friends, of the individual, or (b) is held by an FOI body on the understanding that it would be treated by that body as confidential. Section 2 goes on to specify 14 categories of information which, without prejudice to the generality of the above definition, constitute personal information, including (ii) information relating to the employment or employment history of the individual, (vi) information relating to any criminal history, or the commission or alleged commission of any offence, by the individual, the disposal of such proceedings or the sentence imposed by any court in such proceedings, and (x) information relating to the entitlements of the individual under the Social Welfare Acts as a beneficiary (within the meaning of the Social Welfare Acts) or required for the purpose of establishing whether the individual, being a claimant (within the meaning of those Acts), is such a beneficiary. Certain information is excluded from the definition of personal information, including the names of staff members of FOI bodies in the course of their functions. Paragraph (I) of section 2 refers.
The Department redacted two names from records 12, 13 and 19 under section 37. Having examined the records, I am satisfied that these do not relate to the applicant and they are not the names of staff members of an FOI body, and that they fall under the definition of personal information at section 2, and section 37(1) applies.
The other redactions are less straight forward. The bottom of record 13, and records 14-17 all contain emails sent to the Department with queries relating to PUP claims under the applicant’s PPSN. I am satisfied that these records all contain information falling within the definition of personal information, as set out above. Ordinarily, section 37(2)(a) would provide that such records would not be refused for release to the applicant under section 37(1) on the basis that the personal information relates to him. However, the Department’s position is that the email addresses used to send these emails are not the email addresses verified for communication with the applicant on the Department’s systems and indeed that the email address used in the email contained in record 17 appears to be the address of a third party. In its correspondence to the applicant on 20 March 2024, wherein it released additional records, the Department said that it would release these records to the applicant if he verified that the email addresses were linked to him, and if consent was given by the third party (in record 17). To my knowledge, no such verification has been provided to date.
Having carefully considered the records, and in circumstances where it appears to be accepted that persons other than the applicant made PUP claims using the applicant’s PPSN, I cannot conclude with any degree of certainty that these records contain personal information relating only to the applicant, such that section 37(2)(a) applies. I find therefore that section 37(1) also applies to these records.
That is not the end of the matter as section 37(1) is subject to the other provisions of section 37. Section 37(2) provides that section 37(1) does not apply in certain circumstances. I have already found that section 37(2)(a) does not apply, and I am satisfied that the circumstances set out in subsections (b) to (e) do not arise.
Section 37(5) provides that a request that would fall to be refused under section 37(1) may still be granted where, on balance (a) the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or (b) the grant of the request would benefit the person to whom the information relates. No argument has been made that the release of the records would benefit the persons to whom the information in the records relate, nor is it apparent to me how release would do so. I find that section 37(5)(b) does not apply.
Before I consider the applicability of section 37(5)(a), it is important to note that section 13(4) provides that, subject to the Act, in deciding whether to grant or refuse an FOI request, any reason that the requester gives for the request and any belief or opinion of the FOI body as to the reasons for the request shall be disregarded. In relation to the question of the public interest, this means that I cannot have regard to the applicant's motives for seeking access to the records at issue, except in so far as those motives reflect, or overlap with, what might be regarded as true public interest factors in favour of release of the records, i.e. in this instance, the applicant understanding the circumstances that gave rise to the Department assessing an overpayment against him, notwithstanding that this has since been cancelled. It is also important to note that the release of records under the FOI Act must be regarded, in effect, as release to the world at large, given that the Act places no constraints on the uses to which a record released under the Act can be put. All of this means that in considering whether a right of access exists to records under section 37(5)(a) of the Act, any decision to grant access would be on the basis that there is an overriding public interest in the release of the records effectively to the world at large that outweighs the privacy rights of the third party individuals concerned.
In considering where the balance of the public interest lies in this case, I have had regard to section 11(3) of the Act which provides that in performing any functions under the Act, an FOI body must have regard to, among other things, the need to achieve greater openness in the activities of FOI bodies and to promote adherence by them to the principles of transparency in government and public affairs and the need to strengthen the accountability and improve the quality of decision making of FOI bodies. However, in doing so, I have also had regard to the judgment of the Supreme Court in The Minister for Communications, Energy and Natural Resources and the Information Commissioner & Ors [2020] IESC 57 (“the Enet case”). In that case, the Supreme Court found that a general principle of openness does not suffice to direct release of records in the public interest and “there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure”. Although the Court’s comments were made in cases involving confidentiality and commercial sensitivity, I consider them to be relevant to the consideration of public interest tests generally.
In this case, while the applicant did not identify any specific public interest factors in favour of the release of the records at issue that might outweigh, on balance, the privacy rights of the third parties and potential third parties, I note that in the request for internal review he referred to the overpayment that had been assessed against him and for which the Department were seeking repayment, and that he wanted access to his full file in order to obtain legal advice. Notwithstanding that there have been developments in the case in the meantime, and that the overpayment was subsequently cancelled, it seems to me that while the applicant has essentially expressed a private interest in seeking access to the records, this is reflective of a broader public interest in ensuring that when adverse decisions are made against individuals by the Department of Social Protection, the individuals are able to access relevant records in order to understand the basis for such a decision and the evidence to support it, such that they can make an informed decision on the next steps to take, as appropriate, which might include seeking an appeal or a review of the decision.
On the other hand, the FOI Act recognises the public interest in the protection of the right to privacy both in the language of section 37 and the Long Title to the Act (which makes clear that the release of records under FOI must be consistent with the right to privacy). It is also worth noting that the right to privacy has a constitutional dimension, as one of the unenumerated personal rights under the Constitution. Privacy rights will therefore be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy. Moreover, even where an overriding public interest in granting the request exists, there is a discretionary element to the application of section 37(5)(a).
Having considered the records at issue, it appears to me that releasing the third party names redacted from records 12, 13 and 19 would add little in terms of enhancing transparency around the Department’s decision-making process and that this modest enhancement is not sufficient to override the public interest in protecting the privacy of these two individuals. In relation to the emails in records 13 to 17, given the de novo nature of this review and the fact that there is no longer an adverse decision made against the applicant or an associated demand for overpayment, there seems to me to be little to be gained in releasing these records to him, if they were indeed sent by persons other than him or associated with him, in terms of increasing transparency and accountability around the Department’s decision making on his social welfare entitlements. The fact that the emails were potentially sent by persons purporting to be the applicant has no bearing on their right to privacy in this case, and indeed I note that the definition of personal information at part (vi) of section 2 includes information relating to the commission or alleged commission of any offence. I find that it has not been established that there is a public interest in releasing these records that outweighs the public interest that the right to privacy of the individuals to whom the information relates should be upheld, and therefore section 37(5)(a) does not apply.
It remains open to the applicant to engage with the Department and to verify with it all email addresses used by him or on his behalf to communicate with the Department in relation to the PUP, such that the further relevant parts of records 12-17 and 19 could be released to him pursuant to sections 37(2)(a) and/or (b).
Having carried out a review under section 22(2) of the FOI Act, I hereby affirm the Department’s decision. I find that it was justified, under sections 32(1)(a)(i), 32(1)(a)(ii) and 37(1) of the FOI Act, in refusing to release the records at issue.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Emer Butler, Investigator