Cinneadh
Ms H and Health Service Executive
Ó Oifig an Choimisinéara Faisnéise
Cásuimhir: OIC-145568-W8W3C6
Foilsithe
Teanga: Níl leagan Gaeilge den mhír seo ar fáil.
Ó Oifig an Choimisinéara Faisnéise
Cásuimhir: OIC-145568-W8W3C6
Foilsithe
Teanga: Níl leagan Gaeilge den mhír seo ar fáil.
Whether the HSE was justified in refusing access to Webex footage and minutes of a meeting on the basis of sections 37(1) and 15(1)(a) of the FOI Act
9 September 2024
In a request dated 22 November 2023, the applicant sought access to the following documents from a named Hospital (the Hospital): Minutes of two meetings referred to in internal hospital emails which concerned complaints made by the applicant in relation to her late father’s care. On 7 December 2023, the Hospital issued its decision on the matter, the Hospital stated thatone meeting took place on 9 March 2023 and was held online via Webex, it said that there was no minutes taken at the meeting and accordingly, the request was refused under section 15(1)(a) of the FOI Act. The applicant sought an internal review of the Hospital’s decision on 11 December 2023. The applicant specified that she was also seeking a copy of the Webex footage as well as minutes of the relevant meeting. On 21 December 2023, the HSE issued an internal review decision on the matter. The HSE affirmed the decision to refuse a copy of the minutes under section 15(1)(a), on the basis that no minutes existed.
The HSE also confirmed that the Hospital held footage of the Webex call, it states that the first 33 seconds of the call had been recorded but that the recording stopped when the host left. It states that the host was responsible for setting up the call but left once it started as they were not required to be in attendance. It further refused access to the Webex footage under section 37(1), stating that the video images captured on the call constituted the personal information of the staff. The HSE contends that the exclusion of certain information relating to staff members of FOI bodies from the definition of personal information does not extend to video footage. On 22 January 2024, the applicant applied to this Office for a review of the HSE’s decision.
During the course of the review, I contacted the applicant and provided details of the HSE’s submissions wherein it outlined the searches undertaken, and the reasons for concluding that no further records exist in relation to the request, other than the Webex footage withheld under section 37(1). I invited the applicant to make a submission on the matter, which she duly did.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the submissions made by the HSE in support of its decision and to the applicant’s comments and submissions to this Office. I have also had regard to the contents of the records concerned. I have decided to conclude this review by way of a formal, binding decision.
During the course of the applicant’s engagement with this Office, she clarified that she is seeking the names of all attendees of the Webex video. In addition, she sought that the list of names include each attendee’s role, title, their employment status and their reason for being asked to attend the meeting. She further sought information on all strategy notes, paper notes, post – it notes, electronic invitations diary entries related to the meeting. The applicant did not request this information as part of her original request to the HSE or during the internal review. As the applicant is aware, the scope of any review undertaken by this Office is confined to the original request made and/or to any subsequent narrowing of the scope of the request either during the processing of the request by the FOI body or during the review being undertaken by this Office. We have no authority to broaden the scope of a review beyond what was originally sought. Accordingly, I cannot consider this information for release to the applicant.
The scope of this review is concerned with the following:
• Whether the HSE was justified in refusing access to a copy of the meeting minutes under section 15(1)(a) of the FOI Act
• Whether the HSE was justified in refusing access to the Webex footage under section 37(1) of the FOI Act
Before addressing the substantive issues arising, I would like to make the following preliminary comments.
During the course of this review, the applicant raised a number of concerns related to the FOI Officer’s role and his attendance at meetings to discuss the complaints submitted. She alleged that he was in breach of his role due to “a clear conflict of interest”. I wish to re – iterate to the applicant that this Office has no remit to investigate complaints, to adjudicate on how FOI bodies perform their functions generally, or to act as an alternative dispute resolution mechanism with respect to actions taken by FOI bodies. The applicant has also raised grievances in relation to how her complaint against the named nurse was dealt with by the Hospital during the review process under the Health Act 2004. This Office has no jurisdiction in relation to such a matter. As I explained to the applicant previously, our role is confined to considering whether the decision taken by the HSE is in accordance with the provisions of the FOI Act.
The applicant also raised a number of concerns relating to the Data Protection Act 2018, and the General Data Protection Regulation (GDPR). In her submissions to this Office, the applicant has requested this Office note a number of issues which she alleges are breaches of Article 38 under the GDPR. It is also important to note that the request in this case was made under the FOI Act, which operates independently of data protection legislation. This Office has no role in making such a determination, the statutory powers of the Commissioner are confined to what is set out in the FOI Act 2014. It is also worth stating, that requests for access to records under the FOI Act must be processed in accordance with the provisions of the FOI Act.
Section 15(1)(a)
Section 15(1)(a) of the FOI Act provides for the refusal of a request where the records sought do not exist or cannot be found after all reasonable steps to ascertain their whereabouts have been taken. Our role in a case such as this is to review the decision of the FOI body and to decide whether that decision was justified. This means that I must have regard to the evidence available to the decision maker and the reasoning used by the decision maker in arriving at their decision and must assess the adequacy of the searches conducted by the FOI body in looking for relevant records. The evidence in “search” cases generally consists of the steps actually taken to search for the records along with miscellaneous and other information about the record management practices of the FOI body, insofar as those practices relate to the records in question. It is important to note that a review by this Office is not concerned with access to records that a requester believes ought to exist.
Upon submission of her applicationto this Office the applicant provided a number of appendices as supporting evidence in relation to this application. The applicant refutes the Hospital’s assertion that no minutes of the relevant meeting were taken, in particular she has pointed to emails issued on 3 March 2023 from a relevant doctor to a number of staff members within the hospital. The email in question suggests a meeting to discuss a complaint received from the applicant following the death of her late father while in the Hospital. The applicant has pointed to a line in the email from the doctor in question which states that someone should take minutes at the meeting in question. The applicant also highlighted a second email issued on 7 March 2023 which highlighted a number of agenda items for discussion at the meeting in question. The applicant maintains that both emails are evidence of minutes being taken at the meeting on 9 March 2023. The applicant argues that it would be unusual for meetings of this type to not be fully recorded and minuted and for notes not to be written down as decisions would have been made which required action.
As noted above, the HSE provided this Office with details of the searches it undertook to locate relevant records, details of which were provided to the applicant. While I do not propose to repeat details of those searches in full I can confirm that I have had regard to them.
In the request for submissions which issued to the HSE I sought clarity on why it said that minutes were not taken for the meeting in question, when in the email issued by the named doctor on 3 March 2023, a minute taker had been clearly requested. I sought clarity on whether a decision had been taken not to record any minutes. In its response the HSE said that the meeting in question was an informal meeting that did not require minutes to be taken, and that there are many informal meetings which take place within a hospital setting, it said that while they may be informal they are important as they help the Hospital progress matters. It said examples of when informal meetings may be held are when further expertise is required, or staff need to be fully informed of pertinent information in order to make a decision or progress a matter. It states that no decision was taken not to take minutes but that it is simply the case that none were taken given the nature of the meeting. It also states that no agreed action items were recorded or circulated after the meeting as there was no actions arising out of the meeting. In relation to searches carried out for the minutes in question it said that all staff who attended the meeting were asked to confirm if they took minutes and all confirmed they did not. It states that staff were also requested to search their own personal files and confirm if any records existed, it said that the staff did not find any minutes. It also confirmed that had minutes been taken, this would have been carried out by one staff member in particular, this staff member has confirmed that she was not asked to take minutes and that none were taken. The HSE confirmed that both soft and hard copy files were searched including personal files of staff, FOI files, Complaint files etc. it provided a list of the search terms used to search for the minutes, these search terms included the applicants name, the date of the meeting, the applicant’s fathers name and various abbreviations of same. The HSE also confirmed that no other strategy meetings were held regarding the applicant’s complaint.
In response to the HSE’s submissions the applicant has argued that it is not plausible that if a minute taker was requested that no minutes were taken of the meeting. She said that the email sent from the named Doctor specifically asked for one person taking minutes in order to formulate a response and she argues that it can clearly be seen that the meeting was not informal and covered serious matters with consequences for all involved. The applicant argues that the seriousness of the situation was an indication that the meeting could not have been an informal meeting as the HSE are now trying to withhold the Webex footage. The applicant has alleged that if minutes were not taken after being requested it is evidence of negligent management.
My Analysis
It is important to note that the FOI Act is concerned with access to records held by public bodies. If the record sought is not held by the public body, then that is the end of the matter. Accordingly, the question I must consider is whether the HSE has, at this stage, carried out reasonable searches for the record in question. The Hospital said that minutes were not taken due to the “informal” nature of the meeting, this appears to be in conflict with the emails of the 3 and 7 March 2023, in which the named doctor requests a minute taker in order to formulate a strategy of response, I also note that in the email of 7 March 2023 agenda items for discussion were circulated in advance of the meeting, this email was issued to the named staff member which the HSE has stated has responsibility for minute taking at such meetings and the email clearly states “there are a number of strands to this complaint and we need to set out our strategy going forward”. I can see from the agenda items in the email that there are various matters for discussion including FOI requests from the applicant, a complaint, and various pieces of correspondence.
The HSE maintain that no decision was taken not to record minutes, however it is clear from the emails referred to above that it had been anticipated that a minute taker would be required, and that a strategy was to be agreed upon going forward. It seems to me that it is unlikely no minutes were taken unless the decision was changed either verbally or by written instruction. It seems to me that it would have been prudent of the Hospital to note such a change in instruction and that there should be clear procedures around such matters. While I wish to make note of the above, the question I must consider for the purposes of this review is whether reasonable steps have been carried out to ascertain the whereabouts of the minutes in question. Having regard to the HSE’s submissions, I am satisfied that reasonable searches have been carried out. I note in particular that all attendees at the meeting have been contacted and that all have confirmed that no minutes were taken, and that each of them have searched their own personal files using clear search terms for the information in question. I also note that the complaint file and FOI files relating to the applicant have also been searched using clear search terms to capture any such information. It should be noted that although an applicant might expect a record to exist or even consider that a record should exist this is not something which I can consider as part of my decision. As stated above, how an FOI body carries out its functions is not a matter for this Office, the Hospital has provided an explanation of why the record wasn’t created and provided details of the searches carried out in the absence of any additional evidence to suggest otherwise, I must find that the Hospital was justified to refuse the applicant’s request under section 15(1)(a), on the grounds that the record does not exist.
Section 37
Section 37(1) of the FOI Act provides that, subject to the other provisions of the section, an FOI body shall refuse a request if access to the record concerned would involve the disclosure of personal information relating to individuals other than the requester.
Section 2 of the Act defines “personal information” as information about an identifiable individual that (a) would, in the ordinary course of events, be known only to the individual or his/her family or friends, of the individual or (b) is held by an FOI body on the understanding that it would be treated by it as confidential. Section 2 goes on to provide a non-exhaustive list of fourteen categories of personal information, including (i) information relating to the medical history of the individual.
In addition, Paragraph (I) of section 2 of the Act excludes certain information from the definition of personal information, including "... in a case where the individual holds or held office as a director, or occupies or occupied a position as a member of the staff, of a public body, the name of the individual or information relating to the office or position or its functions or the terms upon and subject to which the individual holds or held that office or occupies or occupied that position or anything written or recorded in any form by the individual in the course of and for the purpose of the performance of the functions aforesaid ...".
The exclusion at Paragraph (I) does not exclude all information relating to staff members. The exclusion is intended, essentially, to ensure that section 37 cannot be used to exempt the identity of a public servant in the context of the particular position held, or any records created by the staff member while carrying out his or her official functions, or information relating to the terms conditions and functions of positions. The exclusion does not deprive public servants of the right to privacy generally.
The Webex footage at issue is 33 seconds long, it captures footage of three staff members along with their names, who joined the relevant meeting on the 9 March 2023. There is no audio recording of the meeting, and nobody speaks on the call before the recording is stopped. As there is no audio on the call there is no discussion of the applicant’s late father, there is accordingly, no personal information relating to her late father within the record.
In her submissions to this Office, the applicant argues for the release of the record on the basis that the individuals on the call are staff members of public hospitals carrying out their functions and are therefore not captured by section 37(1) in the circumstances. The applicant has further argued that all employees would be aware that their attendance at the meeting was in a work capacity and therefore their attendance would not be regarded as personal information as it was in the performance of their role within a tax funded body. She claims that this means that they can have no reasonable expectation of privacy. The applicant has also sought the release of the footage subject to the pixilation of any images of third parties. In relation to her claims concerning the facility to pixelate images, the applicant specifically referenced a previous decision issued by this Office (OIC-136390-X2R4D4), in which she alleges that this Office incorrectly determined that the HSE did not have the facility to pixelate the footage, as she states she was provided with pixelated footage on foot of a SAR request to the Hospital months earlier.
In its submissions to this Office, the HSE argued that the Hospital is satisfied that the footage in question is the personal information of the staff and had due regard to the exclusions at paragraphs (l) and (ll) of the definition of “personal information”.
It contends that the intention of these exclusions are to ensure that section 37 cannot be used to exempt the identity of a public servant in the context of the particular position held, or any records created by the staff member while carrying out their official functions or information relating to the terms, conditions and functions of the positions. It argues that the exclusion does not deprive staff of their general right to privacy. It states that the Hospital is of the opinion that the exclusions do not apply to the images captured on the footage, the HSE referred to a previous decision of the Information Commissioner in support of this position (OIC-96388-T2D5Z1) in which the Senior Investigator determined that video images of staff in a Hospital constituted personal information of the staff outside of the exclusions paragraph (I) of section 2(1) of the Act. The Hospital further noted that none of the staff members in question have consented to the release of their images and that this type of information is not available to the general public.
This Office has previously distinguished between the name of a staff member contained in an official record and an image of that staff member captured on footage, and considered that additional information going beyond mere identification can be derived from such an image that is unrelated to either the position held by the staff member or its functions. Given the nature of the record at issue, I am satisfied that their release would involve the disclosure of personal information relating to individual(s) other than the applicant and her father and that section 37(1) applies. However, that is not the end of the matter as section 37(1) is subject to the provisions of subsections (2) and (5).
Section 37(2)
Section 37(2) of the FOI Act sets out certain circumstances in which the exemption at section 37(1) does not apply. I am satisfied that none of the circumstances at section 37(2) applies to the record in this case.
Section 37(5)
Section 37(5) provides that a request would fall to be refused under section 37(1) may still be granted where, on balance, (a) the public interest that the request should be granted outweighs the right of privacy of the individual to whom the information relates or, (b) the grant of the request would benefit the person to whom the information relates. No argument has been made that the release of the records to the applicant would benefit the third parties concerned, nor is it apparent to me how release would do so. I am satisfied that subsection (b) does not apply in the circumstances of this case.
Before I consider the applicability of section 37(5)(a), there are a number of important points to note. First section 13(4) provides that, subject to the Act, in deciding whether to grant or refuse an FOI request, any reasons that the requester gives for the request and any belief or opinion of the FOI body as to the reasons for the request shall be disregarded. In relation to the question of the public interest, this means that I cannot have regard to the applicant’s motives for seeking access to the records at issue, except insofar as those motives reflect or overlap with, what might be considered as true public interest factors in favour of the release of records i.e. insofar as the concerns raised in relation to the request may also be matters of general concern to the wider public.
Secondly, it is important to note that the release of records under the FOI Act must be regarded, in effect, as release to the world at large, given that the Act places no constraints on the uses to which a record released under the Act can be put. With certain limited exceptions provided for under the Act, such as under sections 37(2)(a), and 37(8) FOI is not about granting access to information to particular individuals only and as noted above, a requester's reasons for making a request are generally not of relevance. Thus, records are not released under FOI for any limited or restricted purpose.
All of this means that in considering whether a right of access exists to records under section 37(5)(a) of the Act, any decision to grant access would be on the basis that there is an overriding public interest in the release of the records effectively to the world at large that outweighs the privacy rights of the third party individuals concerned.
In considering where the balance of the public interest lies in this case, I have had regard to section 11(3) of the Act which provides that in performing any functions under the Act, an FOI body must have regard to, among other things, the need to achieve greater openness in the activities of FOI bodies and to promote adherence by them to the principles of transparency in government and public affairs and the need to strengthen the accountability and improve the quality of decision making of FOI bodies. However, in doing so, I have also had regard to the judgment of the Supreme Court in The Minister for Communications, Energy and Natural Resources and the Information Commissioner & Ors [2020] IESC 57 (“the Enet case”). In that case, the Supreme Court found that a general principle of openness does not suffice to direct release of records in the public interest and “there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure”. Although the Court’s comments were made in cases involving confidentiality and commercial sensitivity, I consider them to be relevant to the consideration of public interest tests generally.
In her submissions to this Office, the applicant did not specifically refer to public interest factors in favour of the release of the footage in question, however, the applicant has made a number of arguments in relation to the care which her father received as a patient in the Hospital, which she claims led to his death, and she has also advanced arguments around the procedures employed by the Hospital. Essentially, she has argued that that the Hospital has attempted to cover up its wrongdoings in relation to what she claims was negligent care of her father, she argues that as the attendees of the strategy meeting are employees of a public body and were called to a meeting related to her complaint in respect of her father’s care, that the footage should be made available to her. She argues that such a matter cannot be considered “informal” and that the matter is extremely serious and that there is an attempt to cover up criminal behaviour within the HSE. She has argued that there appears to be a high level of corruption within the HSE. She contends that holding unrecorded and un-minuted strategy meetings between Senior Management, the Data Protection Officer/FOI Officer, staff members and the Doctor who she claims was involved with the death of her father appears to be extremely underhand and dangerous and “takes the public for fools”.
The HSE has argued that it has considered the public interest in ensuring the openness and accountability of public bodies in the performance of their functions. It also argued that it considered the right of privacy of other individuals captured in the footage and that it was decided on balance that the release of this personal information would not further served the public interest to such an extent that a breach to the other peoples right of privacy would be justified. It noted that the release of record under FOI is regarded as release to the world at large, given that the Act places no constraints on the uses to which the information contained in those records may be put. In the particular circumstances of this case, it notes that the applicant has engaged with the hospital through a number of different processes some of which are still ongoing, it states that in light of this engagement by the applicant and given the frequency, tone and nature of these contacts, the Hospital is committed to protecting their staff as much as possible including the protections of their staff’s privacy rights. It states that for these reasons, the hospital is of the opinion that the images of their staff should be protected and that section 37(5)(a)/(b) do not apply.
As stated above, the footage in question captures no audio recording and no discussion of the matters which concern the applicant’s late father. It captures video images of three employees, not including the doctor who called the meeting. In terms of engaging the public interest arguments in release of the record, it is hard to see how it would further any of the applicant’s concerns relating to the care of her father or how care is administered in the Hospital as the record doesn’t reveal anything related to any kind of discussions concerning either matter. Overall, the only thing the record would reveal is the images of the three staff members who joined the meeting first, as far as I’m concerned this gives no insight into the openness or accountability of a public body nor in my view, does it even provide limited insight into her father’s care or how the Hospital carried out its functions in this regard. In the circumstances of this case, it is unclear to me how the release of this specific record would further the public interest identified above. I am satisfied that staff members in any public organisation can have a legitimate expectation that their employer will protect their privacy insofar as they will not share images to the world at large. I know of no public interest factors in the circumstances of this case in favour of the release of the images of the third parties in question that would, on balance, outweigh their privacy rights. I find, therefore, that section 37(5)(a) does not apply in this case.
Section 17(4)
For the sake of completeness, I have also considered whether there is an obligation on the HSE under the FOI Act to grant partial access to the footage in question.
While the Act does not generally require a public body to create a new record in order to grant a request (apart from a specific requirement under section 17(4) that I will address shortly), section 2 of the Act defines “record” as including “a copy or part” of anything falling within the definition of a record. Furthermore, section 18(1) provides, that "if it is practicable to do so", access to an otherwise exempt record shall be granted by preparing a copy, in such form as the head of the FOI body concerned considers appropriate, of the record with the exempt information removed.
The applicant has argued that the previous decision issued by this Office (OIC-136390-X2R4D4) incorrectly determined that the HSE did not have the in house facility to pixelate footage, she contends that she received pixelated footage from the HSE on foot of a complaint which she made to the Data Protection Commission prior to the previous decision issuing. The applicant contends that this is clear evidence that the HSE was either in the position to use a pre – existing facility or external facility for search and extraction in order to provide the pixelated version of the footage at issue.
I sought submissions from the HSE following receipt of the applicant’s submissions. The HSE’s position is that GDPR is a separate piece of legislation to FOI and each operate independently from each other. It pointed out that the requirements of an FOI body scheduled under the FOI Act are different to the requirements of a Data Controller under Data Protection legislation. It states that in this case, the requestor made her request under the FOI Act and the request was considered in line with that legislation. The HSE confirmed that it does not have the necessary facilities required to pixelate CCTV footage and it states that it would have to engage a contractor for a cost. It states that in these circumstances the HSE is satisfied that section 17(4) does not apply. It further said that as a Data Controller, the HSE considers all subject access requests in line with its responsibilities under Data Protection legislation including GDPR, it states that in cases where a request would include access to footage that requires pixilation, the HSE has engaged outside contractors but that those requirements do not apply to this case.
It is important to note that the FOI Act does not require public bodies to create records if none exist, apart from a specific requirement, under section 17(4), to extract records or existing information held on electronic devices. Under section 17(4), where a request relates to data contained in more than one record held on an electronic device by the body concerned, the body must take reasonable steps to search for and extract the records to which the request relates. The reasonable steps are those that involve the use of any facility for electronic search or extraction that existed on the date of the request and was ordinarily used by the FOI body. Where these reasonable steps result in the creation of a new record, that record is, for the purposes of considering whether or not such a new record should be disclosed in response to the request, deemed to have been created on the date of receipt of the request.
I accept the Hospital’s explanation in relation to the difference in the requirements between GDPR and FOI access. It is also important to note that the request in this case was made under the FOI Act, which operates independently of data protection legislation. If the Hospital is not in a positon to use any pre – existing facility available to it to pixelate facial images, then I am satisfied that section 17(4) of the FOI Act places no additional obligation on it to contract an external service, I say this notwithstanding any access requirements which may exist under GDPR. It is worth mentioning, that this Office has determined previously in two decisions (OIC-136390-X2R4D4, OIC-96388-T2D5Z1) that the reasonable steps that must be taken are those that involve the use of any facility for electronic search or extraction that existed on the date of the request and was ordinarily used by the FOI body. I accept that the Hospital is not in a position to use any pre-existing facility for search and extraction in order to provide a pixelated version of the Webex footage at issue and that section 17(4) does not apply in this case.
In conclusion therefore, I find that the HSE was justified in refusing the applicant’s request for a copy of the Webex footage under section 37(1) of the FOI Act.
Having carried out a review under section 22(2) of the FOI Act, I hereby affirm the decision of the HSE to refuse access under section 37 of the FOI Act, to Webex footage on the ground that its disclosure would involve the disclosure of personal information relating to third parties. I find that the public interest, on balance, does not favour its release. I also affirm its decision to refuse access, under section 15(1)(a) of the FOI Act to minutes of the strategy meeting on 9 March 2023, on the ground that no minutes exist.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Rachael Lord
Investigator