Cinneadh
Mr C and Financial Services and Pensions Ombudsman
Ó Oifig an Choimisinéara Faisnéise
Cásuimhir: OIC-152384-L7V7R5
Foilsithe
Teanga: Níl leagan Gaeilge den mhír seo ar fáil.
Ó Oifig an Choimisinéara Faisnéise
Cásuimhir: OIC-152384-L7V7R5
Foilsithe
Teanga: Níl leagan Gaeilge den mhír seo ar fáil.
Whether the FSPO was justified in refusing access, under sections 35(1)(a) and/or 37(1) of the FOI Act, to certain information relating to a competition for the role of Higher Executive Officer, including details of the qualifications of the candidates
6 June 2025
In a request dated 22 July 2024, the applicant submitted a request to the FSPO for certain records relating to a competition undertaken by a recruitment company (company A) on its behalf for the role of Higher Executive Officer. He sought access to the Data Protection Impact Assessment (DPIA) conducted by the FSPO before it engaged company A and if no such DPIA was undertaken, access to the DPIA that the FSPO conducted for those occasions when it engages recruitment firms to undertake recruitment competitions on its behalf. He also sought access to the shortlisting scoresheet or similar such document which assessed his suitability relative to other candidates for the role. He said the document in question should contain details, with names redacted, of all candidates, both successful and unsuccessful, who appeared on the shortlist. For reference, he provided a copy of an extract from an assessment sheet he received containing his own information.
In a decision dated 19 August 2024, the FSPO refused the first part of the request under section 15(1)(a) of the FOI Act on the ground that no such record exists. It refused the second part under sections 35(1)(a) and 37(1) of the FOI Act. The applicant sought an internal review of the decision on the second part of his request on 28 August 2024. In its internal review decision dated 19 September 2024, the FSPO varied its decision and granted partial access to the record with the redaction of certain information under sections 35(1)(a) and 37(1). On 30 September 2024, the applicant applied to this Office for a review of the FSPO’s decision to redact the information in the record coming under the heading “Desirable (if required) (not used for shortlisting purposes)”.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the submissions made by the FSPO and the applicant. I have also had regard to the contents of the record at issue. I have decided to conclude the review by way of a formal, binding decision.
The Information redacted under the heading identified by the applicant is contained within three columns. The first column is titled “A recognised qualification/degree of at least Level 7 on the National Framework of Qualifications in a relevant discipline such as Law, Business, Compliance, Business Process Improvement or other such discipline as deemed relevant to the role” and is populated with Yes/No answers. The second column is untitled and is populated with details of the specific qualification(s)/degree(s) of the candidates. The third column is titled “A recognised professional qualification in Mediation” and is populated with Yes/No answers.
This review is concerned solely with whether the FSPO was justified in refusing access, under sections 35(1)(a) and 37(1) of the FOI Act, to the information redacted from the three columns in question.
Section 37(1) of the FOI Act provides that, subject to the other provisions of the section, an FOI body shall refuse a request if access to the record concerned would involve the disclosure of personal information relating to an individual other than the requester.
Section 2 of the FOI Act defines personal information as information about an identifiable individual that, either (a) would, in the ordinary course of events, be known only to the individual or members of the family, or friends, of the individual, or (b) is held by an FOI body on the understanding that it would be treated by that body as confidential. Section 2 goes on to specify 14 categories of information which, without prejudice to the generality of the above definition, constitute personal information. Those categories include (i) information relating to the educational, medical, psychiatric or psychological history of the individual, and (iii) information relating to the employment or employment history of the individual. It is important to note that for information to qualify as personal information for the purposes of the FOI Act, it must be information about an identifiable individual. Where information may not, on the face of it, be about an identifiable individual, it may still be personal information if it allows the individual to be identified. An individual may not be named in a record, yet may still be identifiable.
In his correspondence with this Office, the applicant said the FSPO had provided him with a one-line extract from the shortlisting report pertaining to his application for the role. He said his application for the role listed ten educational qualifications but only one was shown on the shortlisting report. He said it was not his highest qualification but one that was joint third, along with three other qualifications at post graduate level. He said he would hardly recognise his own entry on the shortlisting report so very much doubted that he would ever be able to identify anyone else.
In its submissions to this Office, the FSPO said the withheld information relates to 120 individuals involved in a shortlisting process for Higher Executive Officer roles at the FSPO. It said the various columns in the table pertain to an assessment of individual candidates’ employment ability against a number of criteria and contains information relating to candidates’ right to work and their degrees and/or qualifications. It said its view is that the information relates to identifiable individuals. It said that while the redacted version of the record provided to the applicant does not on its own contain information relating to identifiable individuals, if the redacted information that is the subject of review is provided, then the entirety of the record contains personal information relating to identifiable individuals as once that information is provided it is evident how an individual candidate's ability has been assessed in the other columns.
In response to the applicant’s assertion that disclosing professional qualifications would not make candidates for the role identifiable, it said that in order to show the extent to which individuals are identifiable, it undertook a search of LinkedIn in respect of certain of the information contained in the degree/qualifications column. It provided details of specific searches it undertook and details of a number of examples where it considers that the individuals concerned were identifiable. It said that while it had not carried out a search for all degree/qualifications in respect of all candidates in the record, the examples it provided demonstrate that, with relative ease, a number of individuals could be identified by the disclosure of their degree/qualifications when coupled with other information which is publicly available. It said that in those circumstances, the entirety of the record for a particular candidate would become personal information relating to an identifiable individual. It said this Office should take a precautionary approach to the disclosure of personal information in circumstances where it has demonstrated that a number of candidates are identifiable from the information the subject of the appeal.
The FSPO added that when the list of degrees/qualifications is considered, there is little duplication throughout the list and a number of the degrees/qualifications are quite specific. It said that where there are multiple degrees/qualifications listed, this makes it even more likely that a candidate could be identified. It added that, as it believes it has demonstrated from the examples referenced above, even quite generic degree/qualification terms can lead to the identification of individuals when coupled with focussed search terms.
I also note that in its internal review decision, the FSPO also said that individuals who are successfully recruited to Higher Executive Officer roles with the FSPO are likely to be identifiable as their LinkedIn profiles will likely contain their job title and qualifications.
It is worth restating here that the information relating to each candidate that is at issue in this review is confined to the information redacted from three columns only, namely confirmation as to whether or not the candidate holds a relevant qualification of a particular level, the description of the qualification held, and confirmation as to whether or not the candidate holds a qualification in mediation. The disclosure of the information in the first column at issue (“A recognised qualification…”) would simply disclose whether or not a candidate holds a recognised qualification or degree of a specified level in a relevant discipline such as those referenced. The disclosure of the information in the third column would simply disclose whether or not a candidate holds a recognised professional qualification in mediation. I cannot see how the release of the information in those two columns would involve the disclosure of information about identifiable individuals, nor has the FSPO explained how it would.
On the matter of the information contained in the column that describes the nature of the qualification held, I should say at the outset that as section 25(3) requires this Office to take all reasonable precautions in the course of a review to prevent the disclosure of exempt information, I consider that I am not in a position to provide full details of the evidence presented by the FSPO of its LinkedIn searches or to provide full and detailed reasons for my findings. I can say, however, that in explaining how it considered that the release of details of the qualifications held by candidates would allow for the identification of individuals, the FSPO referenced certain information that is not the subject of this review, nor does such information appear to have been already released to the applicant. For example, it argued that the information contained in the column titled “Right to Work” would facilitate the identification of individuals as would the fact of an individual having listed his or her employment as being with the FSPO. The information in the column titled “Right to Work” is not under review and has not previously been released to the applicant. Moreover, the record at issue contains no details of a candidate’s existing or previous employer. As such, I consider that the use of information in an internet search that is not available to the applicant does not provide a valid basis for concluding that individuals can be identified from the sole disclosure of the descriptions of qualifications held by the various candidates.
Having regard to the very limited amount of information already disclosed, I am not satisfied that the disclosure of the description of a qualification held (e.g. Bachelor of Commerce, Barrister at Law Degree etc.) would involve the disclosure of information about an identifiable individual, regardless of how specific the qualification is. Moreover, even where more than one qualification is listed, it seems to me that there could be no certainty that an individual who may have recorded the same details on LinkedIn was, indeed, the candidate listed on the record at issue. Even if it was, it is difficult to see how the disclosure of the information in the record at issue would involve the disclosure of personal information in circumstances where that same information had already previously been made publicly available by the individual on LinkedIn. It would not be the release of the information in the record at issue that would give rise to the disclosure of personal information in those circumstances.
In conclusion, I find that the disclosure of the information that has been redacted from the three columns would not involve the disclosure of personal information relating to identifiable individuals. I find, therefore, that section 37(1) cannot apply.
Section 35(1)(a) of the FOI Act provides for the mandatory refusal of a request if the record concerned contains information given to an FOI body, in confidence and on the understanding that it would be treated by it as confidential (including such information as aforesaid that a person was required by law, or could have been required by the body pursuant to law, to give to the body) and, in the opinion of the head, its disclosure would be likely to prejudice the giving to the body of further similar information from the same person or other persons and it is of importance to the body that such further similar information as aforesaid should continue to be given to the body.
Section 35(2) of the FOI Act provides that subsection (1) shall not apply to a record which is prepared by a head or any other person (being a director, or member of the staff of, an FOI body or a service provider) in the course of the performance of his or her functions unless disclosure of the information concerned would constitute a breach of a duty of confidence that is provided for by an agreement or statute or otherwise by law and is owed to a person other than an FOI body or head or a director, or member of the staff of, an FOI body or of such a service provider.
As section 35(1) does not apply where the records fall within the terms of section 35(2), I deem it appropriate to consider the applicability of section 35(2) at the outset. The FSPO said the record at issue was a collation of information prepared by the FSPO's service provider, company A. It said the redacted information concerning the qualifications/degrees is effectively raw data received from the candidates and in the FSPO's view this is not caught by the section 35(2) carve out. It said that, if this is not the case, whether a record falls within section 35(1) or not in these circumstances would depend on the means by which the public body stores the information received and whether it leaves the information in its original form or collates it for administrative and storage purposes.
The question I must consider is whether the record containing the information at issue was prepared by a member of the staff of the FSPO or its service provider, company A. I am satisfied that it was. Accordingly, for section 35(1) to apply, release of the information at issue must constitute a breach of a duty of confidence that is provided for by an agreement or statute or otherwise by law and is owed to a person other than an FOI body or head or a director, or member of the staff of, an FOI body or of such a service provider.
The FSPO argued that the release of the record would constitute a breach of a duty of confidence that is provided for by an agreement and owed to the candidates. It said candidates engaged with the FSPO's recruitment process on the terms set out in the Candidate Information Booklet which provides that "Subject to the provisions of the Freedom of Information Act 2014, applications will be treated in the strictest confidence". In circumstances where the release of the information at issue would not, in my view, involve the disclosure of personal information relating to identifiable individuals, I simply cannot see how the release of that information would involve a breach of a duty of confidence owed to the candidates. I find that section 35(2) serves to disapply section 35(1)(a) in this case.
Having carried out a review under section 22(2) of the FOI Act, I hereby annul the FSPO’s decision. I find that the FSPO was not justified in refusing access, under sections 35(1)(a) or 37(1), to the Information redacted from the three columns under the heading “Desirable (if required) (not used for shortlisting purposes)”. I direct the release of the information in question.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Stephen Rafferty
Senior Investigator