Cinneadh
Mr X and Enterprise Ireland
Ó Oifig an Choimisinéara Faisnéise
Cásuimhir: OIC-148586-N1V6Y4
Foilsithe
Teanga: Níl leagan Gaeilge den mhír seo ar fáil.
Ó Oifig an Choimisinéara Faisnéise
Cásuimhir: OIC-148586-N1V6Y4
Foilsithe
Teanga: Níl leagan Gaeilge den mhír seo ar fáil.
Whether Enterprise Ireland was justified in refusing access, under section 15(1)(a) of the FOI Act, to further HR records relating to the applicant other than those already released
20 September 2024
In a request dated 01 February 2024, the applicant sought access to his HR file for the period 2011 to the date of his request. On 13 February 2024, Enterprise Ireland asked the applicant to clarify the scope of his request. In his response of the same date, the applicant said he was seeking all of his personal information held by Enterprise Ireland, “as typically contained within the Civil Service Human Resources Personal Data Retention Schedule”, including all of his correspondence with the HR Department relating to the Protected Disclosures Act, information on Professional Added Years, information related to pension related claims, disability and occupational health, and learning and development.
On 20 February 2024, Enterprise Ireland informed the applicant that the request for all of his personal information was voluminous in nature and offered to help with reducing the scope of the request or identifying the exact records sought. In response, the applicant reiterated that he wanted access to his HR file. He referred to his previous email wherein he outlined the elements that he believed Enterprise Ireland should hold on a HR file.
On 28 March 2024, Enterprise Ireland issued its decision on the request wherein it said it had decided to grant the request. It provided an electronic link to the records and asked for an address to which the hard-copy records could be posted. It said the records contained some minor redactions of third-party personal information relating to another employee mentioned in email correspondence. It said the records cover a number of specified areas and provided an explanation of the information an Enterprise Ireland HR file typically contains. It said there had been no further updates to the applicant’s HR file since 2011 and that general communications with his HR specialist or other members of the HR team would not be copied to his HR file.
On 03 April 2024, the applicant sought an internal review of that decision. On 08 April 2024, he emailed Enterprise Ireland and suggested that there was a misunderstanding in relation to the information originally requested. He said his email of 13 February 2024 was “clear and unambiguous”. He said the decision issued suggested that there may be a distinction being made by Enterprise Ireland between his HR file and his “formal” HR file. He said he wished to access both categories of his file.
On 25 April 2024, Enterprise Ireland issued its internal review decision wherein it affirmed the original decision on the request. It said it was unclear from the applicant’s correspondence as to what additional records he was seeking and suggested that new searches could be undertaken as part of a clearer request. On 29 April 2024, the applicant applied to this Office for a review of Enterprise Ireland’s decision.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the submissions made by the applicant and Enterprise Ireland. I have decided to conclude this review by way of a formal, binding decision.
The applicant’s argument is that further relevant records should have been released in response to his request. Enterprise Ireland’s position is that no further relevant records come within the scope of his request exist. This is, in essence, a refusal to grant access to further relevant records under section 15(1)(a) of the FOI Act, which provides for the refusal of a request where the records sought do not exist or cannot be found.
Accordingly, this review is concerned solely with whether Enterprise Ireland was justified in refusing access, under section 15(1)(a) of the Act, to any further records coming within the scope of the applicant’s request.
Section 15(1)(a) provides that an FOI body may refuse to grant a request when records sought either do not exist or cannot be found after all reasonable steps to ascertain their whereabouts have been taken. The role of this Office in such cases is to review the decision of the FOI body and to decide whether the decision is justified. This means that we must have regard to the evidence available to the decision maker in arriving at their decision. The evidence in “search” cases generally consists of the steps actually taken to search for the records along with miscellaneous and other information about the record management practices of the FOI body, insofar as those practices relate to the records in question.
Having regard to the details of the exchanges between Enterprise Ireland and the applicant, and to the various exchanges between this Office and both parties, it is apparent to me that Enterprise Ireland and the applicant have fundamentally different views as to the precise scope and extent of the FOI request. These differences provide very practical difficulties for an assessment to be made by this Office of the adequacy of searches undertaken.
In its submissions to this Office, Enterprise Ireland outlined what it described as the “multiple interactions the FOI and Data Protection Office have had in an effort to provide [the applicant] with the information he has sought at various times over the past two years”. It said the applicant wrote to his assigned HR Specialist in the People & Culture Division of Enterprise Ireland in August 2022 seeking a copy of ‘information held on EI files about [him]’. It said the applicant subsequently clarified that he was seeking access to his HR file. It said his existing HR file was provided to him, on which there were no updates since 2011. It said a HR file typically contains the following:
• Personal Details (Birth Cert; Employee Information – Address/DOB/Bank A/C/Emergency Contact Details
• Recruitment/Job Details – Original Job Spec/Application/Contract of Employment and any changes on promotion. Applications for internal competitions are not kept on a HR file.
• Salary Details – Pay details on commencement and on promotion; Merit Awards.
• Performance & Training – copies of qualifications; probation review forms (on initial position and on promotion). PD forms are not filed here. They are held by OD.
• Absence/Medical/Accident – sick certs, jury service; queries on flexi.; pre-employment medical
Enterprise Ireland said that, given that the applicant did not have any promotions, assignments or significant absences during this time, there were no records to add to his file since 2011. It said that subsequently, in early 2023, the applicant submitted an informal request for information during a HR process in which he was involved. It said this request was processed by the Data Protection Office and that the applicant was provided with all correspondence on certain recruitment files, emails sent and received in respect of certain specified matters, and in relation to a pension added years query. It said that in March 2023, the applicant informed expressed the People & Culture Divisional Manager that he was not satisfied with what he had received through his request for information and on consultation with the DPO & FOI Officer, it was suggested that he make a further request formally through a Subject Access Request on the basis that this may assist in assuring him that all records had been found. It said a Subject Access Request was then submitted by the applicant which included a broader scope of records than had previously been released through the informal request. It said further records were released to the applicant on foot of that request.
Enterprise Ireland added that following further engagements between the parties in August 2023, it agreed to process a request by the applicant for sight of his HR file for the period 2011 to 2022 under data protection legislation. It said that following further searches carried out by the People & Culture Division, a response was sent under GDPR legislation that no records were found on the applicant’s HR file post 2011. It said the decision included the following statement:
“It is important to note that your HR file does not contain any information on competitions you applied for or general correspondence you may have had with HR representatives. If you wish to access any information on competitions or general correspondence, please let me know the details and I will request HR to carry out this search.”
Enterprise Ireland said that following further engagements, the applicant then submitted the request that is the subject of this review.
It is clear to me, having regard to the exchanges between the parties as summarised above, that Enterprise Ireland clearly explained the limits to the types of records that might be held on the applicant’s HR file. Regardless, in his request of 01 February 2024, the applicant again sought access his “HR file for the period 2011 to date”. He said the information requested is “all personal information and records in relation to [him] … covering the period 2011 to date”. In his email of 13 February 2024 wherein he sought to clarify the scope of his request, he said he was seeking all of his personal information “as typically contained within
the Civil Service Human Resources Personal Data Records Retention Schedule (as Version 31 Jan 2020 and amended)”. He went on to mention specific records in particular, including “all correspondence and records between [himself] and the HR Department relating to The Protected Disclosures Act 2014” and a “Record of Professional Added Years”.
The retention schedule the applicant referenced in his clarification of the request appears to be a general sample records retention schedule published by the then Department of Public Expenditure and Reform. Indeed, the record in question indicates that the types of records referenced in the schedule are not exhaustive and for guidance only. Indeed, the schedule indicates that “Departments and Offices should amend this schedule to suit the particular needs of each organisation”. It seems to me that when seeking to clarify his request, the applicant was suggesting that certain records should be held on his HR file, as opposed to those actually held on his HR file by Enterprise Ireland in his case.
It is important to note that the FOI Act is concerned with the provision of access to records that are actually held. It does not provide for a right of access to a record which ought to
exist. As such, if a request is made for records held on a HR file and those records are released, it is not the function of this Office to examine the records management practices of the body concerned or to consider if those practices are in compliance with wider general policies. I would note, however, that in his application to Enterprise Ireland on 08 April 2024 for an internal review of the original decision, the applicant acknowledged that the decision which issued on his request suggested that Enterprise Ireland might be making a distinction between his HR file and his “formal” HR file and he indicated that he wished to access both categories of his file. I take this as meaning that he was seeking access to HR type records that might not, as a matter of practice, be held on his formal file. Indeed, in his submission of 16 May 2024 to this Office, he indicated, among other things, that the period in question covers considerable correspondence and meetings between himself and the nominated HR representative, the CEO, the Head of People and the Director with responsibility for the HR function. He said he has copies of what he sent and the replies he received but that none of this documentation and related correspondence is on file or has been offered to him. He again referred to the fact that among other things, he had received no records relating to the protected disclosure of the record of professional added years.
In its submissions to this office, Enterprise Ireland acknowledged that certain other records relating to the applicant would be held outside of his HR file. Among other things, it said performance development (PD) records are held in Organisation Development (OD). It said it would be happy to carry out a search for such records but noted that the only PD records which are held by the OD team are those which have been agreed with the applicant and sent to them by his Manager. It added that if the applicant is looking for all records held by the People & Culture Division about him, this would require extensive searches across the Division and among other colleagues who worked for the Division but have moved on to other roles. It said that if this was the case, it would propose a discussion with the applicant to determine if there are particular records he is seeking. On the matter of records relating to a protected disclosure, it said that due to its inability to clarify the full extent of records and the repeated mention of the HR file, Enterprise Ireland proceeded with the request on the basis that it was for the HR file and that it did not consider protected disclosure records to come within the scope of its searches. It said protected disclosures are subject to the highest levels of confidentiality and record security and would never be held on a HR file. It said any records in relation to a protected disclosure are likely to rest with the designated person responsible for processing the report.
It is clear that Enterprise Ireland holds additional records that the applicant deems to come within the scope of his request. While Enterprise Ireland’s position is that it proceeded with the request on the basis that it was for the HR file due to its inability to clarify the full extent of records and the repeated mention of the HR file, it was apparent from the applicant’s email of 13 February 2024, wherein he sought to clarify the scope of his request, that he was seeking access to a broader range of records, including, for example, records relating to a protected disclosure. For this reason alone, I simply cannot find that Enterprise Ireland took all reasonable steps to ascertain the whereabouts of all relevant records. Accordingly, I consider that I have no option other than to annul the decision of Enterprise Ireland to refuse access, under section 15(1)(a) of the Act, to any additional relevant records other than those already released and to remit the request back to it for a fresh decision.
I should add, however, that as things stand, a simple reconsideration of the request afresh without further engagement between the parties is unlikely to satisfactorily resolve the issue. While the applicant considers that the clarification of his request as set out in his email of 13 February 2024 was clear and unambiguous, it was anything but, in my view.
It is important to note here that under section 12(1)(b) of the FOI Act, a request for access to records must contain sufficient particulars in relation to the information sought to allow the relevant records to be identified by the taking of reasonable steps. It seems to me that the applicant has received a substantial number of records from Enterprise Ireland to date through various fora and that he would be best placed, therefore, to identify the specific records he believes to be outstanding. There should be no ambiguity in relation to the nature of records sought in an FOI request. A request for “all records relating to” an individual, without more, invariably runs the risk of being misinterpreted. I should add that while FOI bodies are obliged, pursuant to section 12(6) of the Act, to offer assistance in the preparation of a request, it seems to me that Enterprise Ireland made several such efforts to assist the applicant in this case.
I would also note that section 15 of the FOI Act provides for the refusal of a request on a number of administrative grounds that are of potential relevance in this case, including sections 15(1)(b) and 15(1)(i). Under section 15(1)(b), a request may be refused where the request does not comply with section 12(1)(b), i.e. the request does not contain sufficient particulars in relation to the information sought to allow the relevant records to be identified by the taking of reasonable steps. Moreover, under section 15(1)(i), a request may be refused where the request relates to records already released to the requester and are available to the requester. Accordingly, it seems to me that it would be in the applicant’s best interests to seek to come to an agreement with Enterprise Ireland on the exact nature of his request before it is considered afresh.
In conclusion, therefore, while I have decided to annul Enterprise Ireland’s decision and to remit the request back for a fresh consideration, I strongly urge the applicant to engage more fully with Enterprise Ireland in identifying the precise records he believes to be outstanding.
Having carried out a review under section 22(2) of the FOI Act, I hereby annul Enterprise Ireland’s decision to refuse access, under section 15(1(a) of the FOI Act, to further records coming within the scope of the applicant’s request other than those released to date. I direct Enterprise Ireland to conduct a fresh decision-making process on the request.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Stephen Rafferty
Senior Investigator