Cinneadh
Mr A and Commission for Regulation of Utilities
Ó Oifig an Choimisinéara Faisnéise
Cásuimhir: OIC-149388-F0S9L2
Foilsithe
Teanga: Níl leagan Gaeilge den mhír seo ar fáil.
Ó Oifig an Choimisinéara Faisnéise
Cásuimhir: OIC-149388-F0S9L2
Foilsithe
Teanga: Níl leagan Gaeilge den mhír seo ar fáil.
Whether the CRU was justified in refusing access to an audio recording on the basis of sections 32(1)(a) and 37(1) of the FOI Act
This review has its background in a dispute between the applicant and a third-party energy supplier which gave rise to the applicant submitting a compliant to the CRU. According to the CRU, the crux of the applicant’s complaint related to the contents of a phone conversation that took place in May 2023 between the applicant and his energy supplier. The CRU said the supplier shared a transcript of the phone conversation with it and it understands that the supplier had also already shared it with the applicant. It said the applicant considered that the transcript had been altered and was not a true reflection of the conversation that had taken place. It said that notwithstanding the fact that the supplier is a regulated entity and required to provide accurate information to the CRU, it asked the supplier to share an audio recording of the conversation, so that the investigating officer could verify if the transcript was accurate or not, as the outcome of the investigation depended on what had been said on the call.
The CRU added that the recording could not be accessed as it did not have the necessary software that would support listening to the record. Instead, it arranged an MS Teams meeting with the energy supplier to allow the investigating officer to listen to the recording. It said that upon listening to the audio recording played during the MS Teams meeting, the investigating officer was of the view that the transcript was an accurate representation of the audio recording and the CRU’s complaint investigation proceeded on this basis.
The applicant’s position is that the transcript of the phone call is inaccurate. On 10 April 2024, he submitted an FOI request to the CRU for access to the audio recording. On 2 May 2024, the CRU refused the request under sections 32(1)(a)(ii) and 35(1)(a) of the FOI Act. In relying on section 32(1)(a)(ii), which is concerned with the protection of a record whose release could reasonably be expected to prejudice or impair the enforcement of, compliance with, or administration of any law, it identified the law in question as the General Data Protection Regulation (GDPR). On the same day, the applicant sought an internal review of the CRU’s decision.
On 16 May 2024, the CRU varied the grounds upon which it had decided to refuse the request. It said it was relying on section 32(1)(a)(ii) and was no longer relying on section 35(1)(a). It said that for the CRU to be able to release a copy of the call recording to the applicant in a way that does not prejudice compliance with GDPR, it would need to be able to access the recording and edit it to remove/redact the agent’s voice. It said this would require the CRU to purchase software that it does not own. It said that public bodies are not obliged under the FOI Act to take impractical steps to prepare a copy of a record that would not be considered exempt, as per section 18 of the Act.
On 24 May 2024, the applicant applied to this Office through his solicitors for a review of the CRU’s decision. References to communications with the applicant in this decision include references to communications with his solicitors, as appropriate.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the submissions made by the CRU and the applicant. I have decided to conclude this review by way of a formal, binding decision.
The record at issue comprises an audio recording of a phone call which took place between the applicant and the energy provider on 30 May 2023. As noted above, the audio recording was received in an inaccessible format. The CRU was informed that it would need to purchase software to access the file. It made the decision not to do so, instead arranging a phone call with the energy provider during which the audio recording was played. It said that this was sufficient for the purpose of its complaint investigation, which is the reason it had requested the audio recording. The CRU provided this Office with a copy of the record in question. We were also unable to access the recording. The Investigator liaised with the Office of the Government Chief Information Officer but was unable to arrange access. Accordingly, I have been unable to listen to the audio recording in question. I have considered the transcript of the call provided by the applicant, noting his position that the document is inaccurate. I have also considered the submissions received from the parties during the review.
In light of the fact that the CRU was unable to directly access the audio recording, I sought submissions in respect of whether it believed it held the record for the purposes of the FOI Act. In response, it said that section 11(1) provides for the right of access to “any record held by an FOI body”. It said that section 2(5) sets out that “a reference to records held by an FOI body includes a reference to records under the control of that body”. The CRU said that the record requested by the applicant was lawfully provided to the body by the energy supplier in connection with a statutory function of the CRU. It said, therefore, that while it was unable to access the content of the record due to a technical barrier, it is of the view that the CRU holds the record for the purposes of the FOI Act. Accordingly, I am satisfied that it is appropriate to go on to consider the FOI body’s substantive refusal of the record.
For the avoidance of doubt, the remit of this Office is limited to a consideration of records held by FOI bodies. In this case, the specific record in question has proven inaccessible to both the CRU and this Office. I cannot require the CRU to retrospectively obtain a version which it can access, nor can I direct the release of a version held by a third party (the energy supplier). Accordingly, even if I am to direct release, I cannot guarantee that the applicant will be able to access the record at issue. I understand that this may cause frustration, but the scope of this review and my remit is limited. The applicant was notified of the difficulty experienced in accessing the audio recording.
As noted above, the CRU relied on section 32(1)(a)(ii) in support of its refusal, which is concerned with the protection of records whose release could reasonably be expected to prejudice or impair the enforcement of, compliance with or administration of any law. Its position is that release of the record would prejudice its compliance with the GDPR. In light of the arguments made by the CRU and having regard to the fact that reviews before this Office are regarded as ‘de novo’, I formed the view that section 37 of the Act, which provides for the protection of third party personal information, fell to be considered. I notified the applicant of the potential relevance of section 37 and invited submissions which I will address below as appropriate.
Accordingly, this review is concerned with whether the CRU was justified in its decision to refuse access to the audio recording in question under section 32(1)(a)(ii) and/or section 37(1) of the FOI Act.
Before I address the substantive issues arising, I wish to address a number of preliminary matters. Firstly, I wish to clarify that the de novo nature of our review process essentially means that the review is based on the circumstances and the law as they pertain at the time of my decision and is not confined to the basis upon which the FOI body reached its decision. The CRU’s position is that the release of the audio recording would involve the release of personal data of the staff member of the energy supplier. Section 37 is a mandatory exemption that serves to protect third party personal information. Accordingly, in light of the de novo nature of our reviews, I consider it appropriate to consider the applicability of that mandatory exemption, notwithstanding the fact that CRU did not rely on the provision as a ground for refusing the request.
Secondly, I note that in his correspondence with this Office, the applicant referenced his engagement with the third-party energy supplier and the manner in which his complaint was handled by the CRU. It is important to note that this Office has no remit to investigate complaints, to adjudicate on how FOI bodies perform their functions generally, or to act as an alternative dispute resolution mechanism with respect to actions taken by FOI bodies or indeed third parties.
Thirdly, section 13(4) of the Act provides that, subject to the Act, in deciding whether to grant or refuse an FOI request, any reason that the requester gives for the request and any belief or opinion of the FOI body as to the reasons for the request shall be disregarded. Thus, while certain provisions of the Act implicitly render the motive of the requester relevant, as a general rule, the actual or perceived reasons for a request must be disregarded in deciding whether to grant or refuse an access request under the FOI Act.
Section 32(1)(a)(ii) provides that an FOI body may refuse to grant an FOI request if it considers that access to the record concerned could reasonably be expected to prejudice or impair the enforcement of, compliance with or administration of any law. Where an FOI body relies on section 32(1)(a), it should identify the potential harm to the matters specified in the relevant sub-paragraph that might arise from disclosure and, having identified that harm, consider the reasonableness of any expectation that the harm will occur. In doing so, the FOI body should show how or why releasing the particular record could reasonably be expected to cause the harm which it has identified.
In its submissions, the CRU said that although it has been unable to access the record concerned, it is aware that the record contains personal data, as defined in Article 4(1) of the GDPR, of a data subject other than the applicant, in this case the employee of the energy supplier. It said that it understands that the third party has the right to the protection of personal data concerning them and that the protection provided by the GDPR is broader than that provided under the FOI Act.
The CRU referenced Article 5 of the GDPR and certain requirements therein: that personal data be processed lawfully, fairly and in a transparent manner; that it be collected for specified, explicit and legitimate purposes; and that it be processed in a manner that ensures appropriate security of personal data, including protection against unauthorised or unlawful processing. It said that it is of the opinion that releasing the record would constitute a violation of the above-mentioned principles. The CRU also referenced Article 15(1) of the GDPR and said that data subjects only have the right to access personal data concerning themselves, not personal data concerning other data subjects. It said that it therefore understands that providing the applicant with a copy of the audio recording would be a violation of Article 15(1) of the GDPR as the applicant is not entitled to access the personal data of other data subjects. It noted that the CRU is unable to edit the record concerned to remove/redact the other individual’s voice, as it does not have the relevant software and purchasing same would be impracticable. It said that it firmly believes that releasing the record would harm the rights of a data subject other than the applicant and that it is therefore relying on section 32(1)(a)(ii) of the FOI Act as it is necessary for compliance with the GDPR.
It is important to note at the outset that article 86 of the GDPR provides that personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in the public interest may be disclosed by the authority or body in accordance with Union or Member State law to which the public authority or body is subject in order to reconcile public access to official documents with the right to the protection of personal data pursuant to the Regulation. Section 44 of the Data Protection Act 2018 provides that, for the purposes of Article 86, personal data contained in a record may be disclosed where a request for access to a record is granted under and in accordance with the FOI Act pursuant to an FOI request.
In short, data protection legislation does not prohibit public bodies from processing FOI requests where the records sought contain personal information relating to individuals other than the requester or from granting access to such information. The FOI Act is entirely independent of data protection legislation and FOI requests for access to records must be processed in accordance with the provisions of the FOI Act. Any concerns a public body has about the release of personal information relating to individuals other than the requester can and should be addressed by considering the applicability of section 37 to the records at issue.
In the circumstances, I do not accept that granting access to the record concerned under FOI could reasonably be expected to prejudice or impair the CRU’s compliance with the GDPR. Accordingly, I find that the CRU was not justified in refusing the applicant’s request under section 32(1)(a)(ii) of the FOI Act.
Section 37(1) of the FOI Act provides that, subject to the other provisions of the section, an FOI body shall refuse a request if access to the record concerned would involve the disclosure of personal information. This does not apply where the information involved relates to the requester (section 37(2)(a) refers). However, section 37(7) provides that, notwithstanding section 37(2)(a), an FOI body shall refuse to grant a request if access to the record concerned would, in addition to involving the disclosure of personal information relating to the requester, also involve the disclosure of personal information relating to an individual or individuals other than the requester. This is commonly known as joint personal information.
Section 2 of the FOI Act defines personal information as information about an identifiable individual that either, (a) would, in the ordinary course of events, be known only to the individual or members of the family, or friends, of the individual, or (b) is held by the FOI body on the understanding that it would be treated by that body as confidential. Section 2 goes on to specify 14 categories of information which, without prejudice to the generality of the above definition, constitute personal information. This includes (iii) information relating to the employment or employment history of the individual.
As noted above, the CRU did not claim section 37 to apply to the record. In its submissions, it said it did not consider section 37(1) to apply on the basis that the record does not contain personal information within the meaning of section 2 of the FOI Act, “even though the voice of a person can be regarded as information on what the person sounds like”. However, its position is that the record contains personal information as defined under GDPR.
On foot of my invitation to the applicant to make submissions on the applicability of section 37, I received a number of communications. The applicant said that the only information he holds is the name of the energy supplier’s agent he was dealing with. He said the individual in question contacted him and he queried how this could constitute personal information relating to an individual other than him. In further communications, the applicant said he cannot understand how an audio recording between himself and a member of staff of the energy supplier could disclose personal information. He said the call has already been listened to and, in such circumstances, it would seem that he has been the subject of a disclosure of personal information. He also noted that he had been furnished with “what is alleged to be a full transcript of the conversation”. He said the third party staff member identified themselves on the call.
While I have not listened to the audio recording, I have examined the transcript provided to the applicant and the CRU. I fully accept that the record at issue contains personal information relating to the applicant. However, I must also consider whether the release of the record would involve the disclosure of third party personal information. The record comprises a recording of a conversation between the applicant and a third party. That third party was acting on behalf of his/her employer and discussing matters relevant to his/her role with the energy supplier. The energy supplier is not an FOI body. The disclosure of the record would involve both the disclosure of the fact that the third party is employed by the energy supplier and details of the manner of the performance by the third party of his/her functions. I am satisfied that a recording of an individual engaged in the performance of his/her role in a private setting (i.e. a telephone call between the individual and a customer) comprises information relating to the employment of the individual. I am therefore satisfied that the record contains personal information relating to an individual other than the applicant.
Section 18(1) of the Act provides that if it is practicable to do so, access to an otherwise exempt record shall be granted by preparing a copy, in such form as the body concerned considers appropriate, of the record with the exempt information removed. Section 18(1) does not apply, however, if the copy provided for thereby would be misleading (section 18(2) refers). In circumstances where the CRU was unable to directly access the record at issue and does not have the relevant IT programme/software needed to open the file, I am satisfied that it would not be practicable for the CRU to grant access to a redacted version of the record.
In essence therefore, I am satisfied that the release of the record would involve the disclosure of third party personal information and that section 37(1) applies. I would add, for the avoidance of doubt, the fact that an applicant may be aware of the content of the record or may have been involved in matters detailed therein does not serve to disapply section 37(1). The release of a record under FOI effectively amounts to disclosure to the world at large, as the Act places no restrictions on the type or extent of the subsequent use to which a record may be put. While the applicant may have been provided with a copy of the transcript by the energy supplier, the question before me is whether release of the audio recording, the contents of which the applicant disputes, would involve the release of third party personal information. I am satisfied that it would.
However, that is not the end of the matter as section 37(1) is subject to the provisions of sections (2) and (5). Section 37(2) sets out certain circumstances in which the exemption at section 37(1) does not apply. I am satisfied that none of the circumstances in section 37(2) applies in this case. Section 37(5) provides that a request that would fall to be refused under section 37(1) may still be granted where, on balance, (a) the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or (b) the grant of the information would be to the benefit of the person to whom the information relates. I am satisfied that the relevant individual would not benefit from the release of the information at issue and I find that section 37(5)(b) does not apply.
Before I consider the applicability of section 37(5)(a), there are a number of important points to make. Firstly, section 13(4) provides that, subject to the Act, in deciding whether to grant or refuse an FOI request, any reason that the requester gives for the request and any belief or opinion of the FOI body as to the reasons for the request shall be disregarded. In relation to the question of the public interest, this means that I cannot have regard to the applicant’s motives for seeking access to the records at issue, except in so far as those motives reflect, or overlap with, what might be regarded as true public interest factors in favour of the release of the records, i.e. insofar as the concerns raised in relation to the request may also be matters of general concern to the wider public.
Secondly, it is important to again note that the release of records under the FOI Act must be regarded, in effect, as release to the world at large. With certain limited exceptions provided for under the Act, which are not relevant here, FOI is not about granting access to information to particular individuals only. Furthermore, as noted above, a requester's reasons for making a request are generally not of relevance. Thus, records are not released under FOI for any limited or restricted purpose.
All of this means that, in considering whether a right of access exists to records under section 37(5)(a), any decision to grant access would be on the basis that there is an overriding public interest in the release of the records effectively to the world at large that outweighs the privacy rights of the third party individual concerned.
In considering where the balance of the public interest lies in this case, I have had regard to section 11(3) of the Act which provides that, in performing any functions under the Act, an FOI body must have regard to, among other things, the need to achieve greater openness in the activities of FOI bodies and to promote adherence by them to the principles of transparency in government and public affairs and the need to strengthen the accountability and improve the quality of decision making of FOI bodies. However, in doing so, I have also had regard to the comments of the Supreme Court inThe Minister for Communications, Energy and Natural Resources and the Information Commissioner & Ors [2020] IESC 57 (‘the eNet judgment’). In the relevant part, the Supreme Court found that a general principle of openness does not suffice to direct release of records in the public interest and “there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure”. Although the Court’s comments were made in cases involving confidentiality and commercial sensitivity, I consider them to be relevant to the consideration of public interest tests generally.
While the CRU did not rely on section 37 and therefore did not make submissions in respect of the public interest test at section 37(5), it did state that release of the record would harm the rights of the third party. It said that release would violate certain principles under GDPR. It said that it understands that the agent has the right to the protection of his/her personal data. The CRU also said that upon listening to the audio recording played during the MS Teams meeting with the energy supplier, the investigating officer was of the view that the transcript was an accurate representation of the audio recording.
While the applicant was notified of the relevance of section 37 and invited to make submissions in respect of the exemption and the public interest balancing test, no specific submissions were received in respect of section 37(5). However, he made general submissions to this Office which I consider to be of relevance in respect of the public interest balancing test. The applicant referenced the fact that he disputes the content of the transcript provided. He said that he received an unsolicited phone call from the energy supplier, was requested to provide personal information and that this “rang alarm bells” for him. He said that he “just wants to listen to the call” and queried what the difficulty is with this. He said he is “absolutely flabbergasted and totally frustrated with this whole scenario” and “cannot understand” why he is not allowed to listen to the recording of the conversation. In earlier communications he said that the energy supplier had no right to call him. The applicant also expressed frustration that the CRU listened to the audio recording but that he and his solicitor were refused access.
As the CRU outlined in the background information provided as described above, the outcome of its investigation of the applicant’s complaint depended on what had been said on the call between the energy supplier and the applicant. While the relevant investigating officer was satisfied that the transcript was an accurate representation of the audio recording, the applicant’s recollection of the call is that it was not.
It seems to me that it is in the public interest for complainants to be made aware of the basis on which the CRU makes its decisions on complaints and the evidence it has regard to in doing so and that there is also a public interest in complainants knowing that the CRU has appropriately and effectively exercised its statutory functions in investigating complaints raised. In my view, the release of the audio recording would serve those interests, assuming the applicant is in a position to listen to the recording, as it would provide assurance to the applicant as to the precise nature of the evidence the CRU relied upon in its examination of his complaint.
On the other hand, the FOI Act recognises the public interest in the protection of the right to privacy both in the language of section 37 and the Long Title to the Act (which makes it clear that the release of records under FOI must be consistent with the right to privacy). It is also worth noting that the right to privacy has a constitutional dimension, as one of the unenumerated personal rights under the Constitution. Privacy rights will therefore be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy. Moreover, even where an overriding public interest in granting the request exists, there is a discretionary element to the application of section 37(5)(a).
While the right to privacy is protected by the Constitution, the protection afforded is a spectrum. The courts have found that information relating to a person’s home and family life is likely to attract a high degree of constitutional protection. Conversely, the courts have found that a right to privacy in business affairs only exists at the ‘outer reaches of and furthest remove from the core personal right of privacy’ and that, accordingly, the exigencies of the common good weigh all the more heavily against it (_Caldwell v Mahon+ [2006] IEHC 86, per Hanna J). In my view, the privacy rights impacted by the disclosure of the record relate to business affairs. Moreover, it seems to me that the weight to be afforded to the privacy interest in this case is particularly low, in circumstances where the applicant has already been provided with a transcript of the audio recording. The CRU has said that the transcript is an accurate representation of the call which took place. In effect, the applicant has already been provided with a written representation of the personal information contained within the record, apart from the voice of the third-party agent. In my view, the fact that he has been provided with a transcript of the call means that the impact on the privacy rights of the third party agent are negligible.
In the particular circumstances of this case, where I have found that the impact of releasing the record at issue on the privacy rights of the relevant third party are negligible in light of the fact that a transcript of the audio recording has already been provided, I find that the public interest that the request should be granted outweighs, on balance, the right to privacy of the individual to whom the information relates. Accordingly, I find that section 37(1) does not serve to exempt the record at issue.
Having carried out a review under section 22(2) of the FOI Act, I hereby annul the CRU’s decision. I find that it was not justified in refusing access to the record on the basis of sections 32(1)(a) and 37(1) of the FOI Act and I direct release of the relevant audio recording.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Stephen Rafferty
Senior Investigator