Cinneadh
Mr. A and Tallaght University Hospital
Ó Oifig an Choimisinéara Faisnéise
Cásuimhir: OIC-147666-T4N0D6
Foilsithe
Teanga: Níl leagan Gaeilge den mhír seo ar fáil.
Ó Oifig an Choimisinéara Faisnéise
Cásuimhir: OIC-147666-T4N0D6
Foilsithe
Teanga: Níl leagan Gaeilge den mhír seo ar fáil.
Whether the Hospital was justified in refusing access to certain information in records relating to the applicant on the basis of section 37 of the FOI Act
28 November 2024
In a request dated 8 February 2024, the applicant sought access to all personal data held about him by the Hospital. He referenced clinical and non-clinical records and stated that he was seeking “every single piece of information concerning me in any way shape or form mentioned or not I want it all in complete and full”. He specified that he was seeking notes of a named staff member. He confirmed that he was making the request under the FOI Act and article 15 of the General Data Protection Regulation and stated that he wished the requests to run at the same time.
On 20 February 2024, the Hospital wrote to the applicant and informed him that the FOI Act and the Data Protection Act are two different pieces of legislation with different procedural considerations, processes, timeframes and fees. It said that, in line with Central Policy Unit guidelines, a requester should choose one or other piece of legislation for their request to be processed under. The Hospital asked that the applicant revert with his decision. On 23 February 2024, the applicant responded to the Hospital and stated that he was proceeding with the request under the FOI Act. He referenced conversations with staff of this Office in his communication and stated that the timeframe for processing the request had not changed.
On 11 March 2024, the applicant wrote to the Hospital seeking an internal review. He noted that as a decision should have issued in respect of his request on 7 March 2024 the Hospital was deemed to have refused the request. On 15 March 2024, the Hospital issued what I consider to be its internal review decision. It part-granted the applicant’s request, withholding information from certain records on the basis of section 37(7) of the FOI Act. On 21 March 2024, the applicant applied to this Office for a review of the Hospital’s decision.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the submissions made by the parties to the review. I have also examined the records at issue. I have decided to conclude this review by way of a formal, binding decision.
The Hospital identified eight records as coming within the scope of the request (each comprising between 2 and 386 pages). It released seven records in full. It part-granted access to one record on the basis of section 37(7). The part-granted record is described on the schedule provided by the Hospital as “Copy of requested emails”. The Hospital withheld a small amount of information from pages 27 and 37 of the record.
This review is concerned solely with whether the Hospital was justified in refusing access to the withheld information under section 37 of the FOI Act.
Before I address the substantive matters arising, I wish to make a number of preliminary comments. Firstly, some confusion was expressed by the Hospital in respect of the steps to be taken should an applicant make a request for records under both the FOI Act and data protection legislation. It referenced a guidance note issued by the Department of Public Expenditure, NDP Delivery and Reform’s Central Policy Unit which states that “where a body receives a letter seeking the records and relying on both pieces of the legislation they should contact the requester and advise him/her of his/her rights under both pieces of legislation and ask him/her to seek the records under one Act”. The letter issued by the Hospital in this regard stated that the applicant “should choose one or other piece of legislation for their request to be processed under”.
For the avoidance of doubt, the FOI Act is entirely independent of data protection legislation. While it might be best practice to enquire with an applicant as to whether they are willing to choose a single access regime, FOI requests for access to records must be processed in accordance with the provisions of the FOI Act. There is nothing in the FOI Act while precludes a requester from making a parallel request under another regime should they wish to. The applicant’s request was clear and he specifically referenced the FOI Act. I am satisfied that the statutory clock started on the day that the request was received. The Hospital did not issue an original decision within the statutory timeframe. As such, the applicant was entitled to seek an internal review and, upon receipt of the decision dated 15 March 2024, was entitled to seek a review by this Office. I would remind the FOI body of its statutory obligations under the Act and encourage decision-makers to ensure that relevant timeframes are adhered to.
Secondly, it is important to note that although I am obliged to give reasons for my decision, section 25(3) of the FOI Act requires me to take all reasonable precautions in the course of a review to prevent the disclosure of information contained in an exempt record. This means that the extent to which I can describe the contents of the records is limited. It also means that I must limit my description of the Hospital’s submissions and has implications for the extent to which I can give reasons for my decision.
Finally, I note that in his application to this Office and in correspondence copied therein, the applicant made complaints in respect of named staff members of the Hospital. For the avoidance of doubt, this Office has no remit to investigate complaints, to adjudicate on how FOI bodies perform their functions generally, or to act as an alternative dispute resolution mechanism with respect to actions taken by FOI bodies or their staff.
Section 37(1) of the FOI Act provides that, subject to the other provisions of the section, an FOI body shall refuse a request if access to the record would involve the disclosure of personal information (including personal information relating to a deceased individual). This does not apply where the information involved relates to the requester (section 37(2)(a) refers). However, section 37(7) provides that, notwithstanding section 37(2)(a), an FOI body shall refuse to grant a request if access to the record concerned would, in addition to involving the disclosure of personal information relating to the requester, also involve the disclosure of personal information relating to an individual or individuals other than the requester (commonly known as joint personal information).
Section 2 of the FOI Act defines personal information as information about an identifiable individual that, either (a) would, in the ordinary course of events, be known only to the individual or members of the family, or friends, of the individual, or (b) is held by an FOI body on the understanding that it would be treated by that body as confidential. Section 2 goes on to specify 14 categories of information which, without prejudice to the generality of the above definition, constitute personal information, including (i) information relating to the education, medical, psychiatric or psychological history of the individual.
As noted above, the Hospital released the vast majority of records identified as coming within the scope of the request. It withheld limited information from two pages on the basis of section 37 of the FOI Act. The Hospital’s position is that the information withheld pertains to a third party, who was referenced in the emails in question. In its submissions, it said that it determined that the information was third-party personal information and redacted it on that basis.
In his application to this Office, the applicant referenced the Hospital’s failure to supply his medical records on time and its failure to supply all of the requested information. I have addressed the Hospital’s delay in issuing a decision above. In respect of its refusal to provide certain information, the applicant said that he specifically asked for access to certain emails containing his personal data which he said he has a right to access. He did acknowledge that he “did not ask them to see the other person(s) details” but said that he has a right to see the records if they have his personal data in them. He said that he wants everything he asked for. He said that the Hospital was at liberty to block the other person(s) name but that it has no right to only partly grant his request 14 days late.
I must again stress that very limited information is at issue. The Hospital has withheld a full sentence and a partial sentence from two pages of the record. I am limited in the extent to which I can describe the withheld information. However, I am satisfied that the withheld information relates to individuals other than the requester and comprises personal information in accordance with the definition at section 2. The fact that the records may relate to the applicant and his engagements with the Hospital does not serve to disapply the exemption. I am satisfied that the information relates to third parties and that section 37(1) therefore applies.
I note that the information has been refused on the basis of section 37(7). The net effect of section 37(7) as set out above, is that, where a record or part of a record contains personal information relating to the requester, which is closely intertwined with personal information relating to another party or parties, and where it is not feasible to separate the information relating to the requester from that relating to the other party or parties, it can be described as joint personal information and section 37(7) must be considered. Having carefully considered the matter, I take the view that it is not practicable to separate the personal information relating to the applicant from that relating to the relevant third party individual. As such, I consider that such information is joint personal information for the purposes of section 37(7) of the FOI Act.
As section 37(1) of the Act is subject to the other provisions of the section, I must proceed to consider whether any of those other provisions serve to disapply section 37(1) in respect of any or all of the withheld information.
Section 37(2) of the FOI Act sets out certain circumstances in which section 37(1) does not apply. I am satisfied that none of the circumstances arise in this case.
Section 37(5) provides that a request that would fall to be refused under section 37(1) may still be granted where, on balance, (a) the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or (b) the grant of the information would be to the benefit of the person to whom the information relates. I am satisfied that the release of the information at issue would not be to the benefit of the individual concerned and that section 37(5)(b) does not apply.
In relation to paragraph (a), I must consider whether the public interest in granting the request outweighs, on balance, the public interest in protecting the right to privacy of the individual to whom the information relates.
Before I consider the applicability of section 37(5)(a), there are a number of important points to note. First, section 13(4) provides that, subject to the Act, in deciding whether to grant or refuse an FOI request, any reason that the requester gives for the request and any belief or opinion of the FOI body as to the reasons for the request shall be disregarded. In relation to the question of the public interest, this means that I cannot have regard to the applicant's motives for seeking access to the records at issue, except in so far as those motives reflect, or overlap with, what might be regarded as true public interest factors in favour of release of the records, i.e. insofar as the concerns raised in relation to the request may also be matters of general concern to the wider public.
Secondly, it is important to note that the release of records under the FOI Act must be regarded, in effect, as release to the world at large, given that the Act places no constraints on the uses to which a record released under the Act can be put. With certain limited exceptions provided for under the Act, FOI is not about granting access to information to particular individuals only and as noted above, a requester's reasons for making a request are generally not of relevance. Thus, records are not released under FOI for any limited or restricted purpose.
In considering where the balance of the public interest lies in this case, I have had regard to section 11(3) of the Act which provides that in performing any functions under the Act, an FOI body must have regard to, among other things, the need to achieve greater openness in the activities of FOI bodies and to promote adherence by them to the principles of transparency in government and public affairs and the need to strengthen the accountability and improve the quality of decision making of FOI bodies. However, in doing so, I have also had regard to the judgment of the Supreme Court inThe Minister for Communications, Energy and Natural Resources and the Information Commissioner & Ors [2020] IESC 57 (“the Enet case”). In that case, the Supreme Court found that a general principle of openness does not suffice to direct release of records in the public interest and “there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure”. Although the Court’s comments were made in cases involving confidentiality and commercial sensitivity, I consider them to be relevant to the consideration of public interest tests generally.
In its submissions, the Hospital said that it carefully balanced the public interest in favour of transparency and granting the request against the strong public interest in upholding privacy rights, as outlined in section 37(5)(a) of the FOI Act. It said that the FOI Act places significant importance on the protection of third-party personal information, especially in circumstances where the information concerns private individuals and sensitive matters. It referenced the specific information withheld and said that the privacy rights attached to it are substantial. The Hospital said that it ultimately concluded that the public interest in disclosing the information did not outweigh the need to protect the relevant individual’s privacy. It said that there was no evident public interest benefit in releasing the information that would justify breaching privacy in this instance.
In his application to this Office, the applicant referenced his right to examine any emails that contain his data. In correspondence with the Hospital which he provided as part of his application, the applicant said that he does not need consent from anyone to obtain the records, only his own. The applicant has not advanced any specific public interest arguments. He has essentially expressed a private interest for seeking access to the records. However, I note that he is effectively referencing his right to access records relating to himself. It seems to me that this could be understood as reflecting a general public interest in the right of an individual to access records containing their personal information, as well as the related right to have personal information held on them corrected or updated where such information is incomplete, incorrect or misleading.
On the other hand, the FOI Act recognises the public interest in the protection of the right to privacy both in the language of section 37 and the Long Title to the Act (which makes clear that the release of records under FOI must be consistent with the right to privacy). It is also worth noting that the right to privacy has a constitutional dimension, as one of the unenumerated personal rights under the Constitution. Privacy rights, therefore, will be set aside only where the public interest served by granting release (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy. Moreover, even where an overriding public interest in granting the request exists, there is a discretionary element to the application of section 37(5)(a).
I have carefully considered the limited information at issue in this case. Notwithstanding the fact that the partially withheld records relate to the applicant and were identified as coming within the scope of his request, I have accepted that they also contain information relating to a third party. I note that the Hospital has granted access in full to the remaining records identified. It seems to me that it has endeavoured to respect the applicant’s right to access his own personal information. However, section 37 is an explicit acknowledgement that the right of access under FOI must be balanced against the right to personal privacy. Section 37(7) in turn acknowledges that even where access to the record would disclose information relating to the requester, such information will still qualify for exemption if release would also involve the disclosure of personal information relating to another individual. It seems to me that release of the information at issue in this case would provide quite limited additional information in respect of the applicant and his engagement with the FOI body.
On the other hand, the information which has been refused is of an inherently private nature and I must regard its release as being effectively, or at least potentially, to the world at large. Having considered the matter, and bearing in mind the strong public interest in protecting the right to privacy, I do not accept that the public interest in releasing the information outweighs, on balance, the privacy rights of the relevant third party. In particular, I am not satisfied that a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure has been advanced, nor is any such reason evident to me. I find, therefore, that section 37(5)(a) does not apply.
Having carried out a review under section 22(2) of the FOI Act, I hereby affirm the Hospital’s decision on the basis that section 37(1) applies to the information withheld from the records.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Alison Connolly
Investigator