British
and Irish Legal Information Institute
Freely Available British and Irish Public Legal Information
[
Home]
[
Databases]
[
World Law]
[
Multidatabase Search]
[
Help]
[
Feedback]
Irish Data Protection Commission Case Studies
You are here:
BAILII >>
Databases >>
Irish Data Protection Commission Case Studies >>
Case study 3: Access Restriction Under Section 5(1)(a) Requires A Prejudice Test [2012] IEDPC 3 (2012)
URL: http://www.bailii.org/ie/cases/IEDPC/2012/[2012]IEDPC3.html
Cite as:
[2012] IEDPC 3
[
New search]
[
Help]
We received a complaint from an individual in relation to an access request he submitted to the Health Information and Quality Authority (the Authority). The complainant had worked as a healthcare assistant in a nursing home and was allegedly involved in an incident there. Details of this alleged incident were reported to the Authority and the individual concerned sought to access any personal information now held by the Authority.
The Authority refused to provide the requester with a copy of the personal data held by it as it was of the opinion that the data was exempt from disclosure under Section 5(1)(a) of the Data Protection Acts 1988 and 2003. This provision states that Section 4 of the Act does not apply to personal data “kept for the purpose of preventing, detecting or investigating offences, apprehending or prosecuting offenders …. in any case in which the application of that section to the data would be likely to prejudice any of the matters aforesaid.” The Authority stated that the data it held in relation to the requester was kept for the purpose of preventing, detecting or investigating offences under Section 79 of the Health Act 2007.
We commenced an investigation by contacting the Authority, we informed it of the nature of the complaint and we requested that it explain how it had come to the view that the requester’s personal data in this case was exempt from disclosure under Section 5(1)(a). It was not immediately clear to us that personal data relating to an alleged incident involving a healthcare assistant came within the ambit of the offences which the Authority had power to investigate and/or prosecute.
The Authority stated that the offences within Section 79(2) of the Health Act 2007 related inter alia to compliance by the registered provider (i.e. the nursing home) with the Health Act 2007 (Care and Welfare of Residents in Designated Centres for Older People) Regulations 2009. It said that the offences thereunder are offences to which the registered provider would be subject to sanction and, for that reason, it was considered that the data fell under the ambit of Section 5(1)(a). Regarding the status of the investigation into alleged offences under the Health Act 2007 we were informed that following its initial review the matter was concluded from a care and welfare perspective. However, the Authority indicated that it intended to keep the file on the matter active until the relevant statute of limitations period has elapsed.
We advised the Authority that a prejudice test applied to the applicability of the exemption under Section 5(1)(a). We also pointed out that the requester's right to access personal data is confined to that data which relates to them, or by which they can be identified. We pointed out that this does not provide a basis for the requester to access from a report or files information which is not their personal data. We informed the Authority that while it was a matter for it to determine in the first instance, it was not immediately obvious to us what prejudice would arise in relation to an investigation by releasing the personal data to the requester in this case.
The relevant issue for the Authority to consider was whether the provision of the requester’s personal data would be likely to prejudice the Authority’s ability to investigate the alleged non-compliance by the care home with the Health Act 2007. Following a further examination, the Authority concluded that no prejudice would arise by the release of the personal data concerned. The requester was subsequently provided with a copy of the personal data concerned.
While the Data Protection Acts restrict the right of access to personal data where that data is kept for the purpose of investigating and/or prosecuting offences, the mere existence of such an investigation or proceedings does not permit the exercising of a blanket exemption by the data controller across all personal data held by it. The personal data of an individual who requests access to such data may only be withheld where the provision of that data would be likely to prejudice the particular investigation or prosecution proceedings. The exemption is not a permanent one.
Where investigations and follow-on proceedings (if any) have been completed it is unlikely that those matters can continue to be prejudiced by the release of the personal data concerned. Once the prejudice no longer exists, the exemption used to withhold the personal data ceases to apply and a copy of the personal data must be made available to the data subject.