Case 070304. Whether the decision of the IMB to grant a request to which section 29 of the FOI Act applies, involving Periodic Safety Update Reports on the drug nimesulide, is justified

Case Summary

The Senior Investigator found that the applicant failed to meet its burden under section 34(12)(a) of the FOI Act of showing that the decision of the IMB to grant access to the records at issue was not justified. In particular, she rejected the claim that section 26(1) applied because of an understanding or obligation of confidence. She affirmed the decision accordingly.

Date of Decision: 20.10.2009

Review Application under the Freedom of Information Acts 1997 & 2003 (FOI Act) to the Information Commissioner

Background:

This review arises from a decision on a request to which section 29 of the FOI Act applies. The request, dated 25 June 2007, was for records relating to the marketing authorisations granted to medicinal products containing the drug nimesulide and subsequent regulatory activities related to the authorisations. The request was made following the suspension by the IMB, on 15 May 2007, of the marketing authorisations and recall of the relevant medicinal products. The reason given by the IMB for the suspension and recall was that "new safety information ha[d] become available concerning hepatic-related adverse reaction reports associated with nimesulide-containing products".

As a manufacturer of nimesulide-containing products, Helsinn Birex Pharmaceuticals Ltd (Helsinn) was notified of the request in this case in accordance with section 29 of the FOI Act. The letter of notification stated that the IMB was considering whether the relevant records may be required to be disclosed in the public interest. In its reply, Helsinn objected to the release of three categories of records, including all of the Periodic Safety Update Reports (PSURs) concerned, on the basis of sections 26(1)(a), 26(1)(b), 27(1)(b), and 27(1)(c) of the FOI Act.

In its decision, dated 11 October 2007, the IMB did not accept that the PSURs from 1997 to 2007 should be fully exempt and found that access to these records should be granted "subject to the commercially sensitive data being redacted". In a submission to this Office dated 7 November 2007, the IMB explained that the deletions would also include "patient identifiers". The IMB also stated in its submission that it considered that "the data contained in the PSUR was given in confidence and contains commercially sensitive information" but that it considered the data suitable for release in the public interest "subject to the redaction of commercially sensitive and personal information". On 27 November 2007, the IMB provided this Office with a sample of one of the PSURs concerned, dated 24 July 2002 and covering the period of 15 December 2001 to 14 June 2002, with the parts of the record highlighted that it proposed to withhold. The other PSURs concerned were forwarded to this Office on 12 December 2007.

In a submission to this Office dated 19 December 2007, Helsinn continued to object to the release of the PSURs on the basis of sections 26(1)(a), 26(1)(b), 27(1)(b), and 27(1)(c) of the FOI Act. Helsinn also made a claim for exemption for the first time under section 28(1) of the FOI Act. Although Helsinn objected to the release of the PSURs "in any form", the submission stated in relation to the issue of the partial grant of access in accordance with the IMB's decision that "it would be crucial for the provider of the information being redacted to have a direct input into this decision". In light of this statement, Ms. Melanie Campbell, Investigator, considered that it might be possible to reach a settlement of the case and wrote to Helsinn accordingly. In her letter, dated 17 December 2008, Ms. Campbell observed that much the information contained in the sample PSUR (e.g., prescribing information, published case reports of adverse reactions) appeared to be in the public domain. She advised that, as the third party objector in this case, Helsinn should be prepared to identify the particular parts of the PSURs at issue that it considered to be sensitive and of a confidential nature, and to explain specifically why the information should be withheld from release under the FOI Act. As a starting point, however, she asked Helsinn to highlight the parts of the Periodic Safety Update Report (PSUR) dated 24 July 2002 that it considered should be withheld from release and to forward the annotated document to her by 21 January 2009.

Helsinn made no reply to Ms. Campbell's letter dated 17 December 2008. Therefore, on 21 May 2009, Ms. Campbell wrote to Helsinn again to remind the company of its burden of proof in this case and to advise the company of her preliminary view that the decision of the IMB should be affirmed. Helsinn replied to Ms. Campbell's preliminary view letter on 10 June 2009.

With the authority delegated to me by the Commissioner, I have now completed my review in accordance with section 34(2) of the FOI Act. In conducting this review, I have had regard to the submissions made by Helsinn, including its reply dated 10 June 2009 to Ms. Campbell's preliminary observations.

Scope of the Review

My review in this case is concerned solely with the question of whether the IMB's decision to grant access to the PSURs in question, subject to the specified deletions, is justified.

Submissions

.

Findings

Preliminary Matters

It is important to have regard to the extent to which the FOI Act confers on members of the public a statutory right to access records held by public bodies. This is something which the Courts have acknowledged. For example, McKechnie J., in his judgment in Deely v. The Information Commissioner [2001] IEHC 91, had this to say about the FOI Act:

"[The Act's] passing, it is no exaggeration to say, affected in a most profound way, access by members of the public to records held by public bodies and to information regarding certain acts of such bodies which touch or concern such persons. The purpose of its enactment was to create accountability and transparency and this to an extent not heretofore contemplated let alone available to the general public. Many would say that it creates an openness which inspires a belief and trust which can only further public confidence in the Constitutional organs of the State.

[...]

[T]he clear intention is that, subject to certain specific and defined exceptions, the rights so conferred on members of the public and their exercise should be as extensive as possible, this viewed, in the context of and in a way to positively further the aims, principles and policies underpinning this statute, subject and subject only to necessary restrictions.....

It is on any view, a piece of legislation independent in existence, forceful in its aim and liberal in outlook and philosophy."

This view of the extensive nature of the rights conferred by FOI has been endorsed by the Supreme Court, in Barney Sheedy v. The Information Commissioner[2005] IEHC 35 (text of judgment also available at www.oic.ie), where Mr Justice Fennelly commented:

"The passing of the Freedom of Information Act constituted a legislative development of major importance. By it, the Oireachtas took a considered and deliberate step which dramatically alters the administrative assumptions and culture of centuries. It replaces the presumption of secrecy with one of openness. It is designed to open up the workings of government and administration to scrutiny. It is not designed simply to satisfy the appetite of the media for stories. It is for the benefit of every citizen."

Thus, the underlying presumption of the FOI Act is that requests for access will be granted, subject only to necessary restrictions.

As noted above, this review arises from a decision on a request to which section 29 of the FOI Act applies. Section 29 requires formal notification of an affected third party where the head of a public body, or his or her delegate under section 4, is considering the release of confidential information, commercially sensitive information, or personal information in the public interest in accordance with section 26(3), 27(3), or 28(5), respectively. If, following notification of the affected third party, the public body nevertheless decides to grant access to the information at issue, then the affected third party has a right to appeal the decision directly to the Commissioner in accordance with sections 34(1)(f) and (4)(a) of the FOI Act. With limited exceptions not applicable here (sections 14(1)(c) and (d) refer), there is no right to appeal from a decision to grant a request unless the public body considered, at some stage in the decision-making process, that section 26(3), 27(3), or 28(5) applied, even where the request relates to or affects the interests of a third party. In other words, an affected third party has a right to appeal to the Commissioner in accordance with sections 34(1)(f) and (4)(a) only with respect to information that the public body considered at some stage in the decision-making process to be confidential, commercially sensitive, or personal, but nevertheless considered should be released in the public interest. Moreover, in this type of case (requests to which section 29 of the FOI Act applies) the only matter with which this Office may deal is whether the public body has applied the provisions of the relevant exemption(s) correctly.

The case file before me indicates that the IMB initially considered that all three of the exemptions referred to above were relevant to the PSURs concerned. However, in relation to section 28 (personal information), the IMB decided to withhold the "patient identifiers". I also note that the IMB did not directly notify any of the affected individuals under section 29, nor did Helsinn raise any objections under section 28 in its reply to the IMB's section 29 notification to the company. In the circumstances, I take it that the IMB did not decide to release any personal information under section 28(5) of the Act and that this provision is therefore not relevant to my review.

I further note that the IMB's decision was to release the PSURs "subject to the commercially sensitive data being redacted". The IMB's submission to this Office dated 27 November 2007 also confirms that its decision was to withhold access to the information contained in the PSURs that it considered to be commercially sensitive. In other words, the IMB found that section 27(1) applied to certain information that it decided to withhold and it did not decide to release any such information under section 27(3) of the FOI Act. Therefore, section 27(3) of the FOI Act is also not relevant to my review. However, given the general nature of the public interest balancing test under section 26(3) of the FOI Act, as discussed below, I have considered Helsinn's claims regarding commercially sensitive information in addressing the public interest in this case.

I wish to emphasise that, under section 34(12)(a) of the FOI Act, a decision to grant a request to which section 29 applies is presumed to have been justified unless the person concerned shows to the Commissioner's satisfaction that the decision was not justified. This provision has the effect of placing the burden of proof on Helsinn to show that the decision of the IMB to release the PSURs concerned was not justified. It should also be noted that a review by the Commissioner or her delegate under section 34 of the FOI Act is de novo, which means that it is based on the circumstances and the law as they pertain at the time of the decision.

Section 26

The section of the FOI Act dealing with information given in confidence provides as follows:

"26.-(1) Subject to the provisions of this section, a head shall refuse to grant a request under section 7 if-

(a) the record concerned contains information given to a public body in confidence and on the understanding that it would be treated by it as confidential (including such information as aforesaid that a person was required by law, or could have been required by the body pursuant to law, to give to the body) and, in the opinion of the head, its disclosure would be likely to prejudice the giving to the body of further similar information from the same person or other persons and it is of importance to the body that such further similar information as aforesaid should continue to be given to the body, or

(b) disclosure of the information concerned would constitute a breach of a duty of confidence provided for by a provision of an agreement or enactment (other than a provision specified in column (3) of the Third Schedule of an enactment specified in that Schedule) or otherwise by law

...

(3) Subject to section 29, subsection (1) (a) shall not apply in relation to a case in which, in the opinion of the head concerned, the public interest would, on balance, be better served by granting than by refusing to grant the request under section 7 concerned."

The Public Interest: Section 26(3)

Section 26(3), like section 27(3), provides for a general public interest balancing test. As noted above, it states that, subject to section 29, subsection (1)(a) shall not apply in relation to a case in which, in the opinion of the head concerned, the public interest would, on balance, be better served by granting rather than by refusing to grant the request concerned.

Relevant Public Interest Considerations

On its website, the IMB states that its "fundamental role . . . is to protect and enhance public and animal health through regulation of human and veterinary medical products". Among its many functions, the IMB monitors medical products on the market "to ensure their safety and efficacy". Given the importance of the IMB's role to public health and safety, I consider that there is a very strong public interest in openness and accountability in relation to how it carries out its regulatory functions. I further note that a holder of a market authorisation in Ireland is obliged to submit PSURs to the IMB as a condition of the marketing authorisation. I am of the view that there is a strong public interest in making required safety information regarding medical products available to consumers. As stated by the Queensland Information Commissioner in Coulthart and Princess Alexandria Hospital & Health Service District [2001] QICmr 6 (8 October 2001), at paragraph 69, a case involving a request for statistical data regarding medical services: "[I]t is obviously in the public interest that consumers should be be able to make informed choices about services or products they might wish to purchase."

The Commissioner has also recognised that there is a public interest in the proper preservation of confidences and in protecting the commercially sensitive information of a private company. In this case, Helsinn argues that the PSURs were explicitly provided to the IMB on the "basis of strict confidentiality" and on "the clear understanding that they would remain confidential". Helsinn refers to the IMB's Code of Conduct in support of its claim of confidentiality, because it requires all members of staff to sign a confidentiality agreement as a condition of their appointment. Helsinn emphasises that the Code of Conduct provides that, "members of the Board, its staff, committees and sub-committees, consultants, advisers or experts, are not permitted to disclose any information obtained while performing or obtained as a result of performing any activities on behalf of the IMB". In its reply to Ms. Campbell's preliminary view letter, Helsinn also refers to Volume 9A of "The Rules Governing Medicinal Products in the European Union - Guidelines on Pharmacovigilance for Medicinal Products for Human Use" [the EU Rules]. According to Helsinn, the EU Rules describe a PSUR as "intended to provide an update of the worldwide safety experience of a medicinal product to Competent Authorities only at defined time points post-authorisation". Helsinn also points out that Part II, Chapter 1.3, section 10 of the EU Rules, entitled "Confidentiality and Security", states: "At each stage of storage and processing of pharmacovigilance data, measures should be taken to ensure data security and confidentiality. This involves strict control on access to documents and to databases to authorised personnel sharing the medical and administrative confidentiality of the data."

In addition, Helsinn describes a PSUR as "an extremely complex and commercially sensitive document, containing information from a number of different sources worldwide." Helsinn considers that "this complex information could be misinterpreted and misused by persons not fully trained in the evaluation of such a document". According to Helsinn, only partial, incomplete and non-homogeneous information is available from other databases, such as the WHO UMC (the World Health Organization Uppsala Monitoring Centre); such information is thus "substantially different from a PSUR" and "is further evidence of the confidential and commercially sensitive nature of the information contained in the PSURs". Helsinn asserts that the release of its PSURs through FOI "would constitute the release of our commercially sensitive information into the public arena thereby giving an inappropriate and unfair advantage to our competitors".

Analysis

I will first address Helsinn's claims regarding the EU Rules. According to the IMB's website, the IMB has adopted the guidance on the format, content and periodicity for submission of PSURs as described in Part I - Chapter 6 of the EU Rules. Helsinn appears to have misquoted the description found in Part 1, Chapter 6 the EU Rules of a PSUR, which states: "A Periodic Safety Update Report (PSUR) is intended to provide an update of the worldwide safety experience of a medicinal product to Competent Authorities at defined time points post-authorisation." The term "only" does not appear in this context. Moreover, Part I, Chapter 6 does not include any confidentiality provisions. The provision on "Confidentiality and Security" referred to by Helsinn falls under Part II of the EU Rules and in any event relates to the confidentiality of patient records and other identifiable personal details, as do the other references to confidentiality in the EU Rules. The paragraph preceding the text quoted by Helsinn in its submission states: "Confidentiality of Patients' records including personal identifiers, if provided, should always be maintained. Identifiable personal details of reporting Healthcare Professionals should be kept in confidence, as appropriate and in keeping with national and EU legislation." The potential for disclosure of information relating to medicinal products to the general public is acknowledged elsewhere in the EU Rules (e.g., Part I, Chapter 3, section 10; Part IV, Chapter 2.3).

Having examined the IMB's Code of Conduct, I note that it is apparent that the prohibition on the disclosure of information relates to unauthorised disclosures. It states: "Members of the Board, its committees, subcommittees and working parties, experts and staff are obliged not to disclose any information obtained while performing or obtained as a result of performing any activities on behalf of the IMB. This does not apply to information in the public domain or in the possession of the person prior to undertaking the activities. The disclosure of information to government Ministers, to regulatory authorities in EU Member States, to other agencies with which the IMB has appropriate confidentiality agreements, or to parties with whom there is a legitimate requirement to share information is not prevented." Moreover, the section of the Code of Conduct on "Disclosure of information" starts with a discussion of the IMB's obligations under the FOI Act and notes that individuals "may request access to all records held by the IMB (consistent with the public interest and third-party rights in relation to the data) . . . . Staff will comply with the requirements of the [FOI] Acts."

The Code of Conduct also refers to the IMB's "Guide to Information held by the IMB" [the Guide]. The Guide, in turn, states that the IMB "makes information routinely available to the public in relation to its functions, activities and schemes". Significantly, one category of information found among the Guide's lengthy list of information made available to the public without the use of the FOI Act is "Anonymised adverse reaction report (ADR) data", which seems to be the type of information that is subject to disclosure in the redacted versions of the PSURs. I therefore do not accept Helsinn's claim that there was any understanding of "strict confidentiality" in relation to the redacted versions of the PSURs at issue in this case. I further note that, while the IMB stated in its submission dated 7 November 2007 that it considered that the "data contained in the PSUR was given in confidence", I find nothing to suggest that it considered any such data, apart from the details identified as commercially sensitive or personal information in the sample PSUR, to be of a particularly confidential nature.

In its submission to this Office dated 19 December 2007, Helsinn acknowledges that the IMB releases anonymised ADR "line listings" to requesters, but it points out that the anonymised line listings in its PSURs are "often more detailed because they include both the reporter's and Helsinn's case causality assessments", which Helsinn considers to be confidential. However, as Ms. Campbell explained to Helsinn in her preliminary view letter dated 21 May 2009, this Office has previously been advised in the context of another case involving a PSUR that, internationally, it is an industry practice for pharmaceutical companies to make the type of information contained in similar such reports available to the public on a proactive basis. I also note that the information contained in the PSURs generally appears to be of a type that is available from other sources, including on-line databases and published medical journals. For instance, although nimesulide was never marketed in the United States, the website of the US Federal Drug Agency (FDA) states that the "Adverse Event Reporting System (AERS) files available on-line contain "raw data extracted from the AERS database" and that "individual case reports from the AERS database can also be obtained by sending a Freedom of Information (FOI) request to FDA".

I further note that, in correspondence with the IMB, copies of which were included with Helsinn's submission dated 19 December 2007, Helsinn acknowledged that the results of a 9,000 patient study referred in the sample PSUR were published and also accepted that the release of a 41-paged summary of the Clinical Study Report relating to the 9,000 patient study "may be in the public interest". The last page of the summary, which was included with the correspondence, appears to contain the type of assessment, the release of which Helsinn objects to in relation to the PSURs. It seems to me, in the circumstances, that Helsinn does not object so much to the release of the type of information that is contained in the PSURs as opposed to the comprehensive and detailed manner in which it is presented in the PSURs, which may include assessments which are both favourable and unfavourable with respect to the safety of nimesulide.

In its submission dated 10 June 2009, Helsinn states that if the PSURs "do not differ from information already in the public sphere, then the [PSURs] should not be the subject of an FOI request (per Section 46(2) of the FOI Act)". Section 46(2) provides that the FOI Act does not apply to "a record" that is publicly available. For the sake of clarity, I note that I accept that PSURs are not generally made available to the public on either a national or EU level outside of the FOI process. I also accept that they provide safety information that may not be available in as comprehensive and detailed a manner from any other source. However, in my view, it is also beyond reasonable dispute that safety information regarding nimesulide, including ADR reports and commentary, is available through other sources, including the IMB, the WHO, other regulatory authorities, and published reports (some of which are sponsored by Helsinn).

Nimesulide-containing products were recalled by the IMB because of safety concerns arising from adverse reaction reports. This recall followed a review of the safety of the drug by the IMB in 1999, a formal referral to the European Medicines Agency (EMEA) in 2002 for re-assessment of the overall benefit/risk profile of the drug, and the suspension in 2002 of marketing authorisations for nimesulide in Finland and Spain. In the circumstances, I consider that relevant information about the IMB's regulatory role during the period in which nimesulide was authorised for marketing in Ireland should be subjected to maximum scrutiny. Helsinn asserts that the information in the PSURs could be "misinterpreted and misused", but I disagree. It seems to me that selective and controlled disclosure of relevant safety information is far more misleading to the public than the release of the comprehensive and detailed information available in the PSURs. I note, for instance, that in the Queensland case of Coulthart and Princess Alexandria Hospital & Health Service District, referenced above, it was not disputed that the release of comprehensive, "risk-adjusted" medical data would be in the public interest. In any event, as a general matter, the Commissioner does not accept that the possibility of information being misunderstood is a good reason to refuse access to information under the FOI Act.

I stress that the IMB does not propose to release the PSURs in full. According to the IMB, any commercially sensitive and personal information will be redacted from the records. The sample PSUR indicates that the information thus subject to redaction consists of the details of market exposure (i.e. the sale data found in section 5 of the reports), the country of origin of the individual cases mentioned in the reports, and the names and signatures of the Helsinn staff members who prepared and approved the reports. Although Helsinn nevertheless makes conclusory statements regarding the commercial sensitivity of the information in the PSURs, it has not specifically explained how the release of any such information could harm its competitive interests, particularly in light of the recall of nimesulide-containing products and the information about the drug that is available through other sources. Moreover, despite being offered the opportunity to do so, Helsinn has declined to highlight the particular parts the sample PSUR that it considers to be sensitive. I find that Helsinn has failed to meet its burden under section 34(12)(a) of the FOI Act of showing that the decision of the IMB to grant access to the PSURs at issue in the public interest was not justified.

I would also like to stress that my conclusion regarding the PSURs at issue is based on the particular circumstances of this case. There is no class-based rule governing the treatment of PSURs in the FOI context, and any future request for access to a PSUR must be dealt with on its merits in light of the arguments and evidence submitted by the company concerned.

Duty of Confidence?

Helsinn has also continued to object to the release of the PSURs on the basis of section 26(1)(b) of the FOI Act. Section 26(1)(b) is a mandatory exemption that applies where "disclosure of the information concerned would constitute a breach of a duty of confidence provided for by a provision of an agreement or enactment (other than a provision specified in column(3) of the Third Schedule of an enactment specified in that Schedule) or otherwise by law". Helsinn argues that a duty of confidence is owed to it by the IMB as a matter of contract law as well as in equity.

As this review arises from a decision on a request to which section 29 of the FOI Act applies, it is unclear whether this Office has the jurisdiction to consider Helsinn's arguments with respect to section 26(1)(b). A request only falls within the ambit of section 29 if it is one "to which section 26(3) or 27(3) applies or to which section 28(5)applies and which, apart from this section, would fall to be granted" [emphasis added]. In other words, exemptions which are not subject to 26(3), 27(3), or 28(5) are generally not relevant in section 29 cases. However, in previous decisions, e.g., Case Number 98049 (Henry Ford & Sons Ltd, Nissan Ireland and Motor Distributors Ltd and the Office of Public Works (1999), this Office has acknowledged the overlap between the requirements of sections 26(1)(a) and (b). Moreover, although not stated in the FOI Act, the Commissioner takes the view that public interest considerations may be taken into account in determining whether disclosure of information under FOI would constitute a breach of a duty of confidence. Therefore, it seems to me that the question of a duty of confidence naturally arises and is appropriately addressed in any case in which section 26(3) is considered applicable by the public body.

Nevertheless, it must also acknowledged that the FOI decision-making records of public bodies do not always reflect an awareness of the overlap between the requirements of sections 26(1)(a) and (b). The overlap stems from the technical, legal meaning of the term "confidence" which has been adopted by the Commissioner for the purposes of both exemptions. In this case, however, neither the decision-making records nor the submissions of the IMB explain the basis for its finding under section 26(1)(a) that the "data contained in the PSUR was given in confidence". Moreover, I consider that it would be inappropriate for me to construe the IMB's finding in a manner contrary to the presumption of openness under FOI unless sufficient evidence exists to show that the IMB's decision to grant access to the PSURs, subject to the specified deletions, was not justified.

I find no evidence to support Helsinn's claims that a contractual obligation of confidence exists in this case. The PSURs were not given to the IMB by Helsinn on a voluntary or contractual basis but rather as a condition of its marketing authorisations. I have addressed Helsinn's claims regarding the EU Rules and the IMB's Code of Conduct above in relation to section 26(3). I emphasise that the EU Rules actually acknowledge the potential for disclosure of information relating to medicinal products to the general public (e.g., Part I, Chapter 3, section 10; Part IV, Chapter 2.3) and that the Code of Conduct refers to the IMB's obligations under the FOI Act. I also emphasise that it is the practice of the IMB to make anonymised ADR information available to the public without use of the FOI Act. I therefore do not accept that a duty of confidence is provided for in this case by a provision of an agreement or enactment.

The correct tests to apply in deciding whether there is a breach of an equitable duty of confidence are set out in the case of Coco v. A. N. Clark (Engineers) Limited F.S. R. 415 (which is accepted as reflecting the Irish law on the subject - see, e.g., House of Spring Gardens Limited v. Point Blank Limited [1984] I.R 611). The tests require that:

1. the information has the necessary quality of confidence about it;
2. the information was imparted in circumstances imposing an obligation of confidence;
3. there is an unauthorised use of that information to the detriment of the party communicating it.

The Commissioner interprets the term "confidence" by reference to the following definition: "A confidence is formed whenever one party ('the confider') imparts to another ('the confidant') private or secret matters on the express or implied understanding that the communication is for a restricted purpose." ("B" v. Brisbane North Regional Health Authority, (1994) 1 QAR 279, at paragraph 45, quoting from F. Gurry "Breach of Confidence" in P. Finn (Ed.) Essays in Equity; Law Book Company, 1985, p.111.) Based on this definition, the Commissioner considers that, first, information given in confidence is concerned with private or secret matters rather than information which is trite or which is already in the public domain, i.e. that it is necessary to establish that the information has the necessary quality of confidence. Second, the communication must be for a restricted or limited purpose. Third, there must be an understanding that the information is being communicated for a restricted purpose. For the sake of clarity, however, I wish to emphasise that there is nothing in the case file to suggest that the IMB adopted this technical, legal meaning of the term "confidence" in finding that the "data contained in the PSUR was given in confidence".

In the circumstances, I am not satisfied that the PSURs concerned (i.e. as redacted in the manner proposed by the IMB) have the necessary quality of confidence for the purposes of section 26(1)(b). I also find no basis for concluding that the PSURs concerned were given to the IMB in circumstances imposing an obligation of confidence. I therefore do not consider that the release of the PSURs concerned through FOI would constitute an unauthorised use of the information therein. Section 26(1)(b) does not apply.

I also wish to emphasise again that the burden of proof is on Helsinn to show that the decision of the IMB to release the PSURs concerned was not justified. It seems to me that meeting this burden of proof requires Helsinn, at a minimum, to specifically identify the confidential information that it seeks to protect. As the Queensland Information Commissioner observed at paragraph 60 of the Brisbane decision: "It is necessary to specifically identify the information in issue in order to establish that it is secret, rather than generally available, information." As I have noted above, the PSURs concerned contain information that is in the public domain or available through other sources, yet Helsinn declined the opportunity to specifically identify the parts that it considers should be withheld from release.

Helsinn seems instead to rely on the fact that the cover page of each PSUR is marked as "CONFIDENTIAL". However, it is well settled that such labelling is not sufficient, in the absence of other evidence establishing the necessary quality of confidence, to impose an obligation of confidence with respect to the records concerned. "[T]he confider's conduct cannot unilaterally and conclusively impose an obligation of confidence." "B" v. Brisbane North Regional Health Authority, at paragraph 91. Moreover, in light of the IMB's practice of making anonymised ADR information available to the public, it seems to me that there was no understanding that any such safety information was given to the IMB for a restricted or limited purpose.

In the circumstances, I am not satisfied that the PSURs concerned (i.e. as redacted in thge manner proposed by the IMB) have the necessary quality of confidence for the purposes of section 26(1)(b). I also find no basis for concluding that the PSURs concerned were given to the IMB in circumstances imposing an obligation of confidence. I therefore do not consider that the release of the PSURs concerned through FOI would constitute an unauthorised use of the information therein, Section 26(1)(b) does not apply.

Decision

Having carried out a review under section 34(2) of the FOI Act, I hereby affirm the decision of the IMB in this case.

Right of Appeal

A party to a review, or any other person affected by a decision of the Information Commissioner following a review, may appeal to the High Court on a point of law arising from the decision. Such a review must be initiated not later than eight weeks from the date of this letter.

Elizabeth Dolan

Senior Investigator

20 October 2009