The Senior Investigator found that the decision of the HSE was justified in this case.
Whether the decision by the HSE not to grant a request under section 17 of the FOI Act to amend records held on the Travel Claim Application of the SAP payroll system is justified.
On 25 February 2011, the applicant sought, under section 17 of the FOI Act, the amendment of records created on 10 March 2009 held on the Travel Claim Application of the SAP payroll system. The HSE refused the application, a decision which was upheld on internal review on 12 April 2011. On 18 July 2011, the applicant sought a review by this Office of the HSE's decision.
During the course of the review, the HSE agreed to amend the record at issue following consultation on the matter with this Office. On 8 November 2011, Mr. Garvey, Senior Investigator, informed the applicant of his outline view that the HSE, in amending the record at issue by deleting the applicant's computer user name and its replacement with the reference number of the computer, had satisfied its obligations under section 17 of the FOI Act by the removal of misleading personal information about the applicant from the record concerned.
On 21 November 2011, the applicant informed this Office of her view that the amendment made does not fully comply with section 17. Accordingly I have decided to conclude this review by issuing a formal decision.
In conducting this review I have had regard to the provisions of the FOI Acts, the relevant submissions of the HSE and those of the applicant, and to the amendment made by the HSE in the course of the review.
Conducted in accordance with section 34(2) of the FOI Act by Stephen Rafferty, Senior Investigator, who is authorised by the Information Commissioner to conduct this review.
The scope of review is concerned solely with the question of whether the amendment made by the HSE to the record at issue satisfies section 17 of the FOI Act.
.
Section 17 of the FOI Act provides for the amendment of personal information in a record held by a public body where that information is incomplete, incorrect or misleading. The Act is silent on the question of where the onus of proof lies in such cases. The Information Commissioner takes the view that, in the absence of any express statement in the FOI Act, the onus of proof lies on the applicant as the party asserting that the information is incomplete, incorrect or misleading. The Act is also silent as to the standard of proof which should apply in such cases. The Commissioner takes the view that the standard of proof required is that of "the balance of probabilities". It follows that an applicant, seeking to exercise the right of amendment under section 17 must show that the information which is the subject of the application is on the balance of probabilities, incomplete, incorrect or misleading.
This case has its background in an investigation conducted by the HSE in connection with fraudulent claims entered on the HSE's Travel Claim system. A number of the claims in question were entered from the applicant's computer. The HSE accepts that the fraudulent information was not entered by the applicant. Indeed, the HSE has confirmed that at no stage was the applicant the subject of investigation. One of the records relating to the investigation is a spreadsheet which contains a list of claims entered and records the applicant's username as having input a number of the claims based on the computer used. The username comprises the applicants first initial and her surname.
The applicant sought to have her name removed from the record as she did not enter the claims at issue. The HSE refused the request on the ground that the record shows that the entries were made from her computer on the dates in question and that this is factually correct. It argued that the record did not show that the applicant herself created the entries. During the course of the review, and following discussions on the matter with Mr. Garvey of this Office, the HSE agreed to amend the record by replacing the applicant's username with the computer's identification number, known as an MSD number.
The applicant subsequently informed this Office that she does not consider the amendment to sufficiently meet the requirement of section 17 of the FOI Act. She argues that her computer logon screen clearly shows the MSD number followed by her name and that it is an easy matter to ascertain who was using a particular computer at any time. The HSE has confirmed that MSD numbers are allocated to particular PCs and not to individual staff members. When staff members move to another location with a different PC, their usernames are associated with the new MSD number. It is a matter of undisputed fact that the entries at issue were entered from the computers identified by the relevant MSD number at the times and dates shown on the record at issue. In my view, the amended record simply records this fact and it does not contain personal information relating to the applicant. Accordingly, I find that the applicant has not shown, on the balance of probabilities, that the record as amended contains personal information which is incomplete, incorrect or misleading. I find, therefore, that the decision of the HSE to refuse to further amend that record at issue is justified in this case.
Having carried out a review under Section 34(2) of the Freedom of Information Act 1997, as amended, I hereby decide that the HSE has complied with the requirements of section 17 of the Act in this case.
A party to a review, or any other person affected by the decision of the Information Commissioner following a review, may appeal to the High Court on a point of law arising from the decision. Any such appeal must be initiated not later than eight weeks from the date on which notice of the decision was given to the person bringing the appeal.