Whether the HSE was justified in deciding to refuse access to records containing the personal information of a deceased person under sections 26(1), 28(1) and 28(6)(b) of the FOI Act

Review Application to the Information Commissioner under the Freedom of Information Acts 1997 & 2003 (FOI Act)

Background

In an FOI request made on 24 May 2010, the applicant, through her solicitors, requested copies of all medical records held by the HSE relating to her deceased husband, [ name].

In a decision dated 15 June 2010, the HSE provided a schedule of records held and refused access in full on the basis that the exemptions at section 26(1) and section 28(1) of the FOI Act applied to the records. The decision referred to the request having been considered under regulations made by the Minister for Finance in accordance with section 28(6) of the FOI Act providing for the release of records of deceased persons to certain classes of requester. On 8 July 2010, the applicant's solicitors requested an internal review of the HSE decision.

On 27 July 2010, the HSE issued a decision following internal review. The decision affirmed the original refusal of the request. Particular reference was made to the public interest considerations in the regulations and the Internal Reviewer concluded that the public interest would be better served by refusing the request.

The application for review was received from the applicant's solicitors on 5 November 2010 and was accepted for review on 25 November 2010.

In conducting this review I have had regard to the following:

• the submissions of the applicant's solicitors,
• the submissions of the HSE,
• the records held by the HSE falling within the scope of the FOI request and
• the provisions of the FOI Act.

Scope of the Review

The records are contained in two volumes of files held by [name/location] Health Services - Volume 1 (pages 1 to 7) and Volume 2 (pages 1 to 12). In the course of the review, in light of the applicant's status as the "personal representative" of the late [ name], the HSE agreed to grant access to certain records from Volume 2, i.e. pages 4 (with redaction of personal information of third parties), 5, 6, 7 and 8.

The records remaining within the scope of the review therefore are Volume 1 (pages 1 to 7) and Volume 2 (pages 1, 2, 3, 4 (as redacted), 9, 10, 11 and 12).

It should be noted that section 34(12)(b) of the FOI Act provides that a decision to refuse to grant a request shall be presumed not to have been justified unless the head of the public body shows to the Commissioner's satisfaction that its decision was justified.

Analysis and Findings

Section 28 - Personal Information
It is not in dispute that all of the information contained in the records is the personal information of individuals other than the requester. Section 28(1) provides that access to a record shall be refused if access would involve the disclosure of personal information (including personal information relating to a deceased individual). The effect of section 28(1) is that a record disclosing personal information of a third party cannot be released to another person unless one of the other relevant provisions of section 28 applies - in this case section 28(2), 28(5) or 28(6). Given that section 28(6) specifically addresses circumstances in which the individual to whom the record concerned relates is dead, I will first deal with the personal information of individuals other than the late [ name ] as it appears in (relatively few) parts of the records.

Section 28(2)
Section 28(2) provides that section 28(1) does not apply in certain circumstances. Having examined the records in question, I am satisfied that subsections (a) to (e) of section 28(2) are not relevant because the information contained in the records does not relate to the applicant; there is no evidence that any of the individuals referred to consented to the release of the records to the applicant; the information is not of a kind that is available to the general public; neither does it belong to a class of information that might be made publicly available. It has not been argued either that disclosure of the information is necessary to avoid a serious and imminent danger to the life or health of an individual.

Section 28(5)
Section 28(5) provides that a record containing the personal information of a third party may be released in certain limited circumstances. The exemption could be set aside if (a) on balance, the public interest that the request should be granted outweighs the public interest that the right to privacy of the individual to whom the information relates should be upheld, or (b) the grant of the request would benefit the individual.

I do not see how the release of the records at issue to the applicant would benefit the third parties mentioned in the records. Accordingly, I find that section 28(5)(b) of the FOI Act does not apply.

Turning to Section 28(5)(a), I am not satisfied that there exists any public interest in granting the request insofar as the information relates to individuals other than the deceased. Any possible public interests in favour of release would be outweighed by the public interest in upholding the privacy of those individuals. I find therefore, that section 28(5)(a) does not apply and that all references to identifiable individuals other than the deceased are exempt under section 28(1) and should not be released. In the interests of clarity, I should say here that the names of staff of the public body as they appear in the records do not constitute personal information.

Section 28(6) and the Regulations concerning deceased persons
Section 28(6)(b) of the FOI Act provides for an exception to the mandatory refusal of access in section 28(1) and provides that the Minister for Finance ("the Minister") may make regulations for the grant of an FOI request in certain circumstances including where "the individual to whom the record concerned relates is dead and the requester concerned is a member of a class specified in the regulations." Regulations for this purpose were made by the Minister on 23 September 2009 - FOI Act, 1997 (Section 28(6)) Regulations, 2009 (S.I. No. 387 of 2009). Article 4(1)(b) of the regulations provides, subject to the other provisions of the FOI Act, (emphasis added) for the granting of a request for access to records of an individual who is dead to the following classes of requester:

"(i) a personal representative of the individual acting in due course of administration of his or her estate or any person acting with the consent of a personal representative so acting,

(ii) a person on whom a function is conferred by law in relation to the individual or his or her estate acting in the course of the performance of the function, and

(iii) the spouse or the next of kin of the individual where in the opinion of the head, having regard to all the circumstances and to any relevant guidelines published by the Minister, the public interest, including the public interest in the confidentiality of
personal information, would on balance be better served by granting than by refusing the request."

Article 4(b)(i)
It is first necessary to address whether the applicant falls within one of the specified classes which entitles her to have access to the records of the deceased. Given that it is the applicant's case that she is the personal representative of the deceased and is acting in the administration of his estate, article 4(1)(b)(i) (category 1 above) would appear to be the relevant class. I note that the public interest test does not apply to this class - it is confined to persons specified in article 4(1)(b)(iii). Furthermore, while I note that the Guidance Notes published by the Minister purport to offer guidance as to the types of requester covered by category 1 and the steps to be taken by a decision maker when considering such requests, it is clear to me that the Guidance Notes published by the Minister have no standing in relation to article 4(1)(b)(i); they fall to be considered only when dealing with the class of requester specified in article 4(1)(b)(iii).

Does the applicant come within the specified class of requester in article 4(1)(b)(i)?
This Office has been provided with a copy of the Grant of Representation issued by the District Probate Registry which, inter alia, states that letters of administration of the estate of the deceased who died intestate were granted to the applicant on 6 January 2009. The document describes the applicant as the "guardian lawfully appointed" of the couple's three children and the grant is limited for their use and benefit until they reach 18 years or until one of them would reach 18 and apply for and obtain administration of the estate of their deceased father. Having regard to the ages of the minor children as set out in the Probate document which suggests that at least one of them would already have reached majority, my Office asked the applicant's solicitors to confirm whether any of the children had, to date, obtained administration of their late father's estate and whether the estate remains unadministered at this time. As recently as January 2013, the solicitors confirmed to my Office that none of the children have obtained administration of their late father's estate and that the estate remains unadministered.

Solicitors for the applicant say that her requirement to have access to the records, as personal representative of the deceased, arises from the necessity to resolve an issue relating to a mortgage protection policy on a property which is part of the estate of the deceased.

The HSE considered the public interest in dealing with this request and the applicant's solicitors drew attention to the public interest in the granting of access to the applicant for the reason that refusal of access would, in effect, deny their client a right of access to the courts to have the issue of the mortgage protection policy resolved. However, the only test for qualification as a member of a class specified under article 4(1)(b)(i) is that the requester be the personal representative of the individual acting in due course of administration of his or her estate or any person acting with the consent of a personal representative so acting. I consider that the existence of the Probate document, including the onus on the applicant arising from the grant of Administration to administer the estate for the use and benefit of the children, should be taken as fulfilling the criteria for this specified class. There is also confirmation by the applicant's solicitors of their client's responsibilities in relation to mortgage protection cover in respect of part of the deceased's estate.

In all the circumstances, I consider that it is reasonable to hold that the applicant is the personal representative of the deceased acting in due course of administration of his estate and I find that Article 4(1)( b)(i) applies in this case.

The provision at Article 4(1) of the regulations whereby any consideration of granting access to a request for access to personal information (including personal information relating to a deceased individual) must be subject, in the first instance, to the other provisions of the FOI Act (i.e. other than section 28) means that I must also consider the exemption at section 26 relating to information obtained in confidence which was cited by the HSE in support of its refusal

Section 26 (Information obtained in confidence)
Section 26(1)(a) as relied upon by the HSE provides for mandatory refusal of access to records in the following circumstances:

"where the records containing information given to any public body in confidence and on the understanding that it would be treated by it as confidential and, in the opinion of the head, its disclosure would be likely to prejudice the giving to the body of further similar information from the same or other persons and it is important to the body that such further information should continue to be given to the body,..."

Section 26(1) (b) provides

" or

(b) disclosure of the information concerned would constitute a breach of a duty of confidence provided for by a provision of an agreement or enactment (other than a provision specified in column (3) of the Third Schedule of an enactment specified in that Schedule) or otherwise by law."

Section 26(2) of the FOI Act provides that section 26(1) is not applicable to a record which is prepared by

".... a head or any other person (being a director, or member of the staff of, a public body or a person who is providing a service for a public body under a contract for services) in the course of the performance his or her functions unless disclosure of the information concerned would constitute a breach of a duty of confidence that is provided for by an agreement or statute or otherwise by law and is owed to a person other than a public body or head or a director, or member of the staff of, a public body or a person who is providing or provided a service for a public body under a contract for services."

Section 26(2) serves to disapply the section 26(1) exemption where the records have been prepared by staff in public bodies in the course of the performance of their functions unless disclosure of the information would constitute a breach of a duty of confidence owed to a person other than a staff member or contractor. In this case, the records at issue were prepared by staff members of the HSE in the performance of their functions. They are clinical records relating to the late [ name ] which were prepared from information provided by him. The question therefore is whether release of the records to his personal representative in accordance with Article 4(1)(b)(i) of the section 28(6) Regulations detailed above would constitute a breach of a duty of confidence owed by the HSE to the deceased.

In submissions to my Office, the HSE says that:

• the patient's information was created in a professional relationship between health professionals and the late [ name ];
• this relationship was a confidential relationship and an obligation of confidence exists;
• the service provided must retain the confidence of the patients that it cares for and it is considered that releasing such medical records after the death of a patient would have potential to damage relationships;
• the granting of access would lower the level of trust that patients and prospective patients would have in the service and reduce the quality of the service;
• as FOI allows for any use of released information the release could have the potential to cause damage to the good name of the deceased.

In this instance, any duty of confidence would be based, not on any specific agreement or enactment, but on equity. For a breach of duty of confidence based on the principles of equity to arise, Megarry J., in the case of Coco v. A. N. Clark (Engineering) Limited [1968] FSR 415 states that three essential elements must be established:-
"[T]hree elements are normally required if, apart from contract, a case of breach of confidence is to succeed. First, the information itself ... must 'have the necessary quality of confidence about it'. Secondly, that information must have been imparted in circumstances importing an obligation of confidence. Thirdly, there must be an unauthorised use of that information to the detriment of the party communicating it." (pp. 419 to 420). (Approved of by Costello J. in House of Spring Gardens Limited v. Point Blank Ltd. [1984] IR 611).

I accept that the records meet the first test in that they contain confidential information about the health and treatment of the deceased. The second element requires that there be an understanding that the information would be treated as confidential. I accept that this was so in the context of the consultations between the deceased and the health services. The third element in the test for a breach of duty of confidence is that there must be an unauthorised use of the information to the detriment of the person who communicated it to the HSE i.e. the late [ name ] .

Section 28(6)(b) provides for the release of the personal information of deceased persons in certain circumstances; in effect, it provides for what, on the face of it, is a limited breach of privacy and of confidentiality. Section 28(6)(b) and the Regulations provide for a process under which the personal and confidential information of a deceased person will be released to certain specified classes of person and to such classes only. I take the view that to invoke section 26, in relation to personal information which is otherwise releasable by virtue of section 28(6)(b), is at odds with the intent of the FOI Act. Therefore, I must consider whether release of the records under FOI would be an unauthorised use of the information at issue. Given the express provision in article 4(1)(b)(i) of the Regulations for the granting of access to records of a deceased individual to the personal representative of that individual, I consider it untenable to find that such disclosure would be unauthorised. As regards the possibility of detriment to the deceased, I realise that this is not a settled area of law. Nonetheless, I am not prepared to accept in the circumstances of this case that an authorised disclosure to a specified individual (the personal representative of the deceased) in accordance with a statutory provision could be to the detriment of the deceased.

It seems to me that if it was the case that all clinical records were to be exempt from disclosure on the basis that their release would constitute a breach of confidence, the provisions of article 4 and of section 28(6) would be made redundant. Accordingly, I find that release of the records would not give rise to a breach of a duty of confidence and that section 26(1)(a) cannot therefore apply given the provisions of section 26(2). I note that the HSE did not rely on section 26(1)(b) which provides for a mandatory refusal of a request where disclosure of the information would constitute a breach of an equitable duty of confidence. Given that, having regard to section 26(2) as discussed above, the requirement as regards breach of a duty of confidence is common to section 26(1)(b), I consider that the same finding would have to be made in respect of that provision.

Since it is my finding that section 26(1) is disapplied by the provisions of section 26(2), it is not necessary for me to apply the public interest balancing test as provided in section 26(3. Nonetheless, I note that in the Supreme Court case The Governors and Guardians Rotunda Hospital v. Information Commissioner [2011] IESC 26 (the Rotunda case), Macken J. noted that any public interest being considered under section 26(3) would have to be a true public interest recognised by means of a well-known and established policy, adopted by the Oireachtas, or by law. I consider that there is a public interest in supporting the Oireachtas's intention as provided for and enacted in section 28(6)(b) of the FOI Act that certain classes of requester as defined in the Regulations would have access to the personal information of deceased individuals. Had it been necessary to make a finding on the matter, I would take the position that in this instance the public interest would not be best served by the use of section 26 of the FOI Act to set aside the statutory provision in section 28(6)(b) and the Regulations.

Decision

Having carried out a review under Section 34(2) of the FOI Act, I find that the HSE was not justified in its decision to refuse access to all of the records. I find that those parts of the records which do not disclose the personal information of persons other than the deceased and the applicant should be released in accordance with Article 4(1)(b)(i) of the FOI Act, 1997 (Section 28(6)) Regulations, 2009. I find that those parts of the records which disclose the personal information of persons other than the deceased are exempt under section 28(1). Accordingly, I hereby vary the decision of the HSE and direct that the following records be released:

• Volume 1 (pages 1 to 7) except for identifiable third parties' personal information at pages 2, 3 and 7 and
• Volume 2 (pages 1, 2, 3, 4 (part), 9, 10, 11 and 12) except for identifiable third parties' personal information at pages 1, 2, 4, 9, 10,11 and 12,

Right of Appeal

A party to a review, or any other person affected by a decision of the Information Commissioner following a review, may appeal to the High Court on a point of law arising from the decision. Any such appeal must be initiated not later than eight weeks from the date on which notice of the decision was given to the person bringing the appeal.

Emily O'Reilly
Information Commissioner