Whether the HSE was justified in deciding to refuse access to records relating to the applicant and his family.

Review Application to the Information Commissioner under the Freedom of Information Acts 1997 & 2003 (FOI Act)

Background

In his request to the HSE of 9 June 2011, the applicant sought access to "all personal records created on or after 27 June 2010 relating to any or all of myself and my two sons" and he further specified that the request included:

1. all email communications both sent and received, internally and externally,
2. notes of all telephone conversations,
3. minutes of all meetings and list of all attendees,
4. photocopies of all entries in all staff diaries,
5. listing of all persons who have had access to Child Protection Register and the dates of any such access,
6. photocopies of all travel and subsistence claims made by HSE staff while engaged on this case,
7. photocopies of those sections of the Personnel Files for [three HSE staff] setting out their dates of birth, qualifications, training, disciplinary matters and complaints by service users,
8. all notifications and correspondence between the HSE and An Garda Síochána.

In its original decision of 15 August 2011, the HSE granted access to some records and refused access to other records, or part records, on the grounds of Section 26(1)(a) and 28(1) of the FOI Act. In relation to item 5, the HSE gave relevant information to the applicant. The applicant sought an internal review of that decision on 26 August 2011. In its internal review decision dated 26 September 2011 the HSE addressed item 7 in detail refusing the information on the grounds of Section 28(1); it granted access to some additional information previously refused and affirmed the original decision to refuse access to some records/parts of records on the basis of Section 26(1)(a) and 28(1). The applicant then applied for a review to this Office on 22 October 2011.

In conducting this review, I have had regard to the submissions of the applicant, to the submissions of the HSE, to the provisions of the FOI Act, and to the content of the records.

Scope of the Review

The issue in this review is whether the HSE was justified in its decision to refuse access to certain of the records, and part records, which have been identified as covered by the request.

Preliminary Matters

The HSE has told this Office that a full copy of the records released in response to the original request was not retained by it. Therefore, it is not known with absolute certainty what information was released to the applicant prior to this present review. During the course of this review, additional records relevant to the request were identified following intervention by this Office; these included communications with the HSE by the applicant.
It is relevant to note that Section 34(12)(b) of the FOI Act provides that a decision to refuse a request "shall be presumed not to have been justified unless the head concerned shows to the satisfaction of the Commissioner that the decision was justified."

Analysis and Findings

Section 28 - Personal Information

Section 28(1) of the FOI Act provides:

"Subject to the provisions of this section, a head shall refuse to grant a request under section 7 if, in the opinion of the head, access to the record concerned would involve the disclosure of personal information".

However, the provision at Section 28(2)(b) disapplies Section 28(1), and allows for the release of personal information, where the individual to whom the information relates has consented to its release.

The HSE refused access to information on the basis that it contained personal information of persons other than the applicant. During the course of the review, this Office contacted the other family members whose personal information is contained in the records. Consent was received from the applicant's wife and older son (who is now over 18) for the release of their personal information to the applicant.

When the HSE was notified that written consent had been received by this Office from the older son, it said that it had "concerns" about this consent and commented that consent "cannot be valid unless it is informed and voluntary". In this context, the HSE pointed out that the young man in question had not seen the records to whose release he was consenting.

I have considered carefully whether there is substance to the concerns expressed by the HSE regarding this consent. I do not share the view that it was necessary for the older son to have seen the records in question before giving his consent to their release to his father. In any case, I am aware that this Office explained to the young man the type of record at issue as well as the type of information which they contain. The records relate to events between June 2010 and June 2011, which related directly to this young man, and it is reasonable to suppose that he understands what is involved. As the consent was given in writing by an adult, and was given following contact from this Office in which the implications of consent were explained, I see no reason to look behind that consent.

Following the giving of this consent, and having been informed by this Office that it had been given, the HSE contacted the young man to discuss his decision. Following that discussion, the HSE made a further submission to this Office in which it said that the consent had been given in a wider context and that there were particular factors which influenced the young man's decision to give his consent. I accept that the consent decision may have been influenced by various factors but this is not in itself unusual since all decisions involve a weighing up of various factors relevant to the decision to be made. As an adult, the young man was free to make his own decision having weighed up all of the considerations. Furthermore, there is no suggestion from the HSE submission that the young man wished to withdraw his consent.

I find as a matter of fact that the applicant's son, who is now an adult, has given his informed and free consent to the release to his father of records disclosing personal information about him. On this basis I find that the provisions of Section 28(1) are disapplied by the provisions of 28(2)(b) and that the personal information of the applicant's wife and older son should be released to the applicant.

Personal information of minors
A very small portion of certain records refer to the applicant's younger son who is now 16 years of age and a minor. Regulations made under section 28(6) of the Act provide that, subject to certain conditions, a request for records relating to personal information about a minor may be granted where the requester is the minor's parent or guardian. This Office wrote to the applicant's younger son seeking his views on the granting of access of his personal information to his father. The younger son responded in writing that he had no objection to the release of his information to his father, the applicant. The mother of the minor has also given her consent to the release of her younger son's personal information to the father, her husband.

In N.McK and The Information Commissioner [2006] IESC2 (24 January 2006), the Supreme Court held that a parent is entitled to a rebuttable presumption that access to his or her child's medical information is in the best interests of the child. In reaching its judgment, the Supreme Court had regard to the Constitution and observed that the "relationship between parent and child has special status in Ireland". It is clear that, in the circumstances of that case and unless there was evidence to rebut the presumption, a requester is presumed, as a parent, to have the welfare of his child at heart, to be acting in the child's best interests and, accordingly, to be entitled to access records containing medical information in order to exercise his constitutional rights and duties as a parent and guardian regarding the child's medical care.

While the information relating to the younger son is not, strictly speaking, medical information, it is of a kind bearing on the welfare of the son that may reasonably be treated in the same fashion as would medical information. As the applicant in this case is the father of the minor and there is no evidence to rebut the presumption that access to his son's records is in the son's best interests, I find that records containing the personal information of the applicant's younger son are not exempt under section 28(1) of the Act and should be released.

Personal information of HSE staff members
Access to information relating to item 7 was refused on the basis of Section 28(1). The definition of personal information in the FOI Act includes
(iii) information relating to the employment or employment history of the individual
(iv) information relating to the individual in a record falling within section 6(6)(a)

Section 6(6)(a) states:

(a) is a personnel record, that is to say, a record relating wholly or mainly to one or more of the following, that is to say, the competence or ability of the individual in his or her capacity as a member of staff of a public body or his or her employment or employment history or an evaluation of the performance of his or her functions generally or a particular function as such member.

I am satisfied that the information sought by the applicant in item 7 is the personal information of the employees named and that access should not be granted under Section 28(1). Section 28(5)(a) provides for the release of personal information relating to third parties where the public interest that the request should be granted outweighs the public interest that the right to privacy of the individual to whom the information relates should be upheld. I am not satisfied that the public interest served by the disclosure of other parties' personal information would, in this instance, be of sufficient weight as to displace the public interest served by respecting the right to privacy of the individuals concerned.

There are other provisions within Section 28 which , in certain circumstances, allow for the setting aside of section 28(1) and the disclosure of personal information. From the information which is before me, I have no reason to believe that any of these other provisions of Section 28 apply in relation to this information. I find therefore that access to the information sought in item 7 should be refused on the basis of Section 28(1) of the FOI Act.

Section 26(1)(a)
Section 26(1)(a) provides that:

"Subject to the provisions of this section, a head shall refuse to grant a request under section 7 if-

(a) the record concerned contains information given to the public body concerned in confidence and on the understanding that it would be treated by it as confidential (including such information as aforesaid that a person was required by law, or could have been required by the body pursuant to law, to give to the body) and, in the opinion of the head, its disclosure would be likely to prejudice the giving to the body of further similar information from the same person or other persons and it is of importance to the body that such further similar information as aforesaid should continue to be given to the body,".

For section 26(1)(a) to apply, there are four separate requirements to be satisfied:

• that the information was given in confidence, and
• that the information was given on the understanding that it would be treated as confidential, and
• that the disclosure of the information would be likely to prejudice the giving to the body of further similar information from the same person or other persons in the future, and
• that it is of importance to the body that such further similar information should continue to be given to the body.

The approach adopted by this Office is that all four of these tests must be satisfied in order for a record to be considered exempt from release under this section of the FOI Act. The HSE has refused access to a number of records or parts of records on the basis of Section 26(1)(a). These include notifications from the Gardaí to the HSE and other records created by HSE staff (Items 1, 2, 3, and 8). There are circumstances in which the content of communications between the Gardaí and the HSE would be such as to meet the third test for the application of 26(1)(a), and this Office has found this to be the case in the appropriate circumstances. However, it is not the case that Section 26(1)(a) necessarily applies to all records which are communications between the Gardaí and the HSE. I do not accept that the third test is satisfied in respect of the information at issue here. In my view, it is not reasonable to suggest that the Gardaí would not notify the HSE of cases of possible child abuse as a consequence of the disclosure of information in this record.
I find Section 26(1)(a) does not apply to exempt from release any part of those records which are communications from the Gardaí to the HSE (Item 8).

The other records which have been refused by the HSE on the basis of Section 26(1)(a) are records created by HSE staff. Section 26(2) provides that section 26(1) "shall not apply to a record which is prepared by a head or any other person (being a director, or member of the staff of, a public body or a person who is providing a service for a public body under a contract for services) in the course of the performance of his or her functions unless disclosure of the information concerned would constitute a breach of a duty of confidence that is provided for by an agreement or statute or otherwise by law and is owed to a person other than a public body or head or a director, or member of the staff of, a public body or a person who is providing or provided a service for a public body under a contract for services."

The exemption based on a breach of a duty of confidence is that provided for at Section 26(1)(b) and the HSE has not made any case that this exemption applies. For the sake of completeness, however, I have considered whether this exemption applies. Accordingly, the question I must consider is whether disclosure of the information in the records would constitute a breach of a duty of confidence owed to a person other than a public body or head or a director, or member of the staff of, a public body or a person who is providing or provided a service for a public body under a contract for services.

Section 26(2) provides that a duty of confidence may be provided for by an agreement or statute or otherwise by law. The HSE has not identified any agreement or statute which might be of relevance in this case, nor am I aware of any such agreement or statute. I have, therefore, considered whether or not an equitable duty of confidence (that is a "duty of confidence...provided for...by law") is owed by the HSE to any relevant party. The usual test to apply in deciding whether there is a breach of an equitable duty of confidence is set out in the case of CoCo v. A.N. Clark (Engineers) Limited F.S.R. 415. In order for an equitable duty of confidence to exist, three conditions must be met, viz;

• the information contained in the record must have the necessary quality of confidence and
• information must have been imparted in circumstances imposing an obligation of confidence and
• there must be an unauthorised use of that information to the detriment of the party communicating it.

I interpret the term "confidence" by reference to the following definition, which is derived from the law relating to a breach of a duty of confidence: "A confidence is formed whenever one party ('the confider') imparts to another ('the confidant') private or secret matters on the express or implied understanding that the communication is for a restricted purpose."

The information at issue consists of some portions of Garda notifications to the HSE of suspected child abuse and references in other records to communications between the Gardaí and the HSE. The notification forms have already been released to the applicant in redacted form. I find it difficult to accept that this information can be regarded as being concerned with private or secret matters and that it therefore has the necessary quality of confidence, particularly as redacted versions of these notifications have been released. In releasing the redacted versions, the fact that the notification took place is known. On the second requirement, there is no evidence that the Gardai provided the information in circumstances which could be said to impose an obligation of confidence. On the matter of the third requirement, I fail to see how the release by the HSE of the information could reasonably be considered to be an unauthorised use of the information contained in the records or that its release could be considered to be to the detriment of the individuals who provided the information, in this case, the Gardaí. Accordingly, I find that an equitable duty of confidence does not exist in this case and that section 26(1)(b) does not, therefore, apply.

Section 23(1)(aa)
The HSE has further claimed, in submissions to this Office, that Section 23(1)(aa) applies to protect the information in the Garda reports from release and that this applies also to records where information provided by the Gardaí is restated or reported in records created by HSE staff members.

Section 23(1)(aa) provides that a public body may refuse access if access to the records concerned "could, in the opinion of the head, reasonably be expected to... endanger the life or safety of any person."

This exemption is one that is not commonly used. The Information Commissioner has previously considered this exemption in Case Number 090066 (available on this Office's website at www.oic.gov.ie) where she said that it is an exemption which should not be applied without "careful consideration having been given to whether the expectation set out in the subsection is a reasonable one in all of the circumstances". She also said that she considered that "the test to be met in regard to this exemption is such that it should only be invoked in circumstances of the most serious nature. What is required is an assessment of the expected consequences of releasing particular records in terms of endangering life or safety. It is not necessary or indeed possible to establish that such physical harm will occur but that there is reasonable expectation of this." In considering the phrase "could reasonably be expected to" the Information Commissioner has been guided by the analysis carried out by the Queensland Information Commissioner in "Re "B" and Brisbane North Regional Health Authority" (1994) 1 Q.A.R 279 in which he said:

"The words call for the decision- maker ... to discriminate between unreasonable expectations and reasonable expectations, between what is merely possible (e.g. merely speculative /conjectural ''expectations'') and expectations for the occurrence of which real and substantial grounds exist."

Therefore, consideration of this exemption must be concerned only with whether or not the expectation of endangerment to life or safety to persons is reasonable. In order for the exemption to be upheld, it should be possible to clearly link the expectation of serious harm arising to the content and context of the records.

Having considered the submission of the HSE and the content of the records, I am not satisfied that the evidence available to me provides a sufficient basis for the application of this exemption. I find that Section 23(1)(aa) does not apply to protect any of the records from release.

Section 10(1)(a)
In his internal review application to the HSE, and in his application for review to this Office, the applicant identified records which in his view should exist and which, if they did exist, would be relevant to the request.

Section 10(1)(a) of the FOI Act is the relevant section to apply to this aspect of the review. The section provides that access to a record may be refused if "the record concerned does not exist or cannot be found after all reasonable steps to ascertain its whereabouts have been taken". In cases such as this, the role of the Commissioner is to decide whether the decision maker has had regard to all the relevant evidence and to assess the adequacy of the searches conducted by the public body in looking for relevant records. The evidence in "search" cases generally consists of the steps actually taken to search for the records along with miscellaneous other information about the records management practices of the public body insofar as those practices relate to the records in question. On the basis of the information provided, the Commissioner forms a view as to whether the decision maker was justified in coming to the decision that the records sought do not exist or cannot be found. It is not normally the Commissioner's function to search for records.

I should also explain that, in implementing the terms of the FOI Act, the Commissioner is primarily concerned with ensuring public access to extant records in accordance with the provisions of the Act. The Act does not provide for a right of access to records which ought to exist. Therefore, the Commissioner does not have the authority to require a public body to create records where such records do not exist or are not held by it.

During the course of this review, the applicant specified a number of records which in his view should have been identified as relevant to the review and which had neither been released by the HSE nor refused. This Office raised this issue with the HSE and, following further searches, additional records were identified. However, my understanding is that these additional records were not released as, according to the HSE, they contained personal information of other members of the applicant's family. As set out above, there is now no reason not to release such records. The HSE has stated that all relevant records have now been identified. In my view, the HSE has now taken all reasonable steps to identify any records relevant to the request and I am satisfied that Section 10(1)(a) applies to any further records which in the applicant's view should exist. I find accordingly.

Decision

Having carried out a review under Section 34(2) of the FOI Act, I hereby vary the decision of the HSE and decide as follows:
that Section 28(1) applies to the information sought at Item 7 of the request and that this information is exempt from release;
that all of the remaining withheld records, or portions of records, should be released.

For the avoidance of any doubt, this decision is that all of the additional records identified in the course of this review [and dealt with under the heading "Section 10(1)(a)" above] are to be released.

Right of Appeal

A party to a review, or any other person affected by a decision of the Information Commissioner following a review, may appeal to the High Court on a point of law arising from the decision. Any such appeal must be initiated not later than eight weeks from the date on which notice of the decision was given to the person bringing the appeal.

Fintan Butler
Senior Investigator
24 July 2013