Whether the Department was justified in deciding to refuse access to records of internal audit reports.

Conducted in accordance with section 34(2) of the FOI Act by Elizabeth Dolan, Senior Investigator, Office of the Information Commissioner, authorised by the Information Commissioner ("the Commissioner") to conduct this review.

Background

This review relates to the applicant's original request of 3 April 2012, seeking records relating to six different items. In its original decision of 14 June 2012, the Department refused the request in full. The applicant made an internal review request on 29 June 2012. The Department's internal review decision of 19 July 2012 affirmed the original decision to refuse the request. On 16 August 2012, the applicant submitted an application for review to this Office.

During the course of the review, the applicant accepted this Office's view that the position of the Department on items 2-5 was justified and withdrew these from the review. Following further engagement between this Office, the Department and the applicant, he also withdrew item 6. Therefore, only Item 1 remained to be considered in the review.

Item 1 is a request for "all audit reports produced by the Department's Internal Audit Division since January 1 2010". When asked to provide a copy of the records relevant to the review, the Department provided a schedule of records relevant to Item 1, and informed this Office that it would take a considerable amount of time to examine the records in detail. The schedule listed 110 audit reports. No issue was raised by the Department when dealing with the original or internal review request in relation to the volume of records.

The applicant agreed to further restrict the scope of the review to audit reports produced in the six months prior to his request and as a result eleven audit reports were identified as relevant and the review proceeded on this basis. The eleven reports are as follows:

1 Irish Prison Service Human Resources Sick Leave Audit
2 Audit for Criminal Assets Bureau, An Garda Síochána
3 Topaz Fuel Card Report, Irish Prison Service
4 Irish Prison Service, 2011 Capital Construction Work Audit (Joint Audit with C&AG)
5 Saol Project - Probation Service project
6 Cork Alliance Centre - Probation Service project
7 Review of Management processes for funded projects in the Probation Service
8 Follow up audit on Criminal Legal Aid Scheme
9 PALLS Project Limerick
10 Appropriation Account 2011 Audit Justice
11 Appropriation Account 2011 Audit Irish Prison Service

Ms. Brenda Lynch, Investigator of this Office, informed the Department of her view that the vast majority of the content of the reports is not exempt from release under the FOI Act. The Department further reviewed its position and agreed to release additional material to the applicant. Reports 1, 5, 7 and 8 were released in full. In relation to Reports 6 and 9, the Department maintains that a small amount of information, including personal information, bank account details, a Revenue employer number and the identity of two third party organisations, should be redacted. The applicant, when contacted by this Office, agreed to these details being removed from the scope of the review. As the Department has agreed to release Reports 6 and 9 apart from these details, it is not now necessary for me to deal with these reports in this decision. The Department maintains its position that Reports 2 and 4 should be refused in full and that access to parts of the remaining reports (Reports 3, 10 and 11) should be refused.
In relation to Report 2, the Department's position is that this report was commissioned by the Criminal Assets Bureau (CAB), which is part of An Garda Síochána, and not by the Department. According to the Department, the report was prepared on a laptop provided by CAB for this purpose and CAB made it clear at all times that the report was its report and the final version would be held by CAB. Ms. Lynch asked the Department to provide more information about the arrangements for the preparation of this report and to identify the relevant provisions of the FOI Act on which its refusal of access was based. In late June 2014, the Department informed Ms. Lynch that it did, in fact, hold a copy of the report and forwarded a copy to this Office at that time. When the report was examined by this Office, it was clear that it was produced in July 2012, after the date of the original request (April 2012) and is, therefore, outside the scope of the review.

The applicant indicated that he required a formal decision. In conducting this review, I have had regard to the submissions of the applicant, to the submissions of the Department, to the provisions of the FOI Acts, and to the content of the records at issue.

Scope of the Review

The scope of the review relates to whether the decision of the Department to refuse access to all or parts of Reports 3, 4, 10 and 11 was justified under the FOI Act. Any records or parts of records which were released during the course of the review are no longer in scope.

Preliminary Matters

Handling of the request
It seems that the Department did not attempt to identify and quantify the records relevant to the request until it was asked to do so by this Office. A schedule of records was not prepared or made available to the applicant; the decisions issued did not apply the exemptions cited to specific records. The Department informed this Office of its estimate of the staff time required to deal with the examination of the records relevant to the reduced scope of the review and the impact of this on the relevant business unit. It also claimed that Section 10(1)(c) of the FOI Act should have been invoked in dealing with the original request.

Section 10(1)(c) provides that a public body may refuse a request if it considers that granting the request would, by reason of the number or nature of the records concerned or the nature of the information concerned, require the retrieval and examination of such number of records or an examination of such kind of the records concerned as to cause a substantial and unreasonable interference with or disruption of work of the body. However, section 10(2) provides that a public body shall not refuse to grant a request pursuant to section 10(1)(c) unless it has assisted, or offered to assist, the requester to amend the request so that it no longer falls to be refused under that section. Although there is some evidence to suggest that section 10(2) may have been cited in relation to an earlier request or an earlier version of this request, there is no indication that it was used in relation to the request of 3 April 2012 to which this review relates. Therefore , the Department effectively accepted that the request was not one to which Section 10(1)(c) was relevant notwithstanding the fact that the request, as submitted, appears to cover a very large number of records including reports and correspondence going back to 2010 as well as on-going audits. I draw attention to this in the context of this Office's involvement in reducing the scope of the request to a more manageable scale as outlined above. I also note that although the Department ultimately refused the request, it does not appear to have considered the option of charging a statutory fee for search and retrieval at the initial stage.

Section 34(12)(b) of the FOI Act provides that a decision to refuse a request "shall be presumed not to have been justified unless the head concerned shows to the satisfaction of the Commissioner that the decision was justified."

Section 43(3) of the FOI Act requires the Information Commissioner to take all reasonable precautions in the course of a review to prevent disclosure of information contained in an exempt record. This means that the extent to which I can describe the records is limited.

Analysis and Findings

Record 3 - Topaz Fuel Card Report, Irish Prison Service (IPS)
The Department's position is that the information in Appendix 4 of this report is exempt on the grounds of Section 23(1)(a)(v) of the FOI Act. Section 23(1)(a)(v) of the FOI Act provides that a public body may refuse to grant a request if it considers that access to the record sought could: "reasonably be expected to prejudice or impair the security of a penal institution". Appendix 4 sets out information on the numbers of vehicles assigned to different prisons. The Department's position is that release of this information could allow for the monitoring and targeting of certain vehicles and the consequent compromising of the security of a prison. The Department states that the IPS has been notified by An Garda Síochána of threats to IPS staff, and that release of some of the information may reveal aspects of the approach taken in response to these threats which were considered to be viable. While the Department has not made any comment on the reasonableness of the expectation that the harm might arise, I am prepared to accept that it is reasonable to expect that release of some of the information in Appendix 4 for which the exemption is claimed might give rise to the prejudice or impairment feared and I find that Section 23(1)(a)(v) applies to the information in column 5 and 6 of the table, including the headings.

Section 23(1)(a)(v) is subject to section 23(3) which provides that consideration must be given to the possibility that the public interest would be better served by the release of a record, rather than by it being withheld, in the event that one of three conditions is fulfilled. The first condition is that the record under consideration "discloses that an investigation for the purpose of the enforcement of any law...is not authorised by law or contravenes any law". The second condition is that the record contains information concerning "the performance of the functions of a public body whose functions include functions relating to the enforcement of law"" and the third condition is that it contains information concerning "the merits or otherwise or the success or otherwise of any programme, scheme or policy of a public body for preventing, detecting or investigating contraventions of the law".

Having examined the relevant information, I do not consider that it satisfies these conditions. Accordingly, I am satisfied that the public interest is not required to be considered in respect of the withheld information i.e. column 5 and 6 of the table, including the headings, and that it is exempt from release under section 23(1)(a)(v) of the FOI Act and I find accordingly.

Record 4 - Irish Prison Service 2011 Capital Construction Work Audit - Joint Report with the Comptroller and Auditor General (C&AG)
The Department provides confirmation from the C&AG that it carried out this audit as a joint audit with the Department's Internal Audit Unit. Section 46(1)(c)(ii) provides that the FOI Act does not apply to a record relating to an audit, inspection or examination carried out by the C&AG under the Comptroller and Auditor General Acts, 1923 and 1993, the Exchequer and Audit Department Acts, 1866 and 1921, or any other enactment. Having examined this record, I am satisfied that it relates to an audit, inspection or examination carried out by the C&AG and I find, therefore, that section 46(1)(c)(ii) applies to record 4.

Report 10 - Justice Vote Audit Report
The Department's position is that some of the information in this report should be redacted on the basis of sections 20(1), 23(1)(a)(v), 23(1)(aa), 28(1) and 31(1)(a).

The Department claims that Section 20(1) applies to two tables of suspense account balances in Chapter 10 of the report, and that Section 28(1) applies to one suspense account name.

Section 20(1) of the FOI Act provides as follows:

"A head may refuse to grant a request under section 7 if the record concerned contains matter relating to the deliberative processes of a public body (including opinions, advice, recommendations, and the results of consultations, considered by the body, the head of the body, or a member of the body or of the staff of the body for the purpose of those processes)"

Section 20(2) provides that subsection (1) does not apply to a record if and in so far as it contains, inter alia,"factual information". Section 20(3) provides that a record to which section 20(1) has been found to apply may still be released if the public interest would, on balance, be better served by granting rather than refusing to grant the request.

Thus, the effect of sections 20(1), 20(2) and 20(3) is that material forming part of the decision making process of a public body can be exempt from release if the public interest is not better served by such release. The deliberative process can be described as a thinking process that refers to the way a public body makes decisions. It involves the gathering of information from a variety of sources and weighing or considering carefully all of the information and facts obtained with a view to making a decision or reflecting upon the reasons for or against a particular choice. Deliberations naturally involve stages and public bodies need to be free to bring matters to conclusion. It is also reasonable that certain sensitive information should not be prematurely released before the deliberative process, relevant to that information, has been completed.

The information at issue here can be described as a list of suspense account balances at a point in time (31 December 2011) which is over two years ago and reflects the factual position at that time. I cannot accept that this information relates to a "deliberative process" and therefore, I am satisfied that Section 20(1) does not apply to this information. I find accordingly.

Personal Information
One suspense account name is that of an individual. Having reviewed the record and considered the submission of the Department on the matter, I am satisfied that this information is personal to an identifiable third party and not to the applicant.

Section 28(1) of the FOI Act provides:

"Subject to the provisions of this section, a head shall refuse to grant a request under section 7 if, in the opinion of the head, access to the record concerned would involve the disclosure of personal information".

There are some circumstances, provided for at section 28(2), in which the exemptions at section 28(1) do not apply. Having examined the information at issue, I am satisfied that none of the circumstances identified at section 28(2) arise in this case. That is to say, (a) that the third party information contained in the records does not relate solely to the applicant; (b) that the third parties have not consented to the release of their information; (c) that the information is not of a kind that is available to the general public; (d) that the information at issue does not belong to a class of information which would or might be made available to the general public; and (e) that the disclosure of the information is not necessary to avoid a serious and imminent danger to the life or health of an individual. I find that section 28(2) does not apply to the withheld records.

Section 28(5)(a) provides for the release of personal information relating to third parties where the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates. Having reviewed the record, I am not satisfied that the public interest served by the disclosure of other parties' personal information would, in this instance, be of sufficient weight as to displace the public interest served by respecting the right to privacy of the individuals concerned. I find that Section 28(1) applies to the name of the individual and direct that the name be withheld.

Section 31(1)(a) - Financial Interests of the State
The Department claims that Section 31(1)(a) applies to three tables in Chapter 3 relating to payroll overpayments and salary recoupment and one table in Chapter 5 relating to payment issues. Section 31(1)(a) provides that access to a record may be refused if access "could reasonably be expected to have a serious adverse affect on the financial interests of the State....." Section 31(2) provides a non-exhaustive list of categories of information that may qualify for exemption, provided that the relevant test in section 31(1) is met, which in this case requires a showing of a reasonable expectation of a serious adverse affect. The onus is on the Department to identify any potential serious adverse effect on the financial interests of the State. The number of incidents of overpayments reported in the tables is 100. Other information available from the Department's website shows that the relevant number of staff being paid by the Department in 2011 was over 6,000. The information demonstrates that overpayments arose in a very small proportion of cases and that the overpayments and reasons for them were identified and therefore, steps can be taken to recover the overpayments. Similarly, the table relating to payment issues shows that issues arose in relation to a very small proportion of payments made and that these issues have been identified. I cannot see how the release of this information would give rise to a "serious adverse affect on the financial interests of the State". I find that Section 31(1)(a) does not apply to this information.

Section 23(1)(a)(v) - Security of a penal institution
The Department claims that all references to the Criminal Assets Bureau (CAB) in the report should be redacted on the grounds of Sections 23(1)(a)(v) and 31 of the FOI Act. In so doing, it refers to Section 10 of the Criminal Assets Bureau Act, 1996 (1996 Act) which provides for anonymity to be given to officers and staff of CAB. Ms. Lynch informed the Department of her view that CAB is not a "penal institution" and therefore, Section 23(1)(a)(v) cannot apply. I agree with Ms. Lynch and find accordingly.

The information in the report relating to CAB is administrative in nature and relates to the application of normal public financial procedures and provision of assurances in this regard in the same way as for any functional area of the Department. There is no information which, in my view, could be said to relate to the operational functions of CAB, nor is there any information which reveals the identity of any members of staff of CAB. I am satisfied that release of the information relating to CAB would not be a breach of the provisions of Section 10 of the 1996 Act.

In relation to Section 31, the Department claims that release of information on control processes and any weaknesses identified in the report could be used to further breach controls and weaken financial and audit processes and bring loss to the State. In my view, the fact that weaknesses are identified and the report makes it clear that steps are being taken to address any such weaknesses is evidence that the control processes work and that any breaches are rectified. The Department has not demonstrated how the release of all references to CAB in the report could give rise to a "serious adverse affect on the financial interests of the State" and I find that Section 31(1)(a) does not apply to this information.

The Department also claims that Section 23(1)(aa) applies to one recommendation in this report. Mindful of the provisions of Section 43(3), I do not consider it appropriate for me to specify which recommendation is at issue in this decision. However, I can say that the recommendation at issue refers to one of a number of Departmental policies in place to ensure proper procedures are used for the disbursement of public monies. Section 23(1)(aa) provides that a public body may refuse access if access to the records concerned "could, in the opinion of the head, reasonably be expected to... endanger the life or safety of any person."

This exemption is one that is not commonly used. The former Information Commissioner has previously considered this exemption in Case Number 090066 (available on this Office's website at www.oic.gov.ie) where she said that it is an exemption which should not be applied without "careful consideration having been given to whether the expectation set out in the subsection is a reasonable one in all of the circumstances". She also said that she considered that "the test to be met in regard to this exemption is such that it should only be invoked in circumstances of the most serious nature. What is required is an assessment of the expected consequences of releasing particular records in terms of endangering life or safety. It is not necessary or indeed possible to establish that such physical harm will occur but that there is reasonable expectation of this." In considering the phrase "could reasonably be expected to" the Information Commissioner has been guided by the analysis carried out by the Queensland Information Commissioner in "Re "B" and Brisbane North Regional Health Authority" (1994) 1 Q.A.R 279 in which he said:

"The words call for the decision- maker ... to discriminate between unreasonable expectations and reasonable expectations, between what is merely possible (e.g. merely speculative /conjectural ''expectations'') and expectations for the occurrence of which real and substantial grounds exist."

In the view of this Office, consideration of this exemption must be concerned only with whether or not the expectation of endangerment to life or safety to persons is reasonable. In order for the exemption to be upheld, it should be possible to clearly link the expectation of serious harm arising to the content and context of the records. Having considered the submission of the Department and the content of the records, I am not satisfied that the evidence available to me provides a sufficient basis for the application of this exemption. I find that Section 23(1)(aa) does not apply and direct the release of this information.

Report 11 - Prison Service Vote Audit
The Department's position is that some of the information in this report should be redacted on the basis of sections 20(1) and 31(1)(a). The type of information in this report for which the exemptions are claimed is similar to that in Report 10 - Justice Vote Audit Report.

The information for which Section 20(1) is claimed includes tables of now historical financial information and general policy recommendations. I have been given no basis by the Department for accepting that this information relates to a "deliberative process" and therefore, I am satisfied that Section 20(1) does not apply to this information. I find accordingly.

The information for which Section 31(1)(a) has been claimed includes tables of overpayment analysis, issues identified with invoices and a narrative on process and controls in place for prison tuck shops. In both the overpayments and invoices, the numbers of instances are very small in proportion to the overall number of payments issued. The Department has not identified how the release of this information could give rise to a "serious adverse affect on the financial interests of the State" nor has it addressed the expectation that this might occur. Having considered the submissions of the Department and examined the information at issue, I am satisfied that Section 31(1)(a) does not apply and I find accordingly and direct the release of this record.

Decision

Having carried out a review under Section 34(2) of the FOI Act, I hereby vary the decision of the Department and I find that the FOI Act does not apply to Report 4 under Section 46(1)(c)(ii). I further find that Sections 20(1) and 31(1)(a) do not apply to exempt any of the withheld information but that Section 23(1)(a)(v) applies to exempt some information in Report 3 Appendix 4 and that Section 28(1) applies to exempt the name of an individual in Report 10. I direct the release of Report 3 apart from the exempt information in Appendix 4; the release of Report 10 apart from the name of the individual; and the release of Report 11 in full.

Right of Appeal

A party to a review, or any other person affected by a decision of the Information Commissioner following a review, may appeal to the High Court on a point of law arising from the decision. Any such appeal must be initiated not later than eight weeks from the date on which notice of the decision was given to the person bringing the appeal.

Elizabeth Dolan
Senior Investigator