Whether the decision of the HPRA to grant a request to which section 29 of the FOI Act applies, concerning records relating to the Articular Surface Replacement (ASR) Hip Replacement Systems and the ASR Resurfacing Systems, was justified

Conducted in accordance with section 34(2) of the FOI Act, by Elizabeth Dolan, Senior Investigator, who is authorised by the Information Commissioner to conduct this review

Background

On 7 November 2012, a request was made to the HPRA under the FOI Act for records relating to the ASR Hip Replacement Systems and the ASR Resurfacing Systems. The HPRA took the view that the public interest may require the release of certain of the records concerned, notwithstanding that, in its view, they contained confidential information/commercially sensitive information and personal information concerning the company's voluntary recall of the ASR Hip Replacement Systems and the ASR Resurfacing Systems. As required by section 29 of the FOI Act, the HPRA consulted with the company (via its solicitor) on 5 March 2013. All references to the "applicant" in the remainder of this decision may be read as references to the company, or its solicitor, as appropriate.

The applicant's response of 26 March 2013, argued that the records should not be released on the basis that they are exempt under sections 26, 27 and/or 28 of the FOI Act and it stated, that the public interest in withholding the records is much greater than the public interest in disclosure. The HPRA accepted that it should ultimately refuse certain of the records on which it had consulted, but that others were nonetheless required to be released as the HPRA had decided that the records do not contain confidential information and/or commercially sensitive information (its decision of 5 April 2013 refers). From the outset, the HPRA decided to withhold personal names in the records, other than those of employees of the HPRA. As the HPRA did not intend to release any names of third parties, the issue of release of personal information (section 28 of the FOI Act) in the context of this review does not arise. On 19 April 2013 the applicant, applied for a review of the HPRA's decision to grant access to such records.

In carrying out my review, I have had regard to correspondence between the HPRA and the applicant as set out above; to the records at issue, copies of which were sent to this Office for the purposes of the Commissioner's review; to details of various contacts between this Office and the HPRA and to details of various contacts between this Office and the applicant. I have had regard also to the provisions of the FOI Act.

Scope of the Review

The scope of this review is concerned with whether the HPRA's decision, to grant access to a number of the requested records, was justified. The records at issue were numbered by this Office as records 1 to 9 and the corresponding page numbers used by the HPRA are as follows:- Record 1 (pages 1-33), Record 2 (page 38), Record 3 (pages 36-37 with the exception of the fourth paragraph), Record 4 (page 39), Record 5 (page 40), Record 6 (pages 41-52), Record 7 (pages 53-56), Record 8 (pages 57-62) and Record 9 (pages 63-74).

Analysis and Findings

Section 29 requires consultation with an affected third party where a public body is considering the release of records containing confidential information (section 26 of the FOI Act), commercially sensitive information (section 27), or personal information (section 28). If the body decides to release any or all of those records following consultation, the party to whom the records relate has a right to seek a review by this Office of the body's decision.

However, no party to a review has a right of veto over release of records. Section 34(12)(a) of the FOI Act provides that the body's decision is presumed to have been justified unless the person to whom the records relate shows to the Commissioner's satisfaction that the decision was not justified. Effectively, this provision places the onus on the applicant for review to show that the records concerned should not be released on the basis that, at the time of this Office's decision, the records are exempt under section 26, or section 27, or section 28, and that the public interest does not weigh in favour of their release.

It should also be noted that any review conducted under section 34 of the FOI Act is de novo, which means that it is based on the circumstances and the law as they pertain at the time of the decision by this Office.

While the FOI Act requires the Commissioner and his Office to provide reasons for decisions, section 43(3) of the FOI Act also requires all reasonable precautions to be taken in the course of a review to prevent disclosure of information contained in an exempt record. Thus, I cannot describe the records at issue in this case in great detail. However, I have had regard to the requirements of section 34(12)(a) of the Act, as set out above.

The Records At Issue
I do not consider it to be in breach of section 43(3) to say that all of the records at issue, apart from Record 1, consist of emails and attachments dated 2010 and 2011 exchanged between the HPRA and the applicant relating to ASR Hip Replacement Systems and the ASR Resurfacing Systems. These emails deal with the applicant's voluntary recall of all ASR products which issued in 2010 and its subsequent contacts with the HPRA, which is responsible for the regulation of medical devices on the Irish market. The remaining record, Record 1, is an excel spreadsheet provided to the HPRA by the applicant which relates to ASR products.

The decision to release the records was on the basis that the HPRA did not consider that the records contain confidential or commercially sensitive information. In submissions to this Office dated 16 December 2013 and 17 April 2014, the applicant continued to object to the release of the majority of the records/parts of records on the basis of sections 26(1)(a), 26(1)(b), 27(1)(b), 27(1)(c) and 28(1) of the FOI Act.

Consideration of Section 26
Section 26(1)(a) of the FOI Act provides for the mandatory refusal of a record containing information:

• given to a public body in confidence and,
• on the understanding that it would be treated by it as confidential and,
• in the opinion of the head, its disclosure would be likely to prejudice the giving to the body of further similar information from the same person or other persons and,
• it is of importance to the body that such further similar information as aforesaid should continue to be given to the body.

This Office's understanding of the first two requirements of section 26(1)(a) has been superseded by the July 2011 judgments of the Supreme Court, in the case of The Governors and Guardians of the Hospital for the Relief of Poor Lying-In Women v The Information Commissioner[2011] 1 IR 729, [2011] IESC 26 (more commonly referred to as "the Rotunda Hospital case"), available www.oic.gov.ie. In particular, Justice Macken said that what is protected under section 26(1)(a) "stems from the circumstances in which the material is given, and not from the nature of the material itself"; and that the information need not be " 'confidential information' or 'private and secret' or subject to a 'duty of confidence' ... or to have any so-called necessary 'quality of confidence', as defined, other than as to the circumstances in which it was imparted and received.". Macken J. referred to the importance of considering the "circumstances in which [the information] was imparted and received".

Section 26(1)(b) provides that a public body shall refuse a request if disclosure of the information concerned would constitute a breach of a duty of confidence provided for by a provision of an agreement or enactment or otherwise by law. The usual tests to apply in deciding whether there is a breach of an equitable duty of confidence are set out in the case of Coco v. A. N. Clark (Engineers) Limited F.S. R. 415 (which is accepted as reflecting the Irish law on the subject - see, e.g., House of Spring Gardens Limited v. Point Blank Limited [1984] I.R 611). The tests require that: (1) the information has the necessary quality of confidence about it; (2) the information was imparted in circumstances imposing an obligation of confidence; (3) there is an unauthorised use of that information to the detriment of the party communicating it. This Office interprets the term "confidence" under section 26(1)(b) by reference to the following definition, which is derived from the law relating to a breach of a duty of confidence: "A confidence is formed whenever one party ('the confider') imparts to another ('the confidant') private or secret matters on the express or implied understanding that the communication is for a restricted purpose."

Section 26(2) of the FOI Act provides that subsection (1) shall not apply to a record which is prepared by a head, directors or staff members of a public body, or "a person who is providing a service for a public body under a contract for services" in the course of the performance of his or her functions "unless disclosure of the information concerned would constitute a breach of a duty of confidence that is provided for by an agreement or statute or otherwise by law and is owed to a person other than a public body, or a head, director, or member of staff of a public body, or someone who is providing or provided a service for a public body under a contract for services".

This review arises from a decision on a request to which section 29 of the FOI Act applies and a request only falls within the ambit of section 29 if it is one "to which section 26(3)or 27(3)applies or to which section 28(5)applies and which, apart from this section, would fall to be granted" [emphasis added]. In other words, exemptions which are not subject to 26(3), 27(3), or 28(5) are generally not relevant in section 29 cases. However, in previous decisions, e.g., Case Number 98049 (Henry Ford & Sons Ltd, Nissan Ireland and Motor Distributors Ltd and the Office of Public Works(1999), available at www.oic.ie), this Office acknowledged the overlap between the requirements of sections 26(1)(a) and (b). Moreover, although not stated in the FOI Act, the Commissioner takes the view that public interest considerations may be taken into account in determining whether disclosure of information under FOI would constitute a breach of a duty of confidence. Therefore, it seems to me that the question of a duty of confidence naturally arises and is appropriately addressed in any case in which section 26(3) is considered applicable by the public body.

Records 2 and 3
Records 2 and 3 were created by the HPRA, and concern the recall of the ASR products. The applicant argued that these emails include comments made by the HPRA regarding the actions taken by the applicant during the ASR recall and implied criticisms of customers, although no specific customers are mentioned, and that this information is confidential and should be withheld. Section 26 can only apply to such records if the disclosure of the details therein would result in a breach of a duty of confidence owed by the HPRA to the applicant. Having regard to the content of the records at issue, it is not clear to me why the HPRA would owe a duty of confidence to the applicant regarding the details concerned.

Records 4, 5 and 6
The applicant argued that the emails and attachments in Records 4-6 incorporate information that is both confidential and commercially sensitive and should, on this basis, be withheld. The applicant stated that disclosing such information as provided by it in its emails could prejudice the giving to the HPRA of similar information by the applicant and other medical device manufacturers in the future, since it seems likely that the applicant and other manufacturers would be disinclined to provide any confidential information to the HPRA beyond what is strictly necessary to comply with its vigilance obligations if such information may be released into the public domain pursuant to a request made under the FOI Act.

Records 4-6 also deal with the ASR recall issue and do not in my view contain any confidential or otherwise sensitive information. Accordingly, I do not accept that the HPRA owes any duty of confidence to the applicant in respect of the details therein and indeed, nor does the HPRA itself accept this fact. Neither, having regard to the content of these records, do I consider them to contain information that was given to the HPRA in confidence, or on the understanding that it would be treated as such, or that release of the details now would be likely to prejudice the giving to the HPRA of further similar information from the applicant or other parties.

There is no evidence of explicit assurances of confidentiality having been sought or given for Records 2-6 and accordingly, it is my view that the first two tests for section 26(1)(b), as set out above, have not been met. With regard to Record 6, the applicant stated that the subject line of this email includes the words 'Sent in Confidence' and that the first line specifically requests that the attachment to this email should not be circulated outside the HPRA. The applicant further stated that, although the final version of the attachment is in the public domain, the similar, but not identical, draft version is not. The fact that "Confidence " is included in the subject line of this email does not automatically qualify the document as being confidential. The final version of this document is in the public domain and therefore, any confidence which may have applied to the document no longer applies.

As I have no basis to find that section 26 applies to Records 2-6, I find accordingly.

Records 1 and 7-9
During the course of this review and following further consideration of the matter, the HPRA decided that a number of the records are in fact exempt in full from release under section 26(1)(b) of the FOI Act. The records in question are Record 1 and Records 7-9. Record 1 is an excel spreadsheet provided to the HPRA by the applicant which relates to ASR products. Following further submissions from the applicant to this Office, which were forwarded to the HPRA, the HPRA no longer maintains that the information contained in the spreadsheet is in the public domain in this format and level of detail and the HPRA no longer intends to release this record. However, record 1 still falls to be considered in this review.

I have examined the content of the excel spreadsheet (Record 1) and I accept, based on all of the information now before me, that the spreadsheet was provided to the HPRA for the limited purpose of providing information on the recall of ASR products to assist the HPRA in its performance of its regulatory functions in respect of such products and such a recall. This information was provided by the applicant as part of a voluntary process which required the willing participation of the applicant. In order for information to have the necessary quality of confidence, it must not, in general, be common knowledge and a member of the public would have to apply skill and labour to produce the information him or herself. The spreadsheet contains specific product identifiers broken down by individual patient including the individual patient complaint regarding the device. I also accept that this information is not in the public domain in this format or in this level of detail and that the release of the information under FOI would be an unauthorised use to the detriment of the applicant. Accordingly, I find that the requirements for an equitable duty of confidence have been met and that section 26(1)(b) applies to Record 1.

Records 7-9 are emails which relate to stock levels of ASR products. The HPRA stated that, since the FOI request was received, it sought legal advice with regard to the interpretation of Article 20 - Confidentiality of the Medical Devices Directive 93/42/EEC and it made reference to the European Communities (Medical Devices) Regulations, 1994. The HPRA stated that it had considered that stock levels, in the event of a recall were not confidential. However, the HPRA now says that it obtained this information under the Medical Devices Directive (93/42/EEC), and given that this is not in the public domain, it now considers that the information in these emails should not be released. The HPRA further stated that disclosure of this information would be a breach of a duty of confidence owed to the applicant.

With regard to Records 7-9, I consider that these emails contain specific information provided to the HPRA for the limited purpose of the HPRA performing its regulatory functions in respect of the ASR products. I accept that the information is not in the public domain and that it was given to the HPRA in circumstances imposing an equitable duty of confidence on the HPRA. I also accept that the release of the information under FOI would be an unauthorised use to the detriment of the applicant. Accordingly, I find that section 26(1)(b) applies to Records 7-9.

The Public Interest
Section 26(3) provides for a general public interest balancing test and it states that, subject to section 29, subsection (1)(a) shall not apply in relation to a case in which, in the opinion of the head concerned, the public interest would, on balance, be better served by granting rather than by refusing to grant the request concerned. While section 26(1)(b) is not subject to the general public interest balancing test under section 26(3), it has been noted in previous cases that the existence of an equitable duty of confidence is still subject to public interest considerations. However, it has also been acknowledged in previous cases (e.g., in Case 090163, The Sunday Times and Office of the Revenue Commissioners (10 Sept. 2010), available at www.oic.gov.ie) that the public interest grounds which may justify or excuse a breach of a duty of confidence are quite narrow and include, for example, the revelation of wrongdoing or danger to the public.

On its website, the HPRA states that its role is to protect and enhance public and animal health through the regulation of medicines, medical devices and other health products. Among its many functions, the HPRA monitors the safety of all medical devices available in Ireland to ensure that they are as safe as possible and that they work as intended. Given the importance of the HPRA's role to public health and safety, I consider that there is a very strong public interest in openness and accountability in relation to how it carries out its regulatory functions. I further note that there is a mandatory requirement for manufacturers to report vigilance issues to the HPRA. I am of the view that there is a strong public interest in making required safety information regarding medical products available to consumers.
The Commissioner has also recognised that there is a public interest in the proper preservation of confidences and in protecting the commercially sensitive information of a private company. In this case, the applicant did not dispute that the number of ASR revision surgeries at a given date is in the public domain (e.g. as presented by the Health Service Executive at an Oireachtas meeting in 2012 and the number of revision surgeries is also known to the media). However, the applicant contended that Record 1 contains much more detailed information that was provided in confidence to the HPRA. The applicant quoted the Field Safety Notice (FSN) issued by it in August 2010 as an example of general information that is in the public domain. The applicant stated that the statements made in that FSN were made on the basis of information and data then available to it from sources worldwide and the information in the ASR excel spreadsheet is clearly not the same information as that published in the FSN.

While the ASR hip products remain in situ in a significant number of individuals in the State, Records 7-9 relate to stock levels as opposed to the hip products that remain in situ. Record 1 relates to individual cases in which the need for some form of revision or corrective action has already been identified. I also note that there is already a large amount of information in the public domain relating to the applicant's voluntary recall in 2010 of all ASR products and that further information relating to ASR products and the recall falls to be released on foot of this FOI request. In the circumstances, I do not believe that there is a sufficient basis for releasing Records 1 and 7-9 under FOI on public interest grounds and I find accordingly.

Consideration of Section 27
Section 27(1) of the FOI Act provides for the mandatory refusal of three different classes of commercially sensitive information. Section 27(1)(a) provides for the refusal of trade secrets of a person other than the requester concerned, and has no relevance to the case at hand. Section 27(1)(b) provides for the refusal of financial, commercial, scientific or technical or other information whose disclosure could reasonably be expected to result in a material financial loss or gain to the person to whom the information relates, or could prejudice the competitive position of that person in the conduct of his or her profession or business or otherwise in his or her occupation. Section 27(1)(c) provides for the refusal of information whose disclosure could prejudice the conduct or outcome of contractual or other negotiations of the person to whom the information relates.

Records 2-6
The applicant stated that these emails contain commercially sensitive information and that sections 27(1)(b) and (c) applies to these records. It seems to me that the recall of the applicant's ASR products is already in the public domain and any commercial loss that might have arisen would have occurred when this information became public. Accordingly, I do not see from the applicant's submissions how release of the records could cause further damage. The applicant contended that the records contain implied criticisms of its customers and that such persons would be less positively disposed towards the purchase of the applicant's products in the future and this could prejudice the competitive position of the applicant. As the HPRA has indicated that it never intended to release the names of these third parties, I do not accept this argument.

The applicant further argued that the records include specific details which, if considered in isolation and out of context, could result in inaccurate conclusions being drawn regarding performance of certain of the ASR products and the steps taken to address such issues. As a general comment, it appears to me that this argument relies on the assumption that the information in the records, if released, may be misunderstood and I do not accept that the possibility of information being misunderstood is a good reason for refusing access to the records.

The HPRA stated that these records do not contain any commercially sensitive information and that the majority of the information contained in the records is already in the public domain. The HPRA further stated that there is a legal obligation on the applicant to report vigilance information to it and that this should continue if this information is released. Accordingly, it is of the view that the release of the records would not prejudice the giving of further similar information to it in the future. Based on all of the information now before me, I do not accept that disclosure of the records could reasonably be expected to result in a material financial loss or gain to the applicant or could prejudice the competitive position of the applicant in the conduct of its business or otherwise in his or her occupation. I also do not accept that disclosure could prejudice the conduct or outcome of contractual or other negotiations of the applicant and accordingly, I find that section 27 does not apply to these records.

Records 1 and 7-9
Having already concluded that Record 1 and Records 7-9 are exempt from release in their entirety under section 26, and that the public interest favours the withholding of these records, it is not necessary for me to consider further the application of section 27 to these particular records.

The Public Interest
While, in these circumstances, it is not necessary for me to consider the public interest test at section 27(3) of the FOI Act, it is my view, that even if I had accepted that the information in Records 2-6 is commercially sensitive, that the public interest test would have required the release of these records. This is because, in my view, having examined the records, I consider the public interest in transparency surrounding the manner in which the HPRA deals with recalls of medical devices and use of public funds to outweigh the public interest in ensuring that the potential harms identified by the applicant do not arise. Accordingly, I find that the HPRA was justified in its decision to release Records 2-6 in this case.

Consideration of Section 28
Section 28(1) of the FOI Act provides that, subject to other provisions of section 28, a public body shall refuse a request for a record where granting it would involve the disclosure of personal information about an identifiable individual. As stated above, the HPRA decided to withhold personal names in the records, other than those of employees of HPRA. As the HPRA did not intend to release any names of third parties, the issue of release of personal information in the context of this review does not arise.

Decision

Having carried out a review under section 34(2) of the FOI Act, I hereby vary the decision of the HPRA in the following terms:

• I annul its decision in relation to Record 1 and Records 7-9 and direct that access to these records be refused under section 26(1)(b) of the FOI Act.
• I affirm its decision in relation to Records 2-6.

Right of Appeal

A party to a review, or any other person affected by a decision of the Information Commissioner following a review, may appeal to the High Court on a point of law arising from the decision. Such an appeal must be initiated not later than eight weeks from the date on which notice of the decision was given to the person bringing the appeal.

Elizabeth Dolan
Senior Investigator