Whether the Regulator was justified in withholding certain information in response to a request for access to records concerning "technical glitches" experienced by Premier Lotteries Ireland

Conducted in accordance with section 22(2) of the FOI Act by Stephen Rafferty, Senior Investigator, who is authorised by the Information Commissioner to conduct this review

Background

On 5 May 2015, the applicant made a request to the Regulator for access to all internal reports/memos regarding the 'technical glitches' experienced by Premier Lotteries Ireland (PLI) since the start of 2014 and to all correspondence between the Regulator and Premier Lotteries Ireland regarding these 'technical glitches'. On 15 May 2015, the Regulator notified PLI of the request and invited submissions on the release of certain records. PLI objected to the release of the records. On 16 June 2015, the Regulator informed the applicant that he had decided to partially grant the request. As this initial decision was made by the head of the public body concerned, the applicant applied directly to this Office on 7 July 2015 for a review of the Regulator's decision.

During the course of the review, Mr Simon Noone of this Office invited a number of third parties to make submissions on the possible release of records. The third parties in question were PLI, Intralot Ireland Limited (Intralot), Telefonica, and Westbase Technology Limited (Westbase). Submissions were received from all but Telefonica. In conducting this review, I have had regard to the contents of the records at issue, to the correspondence between this Office and the Regulator and to the submissions of the third parties concerned.

In referring to the records at issue, I have adopted the numbering system used by the Regulator in the schedule of records provided to this Office for the purpose of conducting the review.

Scope of the Review

The Regulator split his decision into two parts, one of which related to the "third party records" element of the request, and the other concerned the "non-third party records". In a telephone conversation with Simon Noone, Investigator, the applicant confirmed that his request for a review related to both elements of the request. Subsequently, the Regulator informed this Office that he had released (either fully or partially) 63 non-third party records to the applicant, and he submitted a copy of these records to this Office. However, he stated that only one of the records came within the scope of the request, and that he had released the bulk of the non-third party records to the applicant as a courtesy. Having inspected the records in question, I agree with the Regulator that only one of the non-third party records, number 46, falls within the scope of the initial request.

The Regulator identified 51 third party records as coming within the scope of the request. He released two records in full (records 32 and 34), 30 records in part, and he refused access to the remaining 19 records. The majority of the records to which access was part-granted were redacted to remove the identities of individuals (including email addresses and/or mobile telephone numbers). During the course of the review, the applicant confirmed that he does not require access to such details. Accordingly, I have excluded those records from the scope of this review, and also non-third party record 46 for the same reason.

Accordingly, the scope of this review is concerned with whether the Regulator was justified in granting only partial access to third party records 3 and 40 and in refusing access to records 7, 8, 17, 18, 21 to 25, 29, 30, 36 to 38, 43 to 46, and 51.

Preliminary Matters

It should be noted that the courts have taken the view that, under FOI, records are released without any restriction as to how they may be used and, thus, FOI release is regarded, in effect, as release to the world at large. Additionally, while I am required by section 22(10) of the FOI Act to give reasons for decisions, this is subject to the requirement of section 25(3) that I take all reasonable precautions during the course of a review to prevent disclosure of information contained in an exempt record. This means that the description which I can give of the records at issue is limited. Furthermore, while section 18(1) of the Act allows for the partial release of records, subsection (2) states that the requirement to grant partial access to a record shall not apply if the redacted record would be misleading.

Findings

The Regulator relied upon the provisions of sections 29, 35 and 36 in refusing access to the records. In my view, as section 36 is of most relevance, I will consider that exemption first.

Section 36
This is a mandatory exemption that protects commercially sensitive information. Section 36 (1) provides as follows:

"Subject to subsection (2), a head shall refuse to grant an FOI request if the record concerned contains --

(a) trade secrets of a person other than the requester concerned,

(b) financial, commercial, scientific or technical or other information whose disclosure could reasonably be expected to result in a material financial loss or gain to the person to whom the information relates, or could prejudice the competitive position of that person in the conduct of his or her profession or business or otherwise in his or her occupation, or

(c) information whose disclosure could prejudice the conduct or outcome of contractual or other negotiations of the person to whom the information relates."

Subsection (2) contains a number of exceptions to the exemption. Subsection (3) contains a public interest balancing test.

There are two parts to section 36(1)(b). The only requirement that has to be met in the second part is that disclosure could prejudice the competitive position of the person to whom the information relates. The standard of proof required to show that disclosure of the information sought could cause the harm identified is relatively low in the sense that the test is not whether prejudice or harm is certain to materialise but whether it could do so. The vast majority of the records at issue contain detailed technical information relating to the various issues that arose and actions proposed or taken to resolve those issues while a number of the records contain comment on the manner in which PLI responded to the Regulator's request for information regarding those issues.

In his submission to this Office, the Regulator stated that he relied on subsections (1)(a), (1)(b) and (1)(c) in refusing access to the records. He argued that the release of the records would cause the various harms outlined in those sections to PLI and/or connected parties.

Record 3 is described as a "National Lottery Update" regarding the technical glitches experienced on 4 February 2015. It was partially released by the Regulator. The part of record 3 that was released explains that the Lottery was postponed on 4 February 2015 following a Europe-wide telecommunications network outage on the Telefonica network. The withheld information is of a similar nature to that already released to the requester (record 34 also refers). Accordingly, I find that section 36(1) does not apply.

Westbase is a managed telecommunications provider contracting 3G services from Telefonica/O2 Ireland and Broadband from Eircom for PLI's retail communications network. Records 8, 17, 18, 21, 23 and 30 are "Incident Reports" relating to Telefonica network outages on 26 January 2015, 28/29 January 2015, 4 February 2015 and 9 February 2015 that Westbase provided to PLI and which, in turn, were provided to the Regulator. In its submission to this Office, Westbase stated the following:

"The reports in question relate to sensitive commercial, scientific and technical information regarding the functioning of proprietary wireless technology networks in Ireland and abroad created, owned and operated by private companies including Westbase ... There is a very real danger that should this type of information be made public it would facilitate sophisticated cyber-attacks by unsavoury individuals/groups who engage in criminal activities designed at disabling technology networks ... The reports contain information relating to Intellectual Property and proprietary software of Westbase and others which are trade secrets...Further the reports contain commercial, scientific and technical information in relation to technology which Westbase and others have invested time and money in creating and operating ... competitors armed with access to this information might take actions such as amending their own technology to seek to gain a competitive advantage and seek to oust Westabse from contracts in which we are engaged as technology provider"

Intralot provides the set-up, maintenance and support of software platforms and retail terminals for the National Lottery. Records 25 and 37 are incident reports that were prepared by Intralot in connection with an incidents on 2 March 2015. In the submission, through its solicitors, Intralot stated the following:

"The Reports include analysis of the technical infrastructure and IT systems supporting the National Lottery. In particular, they address an issue around the encryption/decryption mechanism which is supplied by Intralot to PLI. This information is extremely sensitive from a security perspective and we are instructed that its release would pose a substantial risk to (i) the confidentiality of Intralot's proprietary systems and processes; and (ii) the security of the IT infrastructure which supports the National Lottery.

In particular, we are instructed that the contents of the Reports could provide valuable information to any party planning a cyber-attack on PLI and the National Lottery infrastructure generally. This is a very real and live threat as PLI have been the victim of DDoS (Distributed Denial of Service) attacks in recent weeks."

Records 7 and 29 comprise preliminary and final reports by Telefonica concerning the network outage on 4 February 2015, while record 22 is a copy of record 7. While Telefonica did not make a submission to this Office despite being offered an opportunity to do so, I note that the reports contain technical details of the nature of the outage and details of the steps taken by Telefonica to identify and rectify the cause of the problem.

Camelot Global Services Ireland (CGSI) provides consultancy services to PLI. Records 24 and 36 comprise incident reports from CGSI concerning a service interruption on 27 February 2015 affecting a number of terminals. The reports contain technical details of the root cause of the incident and the resulting actions being taken

Records 43 and 44 comprise Incident Reports that PLI provided to the Regulator concerning the outages of 26 and 28/29 January 2015. The reports contain detailed technical information relating to the outages.

Records 38 and 45 comprise reports that Mazars prepared for the Regulator, while record 46 comprises a memorandum from Mazars to the Regulator. These records contain commentary on the adequacy of the responses provided by PLI to the Regulator on the various issues.

Record 51 comprises a presentation prepared by PLI for the Regulator.

Having carefully considered the contents of each of the above records, it seems to me that their release could prejudice the competitive position of the persons to whom the information relates, either by disclosing detailed technical information that may be of use to competitors or as a result of possible reputational damage. Given that the standard of proof required to show that disclosure of the records could cause the harm identified, I am prepared to accept that section 36(1)(b) applies. I also accept that none of the exceptions at section 36(2) apply. However, that is not the end of the matter as I must also consider, under section 36(3) whether the public interest would, on balance, be better served by granting access to the records.

Under the National Lottery Act 2013, one of the functions of the Regulator is to monitor the operation of the National Lottery and to monitor and enforce compliance with the Act and the licence to operate the National Lottery. Under section 48 of that Act, the licence holder and the operator must provide the Regulator with such information as he may require. It seems to me that a key public interest for releasing additional information relating to the various "technical glitches" lies in optimising transparency and accountability in the manner in which the Regulator carried out his functions in his engagements with PLI in connection with the various issues that arose, as opposed to increasing transparency or accountability in respect of the various service providers. As such, while I accept that the full release of all records would serve to increase transparency and accountability, I must also consider the potential harm that could arise as a result of their release.

Section 36(1) itself reflects the public interest in the protection of commercially sensitive information. This Office takes the view that the FOI Act was designed to increase openness and transparency in the way in which FOI bodies conduct their operations and, in general terms, it was not designed as a means by which the operations of private enterprises were to be opened up to scrutiny. Accordingly, I find that the public interest would be better served by refusing access to records 7, 8, 17, 18, 21, 22, 23, 24, 25, 29, 30, 36, and 37 in their entirety.

However, I find that the public interest would be better served by the release of certain parts of records 38, 40, 43, 44, 45, 46 and 51, as follows:

Record 38: All except the two sub-bulleted paragraphs on page 2 following "... related as
follows:"
Record 40: All except the name of the addressee, which is not required by the applicant
Record 43: All except the text contained under the headings "Technical Service Impact" on page 4, "Root Cause" on page 4, "Incident Resolution" on page 4,
"Technical" on page 5, and "Appendix 1" on pages 7 to 9
Record 44: All except the text contained under the headings "Technical Service Impact" on page 4, "Root Cause" on page 4, "Incident Resolution" on page 4,
"Technical" on page 5, and "Appendix 1" on pages 6 to 8
Record 45: All except the text after "as follows" on page numbered 2, the first three
paragraphs on page numbered 3 up to and including "Irish national Lottery",
and the final bullet point on page numbered 5
Record 46: All except the third main bullet point in the left-hand column on page 3, the
the third bullet point in the right-hand column on page 3, the first and and
sixth bullet point in the right-hand column on page 6, and the bullet point in
the left-hand column on page 9.
Record 51: Pages 1, 2 and all of page 10 except the final entry in the column "Actions
Taken/Next Steps"

Accordingly, I find that section 36(1) does not apply to records 38, 40, 43, 44, 45, 46 and 51, apart from those parts identified above.

In respect of the above records or parts of records where I have found that the section 36 exemption is not applicable, I will now consider the other exemptions claimed.

Section 29
This is a discretionary exemption that protects the deliberative processes of FOI bodies. It has two requirements: (1) the records must contain matter relating to the deliberative process, and (2) disclosure must be contrary to the public interest. A deliberative process can be described as a thinking process which informs decision making in FOI bodies.

The Regulator has claimed this exemption in respect of all of the outstanding records (i.e. record 3 and the relevant parts of records 38, 40, 43, 44, 45, and 46 and 51). He has submitted that "The relevant parts of these records relate to my regulatory review concerning the National Lottery service outages earlier this year. This review is ongoing and I have not concluded my findings...In my view, until such time as I have completed my regulatory review of the service outages and concluded my findings on the matter, the granting of access to records or parts thereof containing matter relating to that review would be premature, and could reasonably be expected to prejudice the operation of the National Lottery."

It is important to note that the Commissioner has drawn a distinction between an FOI body being engaged in a monitoring or supervisory role and being engaged in a deliberative process. In Case Number 98078 (Wall and Department of Health and Children, on www.oic.ie), the previous Commissioner stated that "Correspondence from the Department warning agencies that they must keep to budget or must take measures to ensure budget allocations are not exceeded do not, in my opinion, relate to the deliberative process. They relate to the administrative or regulatory role of the Department in overseeing the expenditure pursuant to allocation."

As I have outlined above, one of the functions of the Regulator is to monitor the operation of the National Lottery and to monitor and enforce compliance with the National Lottery Act 2013 and the licence to operate the National Lottery. It seems to me that in carrying out his review of the service outages experienced by the National Lottery, the Regulator is performing this monitoring function. Indeed, he has referred to it as a "regulatory review". Therefore, I am of the opinion that he is not engaged in a deliberative process, as envisaged by section 29 of the FOI Act, and consequently, I find that section 29 does not apply. As no other exemption has been cited in respect of record 40, I find that the record should be released subject to the redaction of the name of the addressee.

Section 35

This is a mandatory exemption that protects information obtained in confidence. Section 35 provides as follows:

1) Subject to this section, a head shall refuse to grant an FOI request if

(a) the record concerned contains information given to an FOI body, in confidence and on the understanding that it would be treated by it as confidential (including such information as aforesaid that a person was required by law, or could have been required by the body pursuant to law, to give to the body) and, in the opinion of the head, its disclosure would be likely to prejudice the giving to the body of further similar information from the same person or other persons and it is of importance to the body that such further similar information as aforesaid should continue to be given to the body, or

(b) disclosure of the information concerned would constitute a breach of a duty of confidence provided for by a provision of an agreement or enactment..."

The Regulator has claimed that both subsection (1)(a) and subsection (1)(b) apply. Therefore I must consider the applicability of both subsections to the remaining records, namely the relevant parts of records 3, 38, 43, 44, 45, and 46 and 51.

In respect of record 3, I consider that there is nothing in that part of the record that was withheld to suggest that the information in question was given to the Regulator in confidence. Indeed, as I have noted above, the withheld information is of a similar nature to that already released to the requester. Accordingly, I find that section 35(1) does not apply and that the record should be released in its entirety.

Records 38, 45 and 46 comprise reports and a memo prepared for the Regulator by Mazars. The records were prepared to advise the Regulator on the adequacy of the responses given to him by PLI in relation to the technical issues that arose and to allow him to carry out his statutory functions. I do not accept that the records in question were given to the Regulator in confidence. Accordingly, I find that section 35(1) does not apply to those parts of records 38, 45 and 46 that I have already found should be released in the public interest, as described above.

Records 43, 44 and 51 comprise reports and a presentation prepared by PLI for the Regulator. It seems to me that any concerns as to the confidentiality of the information at issue stem from the detailed technical nature of the information provided. However, I have already found such information to be exempt from release under section 36. In my view, it cannot be argued that the remaining information was given in confidence on an understanding that it would be treated as confidential or that the release of that information would constitute a breach of a duty of confidence. PLI is required, by the terms of the licence granted and the statutory provisions of the National Lottery Act 2013, to provide whatever relevant information the Regulator requires to enable him to carry out his statutory functions. Accordingly, I find that section 35(1) does not apply to those parts of records 43, 44 and 51 that I have already found should be released in the public interest, as described above.

Decision

Having carried out a review under section 22(2) of the Act, I hereby vary the decision of the Regulator. While I affirm the decision of the Regulator to refuse access to records 7, 8, 17, 18, 21, 22, 23, 24, 25, 29, 30, 36 and 37, I direct the release of the following parts of the following records:

Record 3: The full record
Record 38: All except the two sub-bulleted paragraphs on page 2 following "... related as
follows:"
Record 40: All except the name of the addressee, which is not required by the applicant
Record 43: All except the text contained under the headings "Technical Service Impact" on page 4, "Root Cause" on page 4, "Incident Resolution" on page 4,
"Technical" on page 5, and "Appendix 1" on pages 7 to 9
Record 44: All except the text contained under the headings "Technical Service Impact" on page 4, "Root Cause" on page 4, "Incident Resolution" on page 4,
"Technical" on page 5, and "Appendix 1" on pages 6 to 8
Record 45: All except the text after "as follows" on page numbered 2, the first three
paragraphs on page numbered 3 up to and including "Irish national Lottery",
and the final bullet point on page numbered 5
Record 46: All except the third main bullet point in the left-hand column on page 3, the
the third bullet point in the right-hand column on page 3, the first and and
sixth bullet point in the right-hand column on page 6, and the bullet point in
the left-hand column on page 9.
Record 51: Pages 1, 2 and all of page 10 except the final entry in the column "Actions
Taken/Next Steps"

Right of Appeal

Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated by the applicant not later than eight weeks after notice of the decision was given, and by any other party not later than four weeks after notice of the decision was given.

Stephen Rafferty
Senior Investigator