Case Number: 170002

Whether the Department was justified in refusing access under sections 30(1)(a), (b), and 37(1) of the FOI Act to certain records relating to a complaint he had made regarding the alleged unauthorised disclosure of his personal information to a private investigator

Conducted in accordance with section 22(2) of the FOI Act by Elizabeth Dolan, Senior Investigator, who is authorised by the Information Commissioner to conduct this review

Background

In a request made on 15 September 2016, the applicant sought access to records relating to a complaint he had made regarding the alleged unauthorised disclosure of his personal information to a private investigator. The Department granted the request in part and refused it in part. On 13 January 2017, the applicant applied to this Office for a review of the Department's decision.

I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the contents of the records at issue and to the submissions made by the applicant and the Department. I have decided to conclude this review by way of a formal, binding decision.

Scope of the Review

In its decision, the Department identified 48 records as relevant to the applicant's request. During the course of the review, the Department agreed to release additional records to the applicant in full or in part. Adopting the numbering system used by the Department in its schedule of records, the records remaining at issue are the following:
records 5, 15, 19, 22, 23, 24 - in part;
records 26 and 27 - in full.

This review is concerned solely with the question of whether the Department's decision to refuse access to the records remaining at issue was justified under the FOI Act.

Preliminary Matters

Before setting out my findings, there are some preliminary points I wish to make.

The first point to note is that section 13(4) of the Act requires that, subject to the Act, any reasons a requester gives for making a request shall be disregarded. This means that an applicant's motivation cannot be considered except insofar as it might be relevant to the consideration of public interest provisions. I also note that the remit of this Office does not extend to examining the manner in which a public body performs its functions generally, to investigating complaints against a public body, or to acting as an alternative dispute resolution mechanism with respect to actions taken by FOI bodies.

A related point to make is that, with certain limited exceptions, the FOI Act does not provide for the limiting of access to records to particular individuals only. When a record is released under the FOI Act, it effectively amounts to disclosure to "the world at large" (H.(E.) v Information Commissioner [2001] IEHC 58). The FOI Act places no restrictions on the type or extent of disclosure or the subsequent use to which the record may be put.

In addition, I should point out that, while I am obliged to give reasons for my decision, section 25(3) requires that I take all reasonable precautions to prevent the disclosure of information contained in an exempt record or matter that, if it were included in a record, would cause the record to be exempt. This constraint means that the extent to which I can describe the contents of the records is limited. However, I am mindful of the burden of proof under section 22(12)(b) of the Act, which provides that a decision to refuse to grant access to a record "shall be presumed not to have been justified unless the head concerned shows to the satisfaction of the Commissioner that the decision was justified."

Lastly, I should draw attention to section 18 of the FOI Act, which provides for the deletion of exempt information and the granting of access to a copy of a record with such exempt information removed. This should be done where it is practicable to do so and where the copy of the record thus created would not be misleading. However, the Commissioner takes the view that neither the definition of a record nor the provisions of section 18 envisage or require the extracting of particular sentences or occasional paragraphs from records for the purpose of granting access to those particular sentences or paragraphs. Generally speaking, therefore, the Commissioner is not in favour of the cutting or "dissecting" of records to such an extent.

Analysis and Findings

The Department's position
In this case, the Department claims that the records at issue are exempt under one or more of the following provisions: section 30(1)(a), section 30(1)(b), and section 37(1) of the FOI Act. The Department's claims for exemption under section 30(1)(a) and section 30(1)(b) are based on the harm to its investigative and management functions that is expected to arise from the release of records 26 and 27. The Department explains that the records relate to an identifiable staff member whose activities were investigated in response to the applicant's complain of an alleged data breach. According to the Department, the staff member was not informed that s/he was the subject of a possible data breach investigation, as no evidence of inappropriate access was found, but disclosure of the fact of the investigation through FOI could lead to a highly stressful situation for the staff member concerned. The Department states: "The Department has a duty of care to its staff. Releasing information on its staff who do not even know that they were the subject of a serious investigation will undermine staff relations, and could cause unknown stress and harmful consequences for the staff involved." Moreover, as the records relate to the investigation of a staff member for an alleged data breach, the Department claims that they consist of personal information relating to the staff member concerned. Although the staff member concerned is not named in records 26, and 27, s/he is identifiable from other information that has been released in response to the applicant's FOI request.

The applicant's position
The applicant contends that staff members of the Department have been illegally supplying his personal data to private investigators employed by a certain financial institution. He argues that by withholding records relating to the investigation of his complaint, the Department is potentially protecting a criminal and perverting the course of justice. In support of his position, he points to what he regards as a large number of searches on his account. He also refers to High Court proceedings brought against the Department by [a certain individual] arising from alleged data breaches. The High Court action and separate proceedings against a certain private investigator have received some media attention. According to the applicant, the private investigator was seen outside his house taking pictures, and it has been confirmed to him that he is in the same position as [the certain individual].

Moreover, based on the information released to him, the applicant refers to certain named staff members who accessed his data in searches that he regards as "illegal" or otherwise inappropriate. He notes that, by its own admission, the Department has not asked the staff members why they were searching his records. He considers that it is in the public interest that access to the records at issue be granted to him so that he can begin criminal proceedings.

My conclusions
Having regard to the contents of the records and the circumstances of this case, I find that section 37 of the FOI Act is the more relevant exemption to consider in relation to all of the records at issue. Section 37(1) is a mandatory exemption that applies where the grant of a request would involve the disclosure of personal information (including personal information relating to a deceased individual). Personal information is defined in section 2 of the FOI Act as information about an identifiable individual that (a) would, in the ordinary course of events, be known only to the individual or their family or friends or, (b) is held by a public body on the understanding that it would be treated by it as confidential. The FOI Act details twelve specific categories of information which are included in the definition without prejudice to the generality of the forgoing definition, including "(iii) information relating to the employment or employment history of the individual"; "(vi) information relating to any criminal history of, or the commission or alleged commission of any offence by, the individual"; and "(xiv) the views or opinions of another person about the individual".

Records 5, 19, 22, 23, 24
I note that the redactions made from records records 5, 19, 22, 23, 24 consist of information relating to an identifiable third party individual who also made a data access complaint. Although the individual has been named in media reports and is evidently associated with the applicant, I accept that his information is held by the Department on the understanding that it would be treated by the Department as confidential. I am therefore satisfied, and indeed it does not seem to be a matter that is seriously in dispute, that the redactions referring to the third party individual are personal information within the meaning of the Act. Accordingly, section 37(1) applies, subject to consideration of sections 37(2) and 37(5) of the Act.

Records 15, 26, 27
Records 15, 26, and 27 relate to the investigation of two particular staff members in connection with the applicant's data access complaint. The redactions made from record 15 identify a staff member who was, in effect, singled out for investigation to determine whether s/he had accessed the applicant's data. The staff member referred to in records 26 and 27 is not named, but I accept that s/he is identifiable from other information that has been released in response to the applicant's FOI request and that the context suggests that s/he was the subject of further investigation in response to the applicant's data access complaint.

I note that section 2 excludes certain information from the definition of personal information, such that the definition does not include, in pertinent part, in a case where an individual occupies or occupied a position as a member of staff of a public body, the name of the individual or information relating to the office or position or its functions or anything written or recorded by the individual in the course of and for the purpose of the performance of his or her functions. This exclusion to the definition of personal information is intended, in essence, to ensure that section 37 will not be used to exempt the identity of a public servant in the context of the particular position held or any records created by the public servant while carrying out his or her official functions. However, the exclusions to the definition of personal information do not deprive public servants of the right to privacy generally. Thus, previous decisions of this Office have accepted that the exclusions do not apply to references involving allegations of inappropriate or illegal behaviour, whether proven or otherwise (see, e.g., Case 120236 (Messrs T.E.A. Co. Solicitors and the Health Service Executive), available at www.oic.ie (noting in relation to an investigation of alleged inappropriate behaviour by a staff member that "[t]his Office takes the general view that references to public servants which allege inappropriate or illegal behaviour constitute their personal information for the purposes of the FOI Act")). In the circumstances, I accept that the records concerned do not fall within any of the exclusions to the definition of personal information and that section 37(1) applies, subject to consideration of sections 37(2) and 37(5) of the Act.

Section 37(2)
Section 37(2) of the FOI Act sets out certain circumstances in which 37(1) does not apply. However, I am satisfied that none of those circumstances arises in this case. That is to say, (a) the information does not relate solely to the applicant; (b) the individuals to whom the information relates have not consented to the release of the information; (c) the information is not of a kind that is available to the general public; (d) the information does not belong to a class of information which would or might be made available to the general public; and (e) the disclosure of the information is not necessary to avoid a serious and imminent danger to the life or health of an individual.

Section 37(5)
Section 37(5) provides that a request that would fall to be refused under section 37(1) may still be granted where, on balance:

(a) the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or
(b) the grant of the information would be to the benefit of the person to whom the information relates.

As I find no basis for concluding that the release of the information concerned would be to the benefit of the third party individuals to whom it relates, I find that section 37(5)(b) does not apply. In considering the public interest test contained in section 37(5)(a), it is important to have regard to the comments of the Supreme Court in The Governors and Guardians of the Hospital for the Relief of Poor Lying-In Women v. the Information Commissioner[2011] IESC 26 ("the Rotunda Hospital case"). It is noted that a public interest ("a true public interest recognised by means of a well known and established policy, adopted by the Oireachtas, or by law") should be distinguished from a private interest. I also note that, in a recent judgment in F.P. v. the Information Commissioner[2016] IEHC 771, McDermott J. confirmed that the public interest in granting access to records under FOI is not to be determined on the basis of the applicant's personal circumstances or desire to pursue civil or criminal proceedings.

In this case, I accept that there is a strong public interest in openness and accountability in relation to the manner in which the Department carried out its investigation. However, I note that most of the records relating to the investigation have now been released in response to the applicant's FOI request. These records shed a great deal of light on the manner in which the Department carried out the investigation by disclosing which staff members accessed the applicant's social welfare records and the type of search involved. Moreover, the released part of record 15 reveals that the Department also carried out a check to confirm that the applicant's data was not accessed by a particular staff member. I am satisfied that the released records have served the public interest in openness and accountability to a large degree.

Weighing against the public interest in granting access to the records concerned is the strong public interest in protecting the right to privacy. The public interest in protecting privacy rights is reflected both in the language of section 37 and in the Long Title to the Act (which makes clear that the release of records under FOI must be consistent with the right to privacy). The right to privacy also has a constitutional dimension in Ireland. In the circumstances, I find that the public interest in granting access to the records at issue does not, on balance, outweigh the public interest in upholding the right to privacy of the individuals concerned. Accordingly, I am satisfied that the Department's decision to refuse access to the records at issue was justified under section 37(1) of the FOI Act.

Decision

Having carried out a review under section 22(2) of the FOI Act, I hereby affirm the decision of the Department in this case.

Right of Appeal

Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.

Elizabeth Dolan
Senior Investigator