Whether GMIT was justified in its decision to refuse access on the basis of sections 15, 35 and 37 of the FOI Act to various records relating to an investigation 

28/12/2017

The Senior Investigator affirmed GMIT's decision to refuse access to the records  withheld on the basis of sections 15(1)(a) and 37(1) of the FOI Act. 
 
Background

In a detailed request dated 1 July 2016 the applicant sought access to certain records of correspondence and  related notes between investigators and various named individuals in GMIT; appendices to a particular report and information relating to Data Protection and FOI policies. All of the records were created in the context of an investigation which I cannot describe here lest I disclose personal information about identifiable individuals.   On 22 July 2016 the President of the Institute (the head of the FOI body) made a decision to partially grant the applicant's request.  Access to some of the information sought was refused on the basis of sections 15, 35 and 37 of the FOI Act. 

The applicant sought a review of that decision by this Office on 20 January 2017. 

I have now completed my review in accordance with section 22(2) of the FOI Act.  In conducting this review I have had regard to the correspondence between the applicant and GMIT, and to correspondence between this Office and both the applicant and GMIT on the matter.  

Scope of Review

The applicant's application to this Office for a review of her FOI request was made through her solicitors.  That application states that she wishes to have information about her corrected in a particular report and seeks to have responses to previous FOI requests investigated.  The applicant, referred to "seeking unredacted copies of reports" and "corrections".
It is important to note at the outset that this review application was made on foot of GMIT's FOI decision of 22 July 2016 in response to a request made under section 11 of the Act. It is not apparent that the applicant made a request to GMIT under the separate provisions of section 9 of the FOI Act to have personal information held amended and therefore it is outside the scope of this review to consider whether or not it is appropriate to amend any record.  Similarly, applications for a review of previous decisions made on previous requests were not made and so are outside the scope of this review. 

The applicant made very detailed submissions in the course of her review. While the detailed background she set out was of some assistance, I have to say that many of the issues and complaints in the submissions are outside of my remit and will not be considered.
This review is concerned solely with the review of the decision on the six categories of records sought in the request of 1 July 2016, namely:

1. A copy of the investigators' request to [a certain staff member] for clarification from the applicant on evidence provided by her and the subsequent statement by [that staff member] to the investigators.
2. A copy of the investigators' request to [a staff member] (as outlined in his email dated 13 May 2013) and [the] response to them.
3. A copy of Appendix 4 of the [Report], as well as the other appendices and the chronology in which the applicant is named or referenced.
4. A copy of records and briefing notes naming or referring to the applicant from [various individuals] to the investigators during a staff consultation period (April 2012 to August 2013) , specifically as follows: (a) records between [two individuals] naming or referring to the applicant between July 2013 and October 2013 as well as copies of records between [additional individuals] naming or referring to the applicant from November 2012 to October 2013; (b) records exchanged between [various individuals] and the investigators about a file or folder naming the applicant between 7 March 2012 and 28 October 2013 and (c) records between [two individuals] and the investigators naming the applicant on 24 January 2013, 18 April 2013 and up to October 2013 inclusive.
5. Copies of all legal correspondence between GMIT's solicitors and legal advisers relating to the applicant and regarding the issues [] raised with [] on [a certain] report.
6. Copies of GMIT's Data Protection, Data Governance and FOI Policies.

The names mentioned are members of GMIT staff except for [one individual] who was a service provider contracted to GMIT.

Using the numbering of the applicant's request, GMIT created a schedule that cited the exemptions being relied upon in relation to the items listed in the applicant's request.  However, it did not identify specific records or create a schedule showing the exemptions claimed for specific records actually held.  The FOI  Central Policy Unit of the Department of Public Expenditure and Reform publishes a Code of Practice stating that a schedule of records should be furnished to requesters and Section 48 of the FOI Act obliges FOI bodies to have regard to the Code in the performance of functions under the Act.  The failure to adhere to best practice has most likely led to confusion on the applicant's part as she was not made aware of how many records came within the scope of her request. Indeed, the confusion caused as to which records were held and which released in full or in part has also contributed to delays in the review. Following correspondence with this Office, GMIT completed a comprehensive schedule of records that were considered to come within the scope of this review and this is now being furnished to the applicant in the interests of clarity.  The schedule shows that 49 records were identified to this Office by GMIT as coming within the scope of the applicant's request. 

Following correspondence between this Office's Investigator and GMIT,  access was granted in full to 4 records, namely Appendix 4 and Chronology B.20 (a copy of Appendix 4), and the GMIT Data Governance and FOI policies.  Access was granted in part to 26 records, which consisted of redacted correspondence, transcripts, appendices and the chronology.  Access was refused in full to 19 records, that similarly consisted of transcripts, appendices and chronologies. 

In the course of the review, the applicant, through her representatives, accepted the redaction and/or refusal of information relating to persons other than herself.  Having examined the records, I am satisfied that the redactions made to the records partially released to the applicant all relate to other individuals.  As the applicant has accepted that she is not seeking such information then, arguably, these records are outside the scope of the review.  For the sake of clarity however and because so much of the records I have examined are substantially about individuals other than the applicant, I have included these records in my consideration of section 37 below. 

This review is therefore concerned solely with whether or not GMIT was justified in refusing access to the remaining 45 records in full or in part. 

Preliminary Matters

It is important to note that this Office has no role in examining the appropriateness, or otherwise, of any investigations or practices of GMIT.  In particular, section 13(4) of the FOI Act specifically provides that, subject to the Act, any reason that the requester gives for the request shall be disregarded.

Also,  the FOI Act does not provide for the limiting of access to records to particular individuals only. When a record is released under the FOI Act, it effectively amounts to disclosure to "the world at large" (H.(E.) v Information Commissioner [2001] IEHC 58).

Finally, Section 18(1) of the Act provides that where an FOI request would fall to be granted "but for the fact that it relates to a record that is an exempt record, by reason of the inclusion in it, with other matter, of particular matter, the head of the FOI body concerned, shall, if it is practicable to do so, prepare a copy, in such form as he or she considers appropriate, of so much of the record as does not consist of the particular matter aforesaid and the request shall be granted by offering the requester access to the copy." Section 18(1) does not apply, however, if the copy provided for thereby would be misleading (section 18(2) refers).

This Office takes the view that the provisions of section 18 do not envisage or require the extracting of particular sentences or occasional paragraphs from records for the purpose of granting access to those particular sentences or paragraphs. Generally speaking, therefore, this Office is not in favour of the cutting or "dissecting" of records to such an extent. Being "practicable" necessarily means taking a reasonable and proportionate approach in determining whether to grant access to parts of records.

-‹Analysis and Findings

The records are mostly transcripts of witness statements between investigators and members of staff in GMIT concerning an allegation about a student.  The applicant was on the staff of GMIT, was interviewed as part of the investigative process and seeks information relating to her in the records. 

Section 15 - Records not held or do not exist
GMIT stated that section 15(1)(a) applied in relation to the applicant's request for correspondence between [an individual] and various parties; the request for a copy of the Data Protection Policy and any legal correspondence relating to the applicant. 
Section 15(1)(a) of the FOI Act provides that a request for access to records may be refused if the records do not exist or cannot be found after all reasonable steps to ascertain their whereabouts have been taken. The Commissioner's role in cases such as this is to review the decision of the FOI body and to decide whether that decision was justified. This means that I must have regard to the evidence available to the decision maker and the reasoning used by the decision maker in arriving at his/her decision and also must assess the adequacy of the searches conducted by the FOI body in looking for relevant records. The evidence in search cases consists of the steps actually taken to search for records, along with miscellaneous other evidence about the record management practices of the FOI body, on the basis of which the decision maker concluded that the steps taken to search for records were reasonable.

In responses to queries posed by this Office, GMIT provided details of the searches it says it conducted to locate the records sought by the applicant.  In relation to the Data Protection Policy, GMIT advised that this has not yet been completed and therefore does not exist.  I accept this to be the case. It said that its "Data Governance Policy" is on the intranet for staff and it sent a copy to the applicant.  Similarly, GMIT stated that it holds no legal correspondence relating to the applicant. It stated that searches were carried out between GMIT and its legal advisers and that no reference to the applicant was found.  Regarding the request for records exchanged between [an individual] and additional parties, GMIT's position was that [the individual] was best placed to carry out such a search and identify any relevant records.  [That individual] was asked to do so and, according to GMIT, [the] response was that no such meetings took place and therefore no records could exist in relation to them. 

Having regard to the details of the searches conducted by GMIT as outlined above, I am satisfied that it has taken all reasonable steps at this stage to locate the records sought by the applicant. I find, therefore, that GMIT was justified in its decision to refuse the applicant's request for access to further relevant records on the ground that they do not exist or cannot be found after all reasonable steps have been taken to ascertain their whereabouts.
-‹
Section 35 - Confidentiality
GMIT claimed that section 35(1)(a) applied to 19 records.  These records comprise appendices, chronologies and transcripts of [a] Report. 

Section 35(1)(a) applies to a record containing information given to an FOI body in confidence.  In order for section 35(1)(a) to apply, it is necessary to show the following:

• that the information was given to an FOI body in confidence and,
• that the information was given on the understanding that it would be treated by the FOI body as confidential and.
• that disclosure of the information would be likely to prejudice the giving to the body of further similar information from the same person or other persons and,
• that it is of importance to the body that such further similar information should continue to be given to the body.

Section 35(1)(a) is subject to section 35(2) which says that the confidentiality exemption at subsection (1) does not apply to a record which was:

• Prepared by a head, director or staff member of an FOI body or a service provider
• Prepared in the course of the performance of his or her functions
• Unless disclosure would constitute a breach of a duty of confidence that is owed to a person other than an FOI body or head or a director, or member of staff of an FOI body or of such a service provider. 

GMIT notes that the witness statements were prepared by external investigators contracted on behalf of GMIT, but that they were prepared directly on foot of interviews of witnesses and consequently are the witnesses' own statements as transcribed by a stenographer.  GMIT goes on to state that even if this Office finds that the records were prepared by a member of staff or relevant service provider then they should still not be disclosed as to do so would amount to a breach of a duty of confidence.  The Terms of Reference for the investigation referenced confidentiality when it stated that the investigators would "endeavour to ensure that any information provided by witnesses is treated in confidence."  It was submitted by GMIT that a duty of confidence was owed to staff members, an individual third party witness and a student referred to as Student Y. 

Section 35(2) is clear that subsection (1) does not apply if the records were prepared by a service provider to the FOI body.  In this case, the records were prepared by such a service provider, namely the external investigators and stenographers who were engaged to carry out the investigation.  These records were also prepared in the course of the performance of the functions of the service provider.  The first two requirements of section 35(2) have therefore been met.  In relation to the third requirement, that disclosure would constitute a breach of a duty of confidence that is owed to a person other than an FOI body etc, it is the case that, with a couple of possible exceptions, each of the witnesses were either a head, member of staff or service provider of GMIT. Therefore, section 35(1)(a) cannot apply to these records.
 As regards the exceptions, including students/others mentioned in the records, GMIT has not satisfied me that all of the four requirements (listed above) necessary for the section 35(1)(a) exemption apply in the circumstances of this case. I find that the section 35(1)(a) exemption has not been justified. 

However, that is not the end of the matter.  Section 37 is a mandatory exemption which, with limited exceptions, prohibits the disclosure of personal information of third parties and it is relevant here because, even when heavily redacted and anonymised, the records at issue may contain personal information of identifiable individuals. 

Section 37 - Personal Information
Section 37(1) of the FOI Act provides that, subject to the other provisions of the section, an FOI body shall refuse a request if access to the record concerned would involve the disclosure of personal information. This does not apply where the information involved relates to the requester (section 37(2)(a) refers). However, section 37(7) provides that, notwithstanding section 37(2)(a), an FOI body shall refuse to grant a request if access to the record concerned would, in addition to involving the disclosure of personal information relating to the requester, also involve the disclosure of personal information relating to an individual or individuals other than the requester.
Where a record or part of a record contains personal information relating to the requester which is closely intertwined with personal information relating to another party (or parties), and where it is not feasible to separate the personal information relating to the requester from that relating to the other party (or parties), it can be described as joint personal information and section 37(7) must be considered.

"Personal information" is defined in section 2 of Act as follows:
"Personal information means information about an identifiable individual that, either -“

(a) would, in the ordinary course of events, be known only to the individual or members of the family, or friends, of the individual, or
(b) is held by an FOI body on the understanding that it would be treated by that body as confidential.-¯

The definition also details fourteen specific categories of information that is personal information without prejudice to the generality of the foregoing definition, including

 "(i) information relating to the educational, medical, psychiatric or psychological history of the individual...
 (iii) information relating to the employment or employment history of the individual
 (iv) information relating to the individual's membership or former membership of a trade union
 (v) information relating to the individual in a record falling within section 11(6)(a) (a personnel record of a member of staff of an FOI body) and
...(xiv) the view or opinions of another person about the individual".

Following the Supreme Court's decision in The Governors and Guardians of the Hospital for the Relief of Poor Lying-In Women v. The Information Commissioner[2011] IESC 26 (more commonly referred to as "the Rotunda case") I must proceed on the basis that information about an identifiable individual can qualify as personal information where it comes within either (a) or (b) above or where it comes within one or more of the categories (i) to (xiv) which are non-exhaustive.

However, Section 2 also includes an exclusion to the definition of personal information that relates to members of staff of an FOI body.  It states that personal information does not include-

(I) in a case where the individual holds or held-
(A) office as a director of,
(B) a position as a member of staff of, or
(C) any other office, or any other position, remunerated from public funds in, an FOI body, the name of the individual or information relating to the office or position or its functions or the terms upon and subject to which the individual holds or held that office or occupies or occupied that position or anything written or recorded in any form by the individual in the course of and for the purpose of the performance of the functions aforesaid,

(II)  in a case where the individual is or was a service provider, the name of the individual or information relating to the service or the terms of the contract or anything written or recorded in any form by the individual in the course of and for the purposes of the provision of the service.

(III) the views or opinions of the individual in relation to an FOI body, the staff of an FOI body or the business or the performance of the functions of an FOI body. 

Generally speaking, the exclusions contained in the definition of personal information are intended to prevent FOI bodies from relying on section 37 to refuse to grant access to records created by individual staff members or service providers in the course of their work. They do not deprive public servants, or individual contractors, of the right to privacy generally.  Essentially, when considering the exclusions, a distinction must be drawn between the role of a staff member or contractor as a provider of a public service which is subject to oversight and the privacy rights of those same individuals regarding their private employment affairs. In my view, the plain language of the FOI Act strikes this balance by excluding work and role related functions from the definition of personal information but including details relating to matters such as personnel files and employment affairs, which are specifically included in the definition of personal information.  It seems to me that in many instances, records covering sensitive issues such as complaints, allegations and disciplinary issues in the workplace will fall to be considered as personal information under section 37 of the Act.

I find that the information sought, while containing information on the college's handling of the matter, also contains personal information relating to identifiable individuals. Having regard to the provisions of section 18 explained above, I do not consider that it would be feasible to separate out the personal information as it appears in the records from the other information without the resulting redacted records being misleading.  I find that the exclusions to the definition of personal information do not apply. It follows, therefore, that sections 37(1)  and 37(7) apply to the records sought. 

The effect of section 37(1) is that a record disclosing personal information relating to a third party or third parties cannot be released to another person, unless one of the other relevant provisions of section 37 applies, which I will deal with below.  Similarly, section 37(7) provides a mandatory refusal of a request where the record concerned would, in addition to involving the disclosure of personal information of the requester also involve the disclosure of personal information relating an individual or individuals other than the requester.  Section 37(7) is also subject to the other provisions of section 37. 

Having reviewed the records, it is clear that GMIT sought to release as much as possible to the applicant without compromising the information of others.  There are numerous instances where the applicant is mentioned only in passing in a record but the substantial information relates to another individual.  As the applicant's information is so intrinsically linked with the information of another it is difficult to release it without also disclosing the information of other individuals.  The applicant sought, for example, in category 3 of her request, copies of the appendices and chronology in which she is named or mentioned.  However, those appendices contain very little reference to the applicant but do contain substantial personal information of other individuals.  For example, Appendix 9 is 64 pages long but contains only three references to the applicant.  Similarly, Appendix 17 is 54 pages long but contains only one mention of the applicant.  Section 37(7) clearly applies in such circumstances. 

Section 37(2) of the FOI Act sets out certain circumstances in which sections 37(1) and (7) do not apply. I am satisfied that none of those circumstances arise in this case.
Section 37(5) of the FOI Act provides that a request that would fall to be refused under sections 37(1) and (7) may still be granted where, on balance, (a) the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or (b) the grant of the information would be to the benefit of the person to whom the information relates.

I am satisfied that the release of the information at issue would not be to the benefit of the individuals concerned and that section 37(5)(b) does not apply. In relation to paragraph (a), I must consider whether the public interest in granting the request outweighs, on balance, the public interest in protecting the right to privacy of the individuals to whom the information relates.

The Public Interest

In relation to the issue of the public interest under section 37(5)(a), it is important to note the obiter comments of the Supreme Court in the Rotunda case mentioned above. It is noted that a public interest ("a true public interest recognised by means of a well known and established policy, adopted by the Oireachtas, or by law") should be distinguished from a private interest.

In this case, while the applicant has not identified any particular public interest factors favouring release of the records, the FOI Act recognises a public interest in ensuring the openness, transparency, and accountability of public bodies in how they perform their functions. As I have said earlier, I have no remit to consider the adequacy of the investigation process or GMIT's handling of subsequent matters.  It would not be appropriate for me to direct the release of exempt information in the public interest, effectively to the world at large, on the basis of assertions that a process was flawed. As the Commissioner said in his composite decision in cases 090261/090262/090263:

"I believe that the recognition of a public interest in promoting procedural fairness through FOI is more properly understood as an acknowledgement that the public interest in openness and accountability is entitled to significant weight when the constitutional rights of individuals may be affected by the actions of public bodies. It does not mean that it is for me as the Information Commissioner to determine the precise scope of what fair procedures would have required of a public body in a certain set of circumstances."

The public interest has been served to some extent by the information already provided to the applicant. The Act also recognises the public interest in the protection of the right to privacy, both in the language of section 37 and in the Long Title to the Act (which makes clear that the release of records under FOI must be consistent with the right to privacy). It is also worth noting that the right to privacy has a constitutional dimension, as one of the unenumerated personal rights under the Constitution. Privacy rights will therefore be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy. The records in this case contain  sensitive information in relation to third parties.  I accept that there is a public interest in promoting the transparency and accountability of a public body in how it carries out its functions; however, given the nature of the records in this case, I am not satisfied that this public interest outweighs the privacy rights of the third parties involved.  The question is whether or not the applicant's private interest in the records outweighs, on balance, the public interest in protecting the privacy rights of the individuals to whom the information relates. In my view, it does not. I find, therefore, that section 37(5)(a) does not apply.

Accordingly, I find that GMIT was justified in its decision to refuse access to the withheld records and information under section 37(1) of the FOI Act. 

Decision

Having carried out a review under section 34(2) of the FOI Act, I hereby affirm the decision of GMIT to refuse access to the information sought on the basis of sections 15(1)(a) and 37(1) of the Act.

Right of Appeal

Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision.  In summary, such an appeal, normally on a point of law, must be initiated no later than four weeks after notice of the decision was given.
 

Elizabeth Dolan
Senior Investigator