Whether the Department was justified in redacting certain information from a number of records relating to certain meetings between the Department and the Office of the Data Protection Commissioner (ODPC) and related records under sections 30, 31, 32 and 37 of the FOI Act. 

16/04/2018

Background

On 5 September 2017, the applicant sought access to the following:

(i) records of meetings between the Department and the Office of the Data Protection Commissioner (ODPC) on 20 September 2016 including venue, attendees, agenda and minutes;
(ii) internal and external correspondence relating to this meeting including with the Department of Public Expenditure & Reform
(iii) records of meetings between the Department and ODPC from 20 September 2016 to September 2017 including dates, attendees, agenda and minutes; and
(iv) correspondence since 16 August 2016 between the Office of the Department's Secretary General and the Data Protection Commissioner. 

The Department identified 20 records as falling within the scope of the applicant's request.  It granted access in full to 15 records and part-granted access to five records (records 1, 3, 10, 11 and 15).  In refusing access in part to five records the Department relied on the exemptions set out in section 30(1)(a) relating to functions of an FOI body, section 31(1)(a) relating to legal professional privilege, section 32(1) relating to law enforcement and public safety, and section 37(1) relating to personal information.

The applicant sought an internal review of that decision and on 11 December 2017 the Department affirmed its original decision.  On 17 December 2017 the applicant sought a review by this Office of the Department's decision.

I have decided to bring this review to a close by way of a formal binding decision. In conducting the review I have had regard to the Department's correspondence with the applicant as outlined above and to the communications between this Office and both the applicant and the Department on the matter. I have also had regard to the contents of the record at issue.

Scope of Review

Record 1 comprises the minutes of a meeting which took place between the Department and ODPC on 18 October 2016. The Department redacted details of the discussions held on the first agenda item. Record 3 comprises email exchanges between Departmental officials in advance of the meeting of 18 October 2016 and an email which emanated from the Department's legal adviser has been redacted. Record 10 comprises email correspondence agreeing the agenda for the meeting of 18 October 2016.

The Department redacted the title of the first agenda item. Records 11 and 15 comprise email exchanges between the Department and the ODPC agreeing the agenda for a further meeting in 2017 and in both records one of the proposed agenda items is redacted.

In the course of correspondence with this Office the Department indicated that it was prepared to release further parts of the records 10, 11 and 15 as follows:

(i) Record 10: part of the title of the agenda item which was discussed at the 18 October meeting ('ODPC update on Investigations ....)
(ii) Record 11: partial release of agenda item  (' .... Investigations')
(iii) Record 15: partial release of agenda item  (' .... Investigations')
This review is concerned solely with whether the Department was justified in redacting the relevant records as outlined under sections 30, 31, 32 and 37 of the FOI Act.  

Preliminary Matters

Section 22(12)(b) of the FOI Act provides that when the Commissioner reviews a decision to refuse a request, there is a presumption that the refusal is not justified unless the public body "shows to the satisfaction of the Commissioner that the decision was justified". Therefore in this case, the onus is on the Department to satisfy this Office that its decision to refuse to grant access to the redacted information was justified.

Analysis and Findings

Section 30(1)(a) - Records 1, 10, 11 and 15
Section 30(1)(a) provides that a public body may refuse to grant a request if it considers that access to the record sought could reasonably be expected to prejudice the effectiveness of tests, examinations, investigations, inquiries or audits conducted by or on behalf of a public body or the procedures or methods employed for the conduct thereof. The provision seeks to prevent two types of harm, namely prejudice to the effectiveness of the tests etc. and prejudice to the methods used for conducting those tests etc.

Where a public body relies on section 30(1)(a), it should identify the potential harm to the function specified in the provision that might arise from disclosure, and consider the reasonableness of any expectation that the harm will occur. It is important for the body to show how the release of the record at issue could reasonably be expected to give rise to the harm identified, i.e. what is it about the particular record or the particular information in the record which, if released, could reasonably be expected to cause the harm envisaged?

Furthermore, where the body considers that access to the record could reasonably be expected to give rise to one or more of the relevant harms, it must also consider whether the public interest would, on balance, be better served by granting than by refusing to grant the request (section 30(2) refers).  In the circumstances of this case, it is worth noting that the prejudice need not be to the tests or methods of the particular body to whom the request was made. The exemption extends to tests etc. of "a" public body, i.e. not necessarily the public body making the decision.

Disclosure of the information redacted from records 1, 10, 11 and 15 would involve the identification of a particular sector of industry. In its submission to this Office, the Department argued that in light of ongoing investigations in the sector, drawing attention to the particular sector could prejudice those investigations. Essentially, it argued that publicity relating to the ongoing investigations would divert scarce resources from the investigatory process as the people who conduct the investigations are the same people who would have to deal with the variety of enquiries that would ensue and resulting delays could cause the ODPC to miss the statutory deadline for initiating prosecutions.

I do not accept the Department's argument. While I do not dispute that the identification of the particular sector could give rise to the Department having to deal with enquiries from a variety of sources, I would expect that the Department would be in a position to take alternative measures to address those enquiries to ensure that the investigations would not be delayed to the extent suggested. In any event, a cursory examination of the website of the ODPC suggests that it has been quite active in investigations concerning the sector in question in recent years.

I find that the Department has not justified its decision to refuse access to records 1, 10, 11 or 15 under section 30(1)(a). As no other exemptions have been cited in respect of records 10, 11 and 15, I find that the Department was not justified in redacting the relevant parts of those records and that they should be released in full.

Section 32(1)(a)(i) - Record 1
Section 32(1)(a)(i) provides that a request may be refused if access to the record sought could reasonably be expected to prejudice or impair the prevention, detection or investigation of offences, the apprehension or prosecution of offenders or the effectiveness of lawful methods, systems, plans or procedures employed for the purposes of such matters.

As with section 30(1)(a), it is important for the body to show how the release of the record at issue could reasonably be expected to give rise to the harm identified, i.e. what is it about the particular record or the particular information in the record which, if released, could reasonably be expected to cause the harm envisaged?

The Department argued that the information contained in point (iii) of agenda item 1 relates to a case which remains under ongoing investigation by the Gardaí.  It stated that the disclosure of the precise information could alert certain individuals outside the Department to the ongoing investigation, allowing them the possibility to pervert the course of justice. I am satisfied that section 32(1)(a)(i) applies to the information contained in point (iii).

Section 32(1) is subject to section 32(3) which provides that consideration must be given to the possibility that the public interest would be better served by the release of the information rather than by it being withheld, in the event that one of three conditions is fulfilled.  I am satisfied that none of those conditions is fulfilled in this case. I find, therefore, that the Department was justified in redacting the information contained in point (iii) under section 32(1)(a)(i).

Section 37(1) - Record 1
Section 37(1) of the FOI Act provides for the refusal of a request where access to the record sought would would involve the disclosure of personal information relating to individuals other than the requester. Section 2 of the FOI Act defines the term "personal information" as information about an identifiable individual that (a) would, in the ordinary course of events, be known only to the individual or his/her family or friends, or (b) is held by a public body on the understanding that it would be treated as confidential.

The Department argued that the disclosure of the information contained in points (iii) and (iv) of agenda item 1 would involve the disclosure of personal information relating to two particular individuals. As I have already found point (iii) to be exempt under section 32(1)(a)(i), I do not need to the consider the applicability of section 37(1) to that point. Point (iv) contains a reference number that the Department assigned to a specific individual. I accept that the information at issue is of a type that would generally be accepted as comprising personal information. For the purposes of the FOI Act, however, the question I must consider is whether the release of the information would involve the disclosure of personal information relating to an identifiable individual.

It seems to me that the disclosure of the reference number would not, of itself, disclose personal information relating to an identifiable individual, nor has the Department explained how it might do so. However, I am satisfied that the point contains sufficiently specific information to allow for the identification of the individual concerned. I find, therefore, that section 37(1) applies to point (iv).

There are certain circumstances, provided for under section 37(2) and 37(5), in which the exemption set out in section 37(1) does not apply. I am satisfied that none of the circumstances identified at section 37(2) arise in this case. Section 37(5) provides that a record, which is otherwise exempt under section 37, may be released if (a) on balance, the public interest that the request should be granted outweighs the public interest that the right to privacy of an individual to whom the information relates should be upheld or (b) the grant of the request would benefit the individual. I do not consider that the release of the information at issue would benefit the individual concerned.

On the matter of whether section 37(5)(a) applies, I must consider whether the public interest in granting the request outweighs, on balance, the public interest in protecting the privacy rights of the individual to whom the information relates.

I accept that there is a strong public interest in enhancing the accountability and transparency of the Department in relation to how it deals with alleged data breaches. On the other hand, the FOI Act also recognises a very strong public interest in protecting privacy rights - in both in the language of section 37 and in the Long Title to the Act (which makes clear that the release of records under FOI must be consistent with "the right to privacy").

It is also worth noting that the right to privacy has a Constitutional dimension as one of the unenumerated personal rights under the Constitution. Privacy rights will therefore be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy. 

In this case, it seems to me that the disclosure of the information in point (iv) would do little or nothing to enhancing the transparency and accountability of the Department in relation to how it has dealt with an alleged data breach. On the other hand, disclosure of the information would involve the disclosure of information of an inherently sensitive nature. I find, therefore, that section 37(5)(a) does not apply. Accordingly, I find that the Department was justified in redacting the information contained in point (iv) under section 37(1).

Other Arguments - Record 1

The Department argued that the release of the information contained in point (v) of item 1 would not be in the public interest as release could lead to misinterpretation. However, it has not identified any specific exemption that it considers to apply. As such, I do not need to consider the Department's argument. Nevertheless, I would point out that this Office does not generally accept that the possibility of the public misunderstanding information is a cause for refusing access to the records of public bodies. Apart from anything else, such an argument seems to be based on an assumption, which this Office does not accept, that public bodies are incapable of explaining their records to the public and are unable to present information to the public in a way which will allow any objective observer to draw accurate and balanced conclusions.

Section 31(1)(a) - Record 3
Section 31(1)(a) is a mandatory provision which provides for the refusal of a request if the record sought would be exempt from production in proceedings in a court on the ground of legal professional privilege. In deciding whether section 31(1)(a) applies, I must consider whether the record concerned would be withheld on the ground of legal professional privilege in court proceedings.
Legal professional privilege enables the client to maintain the confidentiality of two types of communication:

(a) confidential communications made between the client and his/her professional legal adviser for the purpose of obtaining and/or giving legal advice (advice privilege); and
(b) confidential communications made between the client and a professional legal adviser or the professional legal adviser and a third party or between the client and a third party, the dominant purpose of which is the preparation for contemplated/pending litigation (litigation privilege).

The Department argued that section 31(1)(a) applies to the email that was redacted from record 3. It argued that the email contains advice from the Department's legal adviser to other officials. I disagree. In my view, the information concerned cannot reasonably be considered to constitute legal advice. I find, therefore, that the Department was not justified in redacting record 3 under section 31(1)(a) of the Act.

Decision

Having carried out a review under section 22(2) of the Freedom of Information Act 2014, I hereby vary the decision of the Department. I direct full release of all records coming within the scope of the request, with the exception of points (iii) and (iv) of agenda item 1 in record 1. 

Right of Appeal

Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision.  In summary, such an appeal, normally on a point of law, must be initiated by the applicant not later than eight weeks after notice of the decision was given, and by any other party not later than four weeks after notice of the decision was given.

Stephen Rafferty
Senior Investigator