Whether TII was justified under various exemptions in the FOI Act, in refusing in part the applicant’s request for access to records concerning internal audit reports

31 July 2019

Background

On 11 September 2018, the applicant made a request for access to records relating to three internal audit reports conducted by TII. TII granted access to parts of the records and withheld information on the basis of sections 30(1)(a), 36(1)(b) and (c) and 37(1) of the FOI Act. Following an application for an internal review, TII affirmed its original decision. On 8 November 2018, this Office received an application for review from the applicant.

In conducting this review I have had regard to the submissions of TII and the applicant and to correspondence between the applicant, TII and this Office. I have also had regard to the provisions of the FOI Act. I consider that the review should now be brought to a close by the issue of a formal, binding decision. During the course of the review, a number of companies were notified as affected third parties and were invited to make submissions on the matter. I have also taken the submissions received into account.

Preliminary Matters

Section 13(4) of the Act requires that, subject to the Act, any reasons a requester gives for making a request shall be disregarded. This means that the applicant's motivation cannot be considered except insofar as this might be relevant to the consideration of public interest provisions.

I draw attention to the extent to which it is feasible to provide access to parts of records while refusing access to the remaining parts. Section 2 of the FOI Act defines "record" as including "anything that is a part or a copy" of a record.  Section 18 of the Act provides for the deletion of exempt information and the granting of access to a copy of a record with such exempt information removed.  This should be done where it is practicable to do so and where the copy of the record thus created would not be misleading. However, the Commissioner takes the view that neither the definition of a record nor the provisions of section 18 envisage or require the extracting of particular sentences or occasional paragraphs from records for the purpose of granting access to those particular sentences or paragraphs. Generally speaking, therefore, the Commissioner is not in favour of the cutting or "dissecting" of records to such an extent.

Although I am obliged to give reasons for my decision, section 25(3) requires all reasonable precautions to be taken in the course of a review to prevent disclosure of information contained in an exempt record. This means that the description which I can give of the records at issue and the material that I can refer to in the analysis is limited. The release of a record under the FOI Act is considered, effectively, as release to the world at large.

Scope of Review

This review is concerned solely with whether the decision of TII to refuse in part the applicant's request under sections 30(1)(a), 36(1)(b) and (c) and 37(1) of the FOI Act was justified.

Analysis and Findings

Section 30(1)(a) (prejudice to effectiveness of tests etc.)
Section 30(1)(a) is a discretionary exemption, which provides that a head may refuse to grant an FOI request if access to the record concerned could, in the opinion of the head, reasonably be expected to "prejudice the effectiveness of tests, examinations, investigations, inquiries or audits conducted by or on behalf of an FOI body or the procedures or methods employed for the conduct thereof". This is subject to section 30(2) which provides that the exemption shall not apply where, in the opinion of the head concerned, the public interest would, on balance, be better served by granting than by refusing to grant the FOI request concerned.

Section 30(1)(a) is a harm-based provision. Where an FOI body relies on section 30(1)(a) it should: identify the potential harm in relation to the relevant function specified that might arise from disclosure and, having identified that harm, consider the reasonableness of any expectation that the harm will occur. The FOI body should explain how and why, in its opinion, release of the record(s) could reasonably be expected to give rise to the harm envisaged. A claim for exemption under section 30(1)(a) must be made on its merits and in light of the contents of each particular record concerned and the relevant facts and circumstances of the case.

The withheld information in the records is the 'Findings' and the 'Contract Findings' in the 2017 audit reports 'TII-IA 16 - Contract Change Orders' and 'TII-IA 24 - Procurement' and the 'Findings' only in the audit report 2017 for 'TII-IA 18 - Land/Property Management'.

TII was established through a merger of the National Roads Authority and the Railway Procurement Agency. It stressed the importance of the audit function generally and said that the audit reports, conducted in 2017, were part of a planned and systematic overall review to ensure the efficient integration of the systems and processes in place in the newly merged organisation. It said that its internal audits can identify areas of concern which are presented in a balanced way to its management and that the audit reports are an invaluable tool for senior management in identifying issues and the appropriate strategies to address those issues. TII said that if the level of detail contained in its Findings (which it regarded as "forensic") is made publicly available, this would "dilute the level of detail provided to Management" and would deprive senior management of essential data and information which is needed to enable strategic and operational level decisions to be made. TII said that this would have potential consequences for its ability to monitor and fulfil its corporate governance obligations. It said that this would prejudice the effectiveness of future audits and the methods employed in conducting such and that there is a material risk that key deliverables will not be achieved. TII emphasised that the FOI Act specifically recognises the importance of internal audit and that section 30(1)(a) did not require that “significant” or “substantial” harm would occur in order for the exemption to be engaged. It listed details of the harms envisaged if the findings were released, including impacts on management and staff at various levels.

Having examined the withheld information and what it reveals, I consider that it is of a very detailed nature both in relation to the specific processes of TII’s various divisions and the methodology and procedures employed in the audit. I cannot accept that the findings in internal audits generally are protected as a class. There is no “blanket” exemption for audits conducted. That said, I am satisfied in this instance on the basis of the information provided that TII has a reasonable expectation of prejudice to the effectiveness of its internal audit process and the methods employed for its conduct if the specific findings were to be released to the world at large. I am satisfied that TII has identified potential harms to the effectiveness of its audits and/or to the procedures employed and demonstrated how it expects such harms to occur. I would add that this does not mean that I accept that each and every one of the harms identified by TII could reasonably be expected to occur. I find that section 30(1)(a) applies to the redacted audit findings.

Section 30(2) - the public interest
In view of this finding, I am required to apply the public interest balancing test under section 30(2) of the FOI Act.

On the one hand, section 30(1)(a) itself reflects the public interest in FOI bodies conducting tests and examinations effectively. On the other hand, there is a public interest in transparency around the way in which TII carries out its functions. Section 11(3) of the FOI Act requires FOI bodies to have regard to the need to achieve greater openness in their activities and to strengthen their accountability and improve the quality of their decision-making.

The applicant said that he believes it is in the public interest for the audit findings to be released, so that there can be a full and comprehensive understanding of how TII operates and spends public money. He said that while he knows the conclusions and recommendations contained in the audit reports, he does not have access to the details on which they were based. He said that the various findings led to numerous recommendations with High or Moderate Priority ratings. He stressed that TII had oversight and control over “billions” of taxpayers’ money.

TII said that it had regard to the importance of internal audits and corporate governance obligations and that it acknowledges consideration of the public interest and the need for openness and transparency. It said that while the 'Findings' sections of each report are redacted, they are summarised and form the basis for the reports' 'Recommendations and Management Action Plans' which it said were released in full in the "Scope and objectives, Recommendations and Action Plan sections" in each of the reports.

It seems to me that the applicant’s arguments go to the importance of having the details underlying the findings of the audit in the context of accountability by TII in its use of public monies.

I acknowledge that there is a significant public interest in openness and transparency as regards how public bodies carry out their functions. Nonetheless, I consider that considerable weight must be afforded to the importance of having robust systems in place to identify and mitigate financial and other risks and to ensure the proper management of a public body’s functions and finances. Furthermore, I am of the view that the records as released including the recommendations have gone some way towards satisfying the public interest in openness and transparency in how TII carries out its functions. On balance, I consider that the public interest does not weigh in favour of release of the level of detail in the withheld information in this case. Accordingly, I find that the decision of TII to refuse to grant access to the withheld information in the records concerned is justified on the basis of section 30(1)(a) of the FOI Act.

In regard to my finding above, arguably it would be possible to identify certain relatively small parts of the withheld material which, if released, would be less likely than others to result in prejudice to the effectiveness of future audits or to the methods employed in internal audit. I considered whether it would be feasible to direct the release of such parts. Having regard to section 18 of the FOI Act explained above and the detailed nature of the various audit findings, I concluded that, even if it were practicable to isolate such parts by extracting certain words and sentences, the resulting redacted records would be misleading when taken out of context in the light of the audit findings as a whole (section 18(2) of the Act refers). Being “practicable” necessarily means taking a reasonable and proportionate approach to determining whether to grant access to parts of records.

Section 36 (commercial sensitivity)
TII relied on sections 36(1)(b) (commercially sensitive information) and 36(1)(c) (prejudice to outcome or conduct of negotiations) in relation to appendix 2 and appendix 3 contained in the record 'TII-IA 18 - Land/Property Management'. The information in the appendices refers to licences and leases which were examined as part of the audit report process.

Section 36(1)(b) must be applied to certain types of information whose disclosure could reasonably be expected to result in material financial loss or gain to the person to whom the information relates, or could prejudice the competitive position of the person in the conduct of his or her profession or business or otherwise in his or her occupation. The essence of the test in section 36(1)(b) is not the nature of the information but the nature of the harm envisaged.

The harm test in the first part of section 36(1)(b) is that disclosure "could reasonably be expected to result in material loss or gain". I take the view that the test to be applied is not concerned with the question of probabilities or possibilities but with whether the decision maker's expectation is reasonable. As such, a basis for a claim that such harm could reasonably be expected to result from disclosure of the particular information in the record(s) at issue should be shown by an FOI body or a third party relying on this provision.

The harm test in the second part of section 36(1)(b) is that disclosure of the information "could prejudice the competitive position" of the person in the conduct of their business or profession. The standard of proof to be met here is considerably lower than the "could reasonably be expected" test in the first part of this exemption.  However, this Office takes the view that, in invoking "prejudice", the damage which could occur must be specified with a reasonable degree of clarity.

In the High Court case of Westwood Club v The Information Commissioner [2014] IEHC 375 Cross J. held that it is not sufficient for a party relying on section 36(1)(b) to merely restate the provisions of the section, list the documents and say that they are commercially sensitive. A party opposing release should explain why disclosure of the particular records could prejudice their financial position. Furthermore, a general prediction without any supporting evidence is not sufficient to satisfy the requirement that access to the record could reasonably be expected to result in the outcome envisaged. In the Supreme Court case of Sheedy v the Information Commissioner ([2005] 2 I.L.R.M. 374, [2005] 2 IR 272, [2005] IESC 35) Kearns J stated that "[a] mere assertion of an expectation of [prejudice] could never constitute sufficient evidence in this regard”.

In its submission, TII said the information in the appendices referred to commercial contracts. It said that release of the information would compromise TII's ability to ensure value for money and would harm and undermine existing and future competitive negotiation processes. It also said that release of the information would prejudice TII's future marketing and sale processes and that competing private interests would gain an unfair competitive advantage. It also stated that in meeting the public interest and in consideration of openness and transparency it had granted access in full to several sections of each record.

As mentioned earlier, this Office also wrote to 13 third parties who were invited to make submissions on the matter of the exemption of the information in the appendices on the basis of section 36. All of the companies are referred to in the appendices as licensors in agreements with TII. Six companies made submissions to this Office. All of the companies who responded said that the information was commercially sensitive citing such concerns as their competitive position vis-à-vis others who might be seeking similar terms. One argued that the information about its particular circumstances was personal information and exempt under section 37.

On examination of the appendices containing the withheld information, two particular issues are evident – firstly, very little detail appears about either the business models involved or the terms of leases/licences between the companies and TII.  Secondly, the financial details comprise amounts of rental paid to TII as opposed to, say, expenditure by a public body on goods or services. The standard of proof necessary to meet the second part of the test in section 36(1)(b) (could prejudice the competitive position etc.) is relatively low.  Therefore, I am prepared to accept that in Appendix 2, the fee (column 5) and licence period (column 6) and in Appendix 3, the rental fee (column 5) and the lease period (column 6) could, if disclosed, be reasonably expected to prejudice the competitive position of the licence and leaseholders, if, for example, a competitor seeks to negotiate a similar arrangement with the public body.

I find that section 36(1) of the Act applies to the information in Appendix 2 in column 5 (fee) and in column 6 (licence period) and Appendix 3 in column 5 (rental fee) and in column 6 (lease period) in the record 'TII-IA 18 - Land/Property Management'.

While I note that some of the licences and leases appear to have expired, I have no information on whether these have been renewed in the interim by the same or other parties and, if so, on what terms.

Having carefully considered the arguments of both the companies and TII in the context of the limited remaining information, I do not see any basis for accepting that release of the companies’ identities and description/location of the business premises could reasonably be expected to result in prejudice to the competitive position of the parties to licences or leases. I consider that the location details/description of the business are either in the public domain and obvious due to the nature of the business or are of such a general, high level nature that prejudice to the security and other concerns expressed by some companies cannot reasonably be expected to arise from their release. As regards TII’s position, having considered its submission, I do not accept that the possible prejudice it envisages would result from release of the company names and business description/location.

I find that the details in Appendix 2 in columns 1, 2, 3 and 4 and in Appendix 3 in columns 1, 2, 3 and 4 in the record 'TII-IA 18 - Land/Property Management' are not exempt under section 36(1)(b).  

For completeness, I find that the information relating to the companies in these appendices is not, in this instance, personal information to which section 37 of the Act might apply.

Section 36(2)
I do not consider any of the exceptions in section 36(2) to apply in this case. 

The public interest – section 36(3)
Section 36(3) provides that subsection (1) does not apply where the public interest would, on balance, be better served by granting than by refusing to grant the FOI request. Having found that the lease/licence periods and fees/rental paid are exempt under section 36(1)(b) I must apply the public interest balancing test.

The FOI Act is concerned primarily with the promotion of transparency and accountability in public bodies. There is a public interest in ensuring that public bodies manage assets and fulfil any commercial remit that they might have.

I am satisfied that the public interest in how TII carries out its functions in relation to the internal audit and to property management insofar as these records are concerned is served to some extent by the information already released and directed for release.  This includes the identities of the lessors/licencees and details of the businesses with which the public body is involved in commercial transactions.

However, it seems to me that details of fees paid by the companies and the duration of their licences and leases are primarily related to their commercial interests and I consider that there is a strong public interest in allowing private enterprises to operate without being commercially disadvantaged. On balance, I find that the public interest in granting access to the details of fees and the duration of licences and leases does not outweigh the public interest in protecting the competitive positions of the third parties.

As regards section 36(1(c), I am not satisfied that either the companies or TII identified any specific contractual or other negotiations that are in train or reasonably foreseen that might be affected by the disclosure of the description/location of the businesses nor has it been explained to me how release of the location and nature of the businesses at issue could prejudice negotiations. I find that those parts of the records are not exempt under section 36(1(c). Given my finding under section 36(1)(b) that the amount of rental and duration of the leases involved is exempt, there is no need for me to consider 36(1(c) in relation to those parts of the records.

Section 37 (personal information)
TII relied on section 37(1)(Personal information) in relation to appendix 4 in the record 'TII-IA-18 - Land/Property Management'. The information refers to 'Residential Lettings Examined'.

Section 37(1) of the FOI Act, subject to other provisions of section 37, provides for the mandatory refusal of a request if access to the record concerned would involve the disclosure of personal information relating to an individual or individuals other than the requester. For the purposes of the Act, personal information is defined as information about an identifiable individual that (a) would, in the ordinary course of events, be known only to the individual or their family or friends or, (b) is held by a public body on the understanding that it would be treated by it as confidential. The Act details fourteen specific categories of information that is personal information, without prejudice to the generality of the foregoing definition, including "(xii) the name of the individual where it appears with other personal information relating to the individual or where disclosure of the name would, or would be likely to, establish that any personal information held by the public body concerned relates to the individual". 

TII said that release of the information could reasonably be expected to lead to the identification of social housing units in a private development. Having regard to the definition of personal information as set out above, I am satisfied that the withheld information could easily be linked to the names of the occupants of those units and thus disclose the personal information of those individuals. The withheld information in the record also discloses the rent paid by those occupants. I find, therefore, that section 37(1) applies to the withheld information. 

Section 37(2) of the FOI Act sets out certain circumstances in which section 37(1) does not apply. I am satisfied that none of those circumstances arise in this case.

Section 37(5) – the public interest

Section 37(5) of the FOI Act provides that a request that would fall to be refused under section 37(1) may still be granted where, on balance, (a) the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or (b) the grant of the information would be to the benefit of the person to whom the information relates.

I am satisfied that the release of the information at issue would not be to the benefit of the individuals concerned and that section 37(5)(b) does not apply.

In relation to paragraph (a), I must consider whether the public interest in granting the request outweighs, on balance, the public interest in protecting the right of privacy of the individuals to whom the information relates.

On the matter of where the public interest lies, I have had regard to the comments of the Supreme Court in The Governors and Guardians of the Hospital for the Relief of Poor Lying-In Women v The Information Commissioner,[2011] 1 IR 729, [2011] IESC 26) (the Rotunda case). It is noted that a public interest ("a true public interest recognised by means of a well known and established policy, adopted by the Oireachtas, or by law") should be distinguished from a private interest. Although these comments were made in relation to another provision of the FOI Act, I consider them to be relevant to consideration of public interest tests generally.

As I stated earlier in relation to section 36, the FOI Act itself reflects a public interest in ensuring the openness and accountability of public bodies regarding how they conduct their business. On the other hand, the FOI Act recognises a very strong public interest in protecting privacy rights in the language of section 37. It is also worth noting that the right to privacy also has a Constitutional dimension as one of the unenumerated personal rights under the Constitution. Privacy rights will therefore be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy.

The question I must consider is whether the public interest in the release of the third party personal information contained in the record outweighs, on balance, the significant public interest in protecting the privacy rights of the third parties to whom the information relates.

I cannot identify a public interest which would override the Constitutional rights to privacy of the third parties to whom the withheld information in the record relates. I find that the right to privacy of the individuals whose personal information is in the record outweighs the public interest in granting the applicant's request.

Accordingly, I find that TII was justified in withholding the information in appendix 4 of the record 'TII-IA-18 - Land/Property Management' on the basis of section 37(1) of the FOI Act. 

Decision

Having carried out a review under section 22(2) of the Freedom of Information Act 2014, I hereby vary the decision of TII as follows:

• I affirm its decision to refuse access to information identified above and Findings and Contract Findings in records on the basis of section 30(1)(a) of the FOI Act.
• I affirm its decision to refuse access to information in Appendix 4 described above the basis of section 37(1) of the FOI Act.
• I vary TII's decision to refuse access to information in parts of Appendix 2 and Appendix 3 identified above under section 36 and I direct the release of the information (i.e. company names and business description/location in columns 1, 2, 3 and 4).

Appeal

Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision.  In summary, such an appeal, normally on a point of law, must be initiated by the applicant not later than eight weeks after notice of the decision was given, and by any other party not later than four weeks after notice of the decision was given.

 

 

 

 

Elizabeth Dolan

Senior Investigator