Whether the Department was justified in refusing access to various records regarding an investigation by the Office of the Data Protection Commission into the Public Services Card and related matters under various sections of the Act
18 June 2020
Background
Following correspondence between both organisations, the Office of the Data Protection Commission (the DPC) notified the Department on 27 October 2017 of its decision to commence an investigation of data protection issues relating to the Public Services Card (PSC). The notification outlined that the investigation would include matters relating to:
• the Standard Authentication Framework Environment (SAFE) Registration system,
• the Public Services Identity (PSI) dataset,
• the PSC,
• the Single Customer View (SCV) database, and
• the MyGovID account facility.
On 30 January 2018, the DPC informed the Department that it intended to proceed with the investigation by way of two separate modules. It said Module 1 was to cover:
• the legal basis for processing data in connection with the PSC,
• the appropriateness of the technology and organisational matters employed in relation to security and other personal data processing operations carried out in connection with the PSC, and
• the transparency of information provided to data subjects in relation to the processing of personal data in connection with the PSC.
On 28 August 2018, the DPC issued a draft investigation report (the draft report) to the Department in relation to the matters in question. In a request dated 3 September 2018, the applicant sought access to the following:
1. Records from 1 September 2016 to date relating to communications between the Department and the DPC regarding the PSI dataset, SAFE, the PSC and MyGovID, including;
• the DPC’s investigation into the PSC,
• the DPC’s draft interim report detailing its investigation into the PSC, and
• the DPC’s request that the Department provide a legal basis for the PSC.
2. Records from 1 August 2018 to date of all Departmental discussions, decisions and research regarding the findings within the DPC’s draft interim report, including discussions regarding the legal basis relating to the PSC.
3. A copy of the draft report provided to the Department.
In a decision dated 8 October 2018, the Department part granted the applicant’s request. It identified 54 records, set out in four separate schedules, held by three different business areas relating to the applicant’s request – the Secretary General’s Office (schedules SG1 and SG2), the Business Information Security Unit (BISU) and Client Identity Services (CIS). Of these, it released 31 records in full and refused access to the remaining 21 in full and two in part.
The Department refused access to four of seven records on the SG2 schedule (numbered 2, 4, 6, and 7). It also refused access to 17 of 26 records on the BISU schedule (numbered 1, 5 to 17, 21, 25, and 26) and granted partial access to two of the remaining records (numbered 3 and 20). The draft report was one of the records to which access was refused (record 26 on the BISU schedule). It based its refusal on sections 29(1), 30(1)(a), 32(1)(c), 35(1) and 37(1) of the FOI Act.
The applicant sought an internal review of that decision on 5 November 2018, following which the Department affirmed its original decision. On 19 February 2019, the applicant sought a review by my Office of the Department’s decision. My Office accepted the application for review on 21 February 2019 and submissions were invited from the applicant, the Department and the DPC on the matter. Submissions were received from the Department and the DPC in June 2019.
The Department informed my Office in its submissions that it wished to rely on additional grounds for refusing access to the records at issue. It argued that they were also exempt under section 40 and it also sought to rely on sections 29, 30 and 35 for refusing access to a broader range of the withheld records than it had initially. Ms Murdiff of my Office notified the applicant of the Department’s position and afforded her an opportunity to make additional submissions on the matter.
On 15 August 2019, the DPC issued a final report to the Department in relation to certain, but not all, parts of Module 1 of its investigation. According to the DPC, the final report addresses some of the matters raised in the draft report, including lawful basis and transparency, but does not address other elements of the draft report, such as security. The Department published the final report, along with certain of its correspondence with the DPC and its summary response to the final report.
Ms Murdiff contacted the Department and the DPC and invited them to identify which records remained at issue and to clarify whether it was still the position of both organisations that the records concerned should not be released.
The Department subsequently informed my Office that while it remained of the view that the majority of the withheld records continued to be exempt from release, notwithstanding its publication of the final report, it was no longer claiming exemption for three letters from the DPC, two of which it had already published. As a result, the relevant parts of records 2, 4, and 7 on the SG2 schedule and records 21 and 25 on the BISU schedule will be given no further consideration in this review. The Department also indicated that it considered section 31(1)(a) to apply to the remaining records. The DPC indicated that its position was unchanged in relation to the withheld records.
I have now concluded my review of the Department’s decision. In carrying out my review, I have had regard to the correspondence between the applicant and the Department as outlined above and to the correspondence between my Office and the applicant, the Department, and the DPC on the matter. I have also had regard to the contents of the records concerned. In referring to the records at issue, I have adopted the numbering system used by the Department in the four schedules of records it prepared when processing the request.
Scope of the review
The scope of this review is concerned solely with whether the Department was justified in its decision to refuse to grant access to the following records in full or in part on the basis of sections 29(1), 30(1)(a), 31(1)(a), 32(1)(a), 32(1)(c), 35(1)(a) and (b), 37(1) and 40 of the FOI Act:
BISU schedule:
Refused in full:
• Record 1: Email correspondence between the Department and the DPC
• Record 5-17: Various attachments to the Department’s response to DPS queries
• Record 26: Draft report
Refused in part:
• Record 3: Email response from the Department to the DPC
• Record 20: Email correspondence between the Department and the DPC
SG2 schedule:
Refused in full:
• Record 6: Email threads (including internal and external email correspondence) enclosing various letters from the DPC, including the appendix to the DPC’s letter of 27 October 2017, and a table of the DPC’s provisional findings
Refused in part:
• Record 2: Appendix to the DPC’s letter of 27 October 2017 to the Department comprising requests for information
• Record 4: Internal email thread circulating the DPC’s letter of 31 January 2018
• Record 7: Various internal/external email correspondence forwarding the DPC’s letters and draft report
Analysis and Findings
Schedule 1, Part 1
In its submissions to this Office, the Department argued that the records at issue are not subject to the Act having regard to the fact that for the purposes of the Act, the DPC is a partially included agency only in respect of records concerning the general administration of that Office.
Section 6(2)(a) of the Act provides that an entity specified in Schedule 1, Part 1 of the Act shall, subject to the provisions of that Part, be a public body for the purposes of the Act. Schedule 1, Part 1 contains details of bodies that are partially included for the purposes of the Act as well as details of specified records that are excluded. If the records sought come within the description of the exclusions in Part 1, then the Act does not apply and no right of access exists to such records held by the body.
Schedule 1, Part 1(f) of the FOI Act provides that section 6 does not include a reference to the Data Protection Commissioner or an officer of the Commissioner other than records concerning the general administration of the Office of the Commissioner. In other words, the only records held by the DPC that are subject to the FOI Act are those that concern the general administration of that Office. Records it holds relating to its core functions, such as the carrying out of investigations, are not subject to the Act. However, the exclusion does extend to any such records held by other public bodies.
Under section 46 of the FOI Acts 1997 & 2003, the Act did not apply to certain records relating to specified functions of a number of bodies, regardless of what body held the records. However, under the FOI Act 2014, a number of such bodies are now included in Schedule 1, Part 1 as partially included agencies. While this means that such bodies remain entitled to refuse access to those records that they hold which are excluded under Schedule 1, the exclusion does not extend to such records if they are held by other bodies that are subject to FOI.
The records at issue in this case are held by the Department. As such, I find that they are not excluded from the Act by virtue of Schedule 1, Part 1(f) of the FOI Act.
Section 11(1)
A related argument made by the Department in its submissions is that it does not hold the core investigation documents for the purpose of the Act. The right of access to records, as set out in section 11(1), is confined to records “held” by public bodies. The Department sought to rely on the findings of the Supreme Court in Minister for Health v Information Commissioner [2019] IESC 40 in support of its position.
In that case, the Department of Health refused to grant access to a transcript of an interview the requester had with an independent reviewer, a former High Court judge, who had been appointed by the Minister for Health to carry out a review in relation to certain matters at Our Lady of Lourdes Hospital, Drogheda.
Following the completion of his work, the reviewer, who had set the terms upon which he obtained the relevant information, sealed the transcript with other records and deposited them with the Department of Health for safekeeping. The reviewer stipulated that the boxes of records were not to be disclosed or opened in any circumstances except by court order for discovery, of which he wished to be notified. The issue before the Court was whether the records were held by the Department of Health for the purposes of the FOI Act.
The Supreme Court found that for a record to be held within the meaning of the Act, the public body must not only be in lawful possession of the record in connection with, or for the purpose of, its business or functions but must also be entitled to access the information in the record. In this case, the Department argued that the records centring on the investigation are not truly held by it as they are connected with, or for the purpose of, the business or functions of the DPC in the context of its ongoing investigation. I must admit, I find it very surprising that the Department has sought to argue that it does not hold the records in connection with, or for the purpose of, its functions. It clearly does. While the records relate to the functions of the DPC insofar as they relate to an ongoing investigation being undertaken by that Office, the investigation is concerned with matters relating to the business and functions of the Department. I am satisfied that the Supreme Court judgment cited provides no support for the Department’s arguments that it does not hold the records at issue for the purpose of the Act. I find that the Department holds the records concerned for the purposes of section 11 of the FOI Act.
Section 29
The Department argued that all of the withheld records are exempt pursuant to section 29(1) of the Act (excluding, presumably, the small part of record 20 on the BISU Schedule to which access was refused under section 37(1)). Section 29(1) provides for the discretionary refusal of a request, (a) if the record concerned contains matter relating to the deliberative processes of an FOI body, including opinions, advice, recommendations and the results of consultations considered by the body for the purpose of those processes and (b) the body considers that the granting of the request would be contrary to the public interest.
These are two independent requirements and the fact that the first is met carries no presumption that the second is also met. Furthermore, the public interest test at section 29(1)(b) is a strong test. Any arguments against release should be supported by the facts of the case and it should be shown how release of the record(s) would be contrary to the public interest.
There is nothing in the exemption itself which requires the deliberative process to be ongoing. However, the issue of whether the deliberative process is ongoing or at an end may be relevant to the issue of the public interest.
The first requirement which must be met in order for section 29(1) to apply is that the record must contain matter relating to the ‘deliberative processes’ of an FOI body. The Department said that the deliberative processes concerned were its own, insofar as it was engaged in determining how to respond to the DPC’s questions and to the Draft Report. It argued that section 29 was intended to create breathing space for an FOI body to consider significant issues, such as those at play here. It also stated that the deliberative processes of the DPC were relevant, in terms of its investigation into the PSC and its Draft Report. In support of the Department’s decision, the DPC stated that the records disclose the subject matter of the ongoing investigation, the queries of interest to the DPC, the draft findings of the investigation at a particular stage and the reasons which support these draft findings.
The applicant argued that a regulatory investigation into a public authority could not be considered a “deliberative process”. She contended that the Department was obliged as a matter of law to engage with the DPC’s statutory investigation and that, in essence, this was “far removed” from the intent of section 29 which was to give FOI bodies “thinking space for policy formation”. She also argued that even if there was a deliberative process, it was now at an end.
The records in this case comprise requests for information made during a statutory investigation, information provided in response and a preliminary report setting out draft findings for comment. I note that the DPC issued the draft report of its investigation to the Department for consideration and comment. It was accepted by the DPC that the final report and its findings may be subject to change as a result of the process engaged in between the parties. A deliberative process involves the consideration of various matters with a view to making a decision on a particular matter. It would, for example, include some weighing up or evaluation of competing options or the consideration of proposals or courses of action. In the circumstances of this case, and having regard to the contents of the records at issue, I find that they contain information relating to the deliberative process of both the Department and the DPC. However, for the exemption to apply, release must also be contrary to the public interest.
Section 29(1)(b ) - the public interest
In relation to the issue of the public interest, it is important to have regard to the comments of the Supreme Court in The Governors and Guardians of the Hospital for the Relief of Poor Lying-In Women v. the Information Commissioner [2011] IESC 26 ("the Rotunda case"). It is noted that a public interest ("a true public interest recognised by means of a well-known and established policy, adopted by the Oireachtas, or by law") should be distinguished from a private interest.
The public interest test at section 29(1)(b) is a stronger public interest test than the public interest test in many other sections of the Act which require that, on balance, the public interest would be better served by granting than by refusing to grant the request. The public interest test in section 29(1)(b) requires the FOI body to show that the granting of the request would be contrary to, or against, the public interest. In my view, this exemption tends more strongly towards release of records. Where a body wishes to rely on section 29(1) to refuse access to records, I would expect it to be in a position to explain how release of the records would be contrary to the public interest. Generally speaking, this requires a body to identify a specific harm to the public interest flowing from release.
In its first submission to my Office which was made before the final report was published, the Department acknowledged that there is a public interest in the enhancement of transparency and accountability in relation to the investigation. Nevertheless, it presented a number of arguments in support of its position that release of the records would be contrary to the public interest.
The Department argued that the DPC investigation requires confidential dialogue with the Department so that all provisional findings and Departmental submissions can be considered in full before a final report is compiled by the DPC. It said the dialogue is ongoing and the premature release of the records could pre-empt the direction of the investigation and harm the DPC in its ability to complete its regulatory investigations confidentially. It also argued that release could contaminate the decision making process and undermine the cooperation and candour which is a feature of DPC investigations.
In terms of harm to the Department itself, it argued that premature release of the records could seriously damage the reputation of the PSC in terms of its reliability as a token used to obtain a range of public services in the State. The Department also argued that there is a serious risk to the public’s faith in the PSC should the draft report be released, in circumstances where that may be an unnecessary blow to public confidence, should the ultimate report exonerate the PSC in terms of data protection law.
Among other things, the Department also argued that the release of an incomplete response in an ongoing investigation would not provide the full facts and could be misleading to the public. It said that the public interest would be best served by allowing for the investigation to be completed in a thorough and impartial manner.
In its subsequent submission, the Department said the published final report did not address all aspects of Module 1 of the investigation and that its earlier arguments as to why release of the records would be contrary to the public interest remained relevant. It also contended, in essence, that there was no public interest in the release of a draft report which contained opinions and positions which had changed, in circumstances where the final report had been published.
When asked to identify the particular information in the records concerned which it considered should not be released following the publication of the final report, the Department argued that the information in the draft report relating to the published and unpublished elements of the DPC’s investigation were so intertwined that the records could not be released without revealing details of the parts of the investigation which are still underway.
The Department further argued that while the final report has been published, the effect on future decision-making must be considered. It argued that if confidential draft DPC reports containing provisional findings and requests for further information are subject to release, this would stifle and contaminate such decision-making.
The DPC advanced similar arguments in support of the Department’s reliance on section 29(1) to refuse access to the records at issue. Among other things, it argued that there is an integrity to the investigative process which should be preserved by allowing it to be conducted without detailed public scrutiny of the documents.
The DPC also argued that account should be taken of its status as a partially included agency under Schedule 1 and of the fact that records of a DPC investigation could not be obtained directly from the DPC as they are excluded from the FOI Act. It argued that the status of such documents in the hands of the DPC amounts to a recognition that the investigative work of the DPC should be treated as confidential and should not be subject to public scrutiny whilst any investigation is ongoing. It said it is necessary for the DPC to communicate with the organisation under investigation as a matter of fair procedures and it argued that the public interest should weigh against disclosure by the body under investigation, reflecting the way in which the Act has dealt with those same records in the hands of the DPC.
The DPC noted that the investigation in question may result in regulatory consequences for the Department. It argued that it is a matter of fundamental importance that the process should be able to proceed without outside scrutiny and consequently, that the core documents pertaining to the ongoing investigation should not be released for public dissection or comment. It said the DPC was in no different position than any other body with investigative and sanction powers, such as the Gardaí, the Director of Public Prosecutions, the Competition and Consumer Protection Commission, or the Commission for Communications Regulation and that the Department was in no different position than other organisations that might be the subject of such investigations, namely that the records which document the investigation and responses to the investigation are not matters or public record and nor should they be.
The DPC further argued that in relation to the public debate surrounding the PSC, the public interest is fully met by the publication of the final report, which it described as hugely detailed and fully reasoned. It said the public interest would be met in the future by publication of the DPC’s future final reports on the outstanding issues under investigation when those reports are ready. It said the draft and final reports are different in context and nature and that the draft report deals with matters that are still under consideration. It argued that it would not be appropriate to release a record of matters being considered as part of an investigation which does not reflect the final outcome of that investigation and that release is likely to invite unnecessary and misinformed public commentary about issues which have been the subject of additional analysis and revision by the DPC, as reflected in the final report. It argued that it would not be helpful to public debate or in the public interest to release draft documents which recorded matters at an interim stage of the investigation and which had not, at that point, taken account of the Department’s subsequent submissions on the matter covered in the draft report.
The applicant argued that the Department had not demonstrated how it would be contrary to the public interest to grant access to the records sought. She also argued that the PSC may be one of the most controversial projects ever undertaken by the Department and that there was a huge public interest in having access to information about that project.
I have carefully considered all of the detailed arguments presented in relation to the public interest. The records at issue are concerned with an investigation by the DPC of data protection issues concerning the use of the PSC. Both the Department’s development of the PSC and the DPC’s investigation have attracted a significant degree of public attention. While the Department argued that the development of the PSC has been welcomed by the public and that this is reflected in its research, it also acknowledges that critics have raised concerns relating to the transparency of information provided in respect of the PSC and its legal basis. As such, it seems to me that the public interest in enhancing the transparency and accountability of the Department in relation to those matters is quite significant.
However, the particular circumstances arising in this case are worthy of further scrutiny. The records at issue concern a stage in the DPC’s investigations where the parties have essentially set out their respective positions on the key issues and where those positions are subject to clarification, challenge, and debate. In my view, there is some merit in the argument that there is a strong public interest in preserving the integrity of the DPC’s investigative process by allowing it to be conducted without detailed public scrutiny of the relevant documents at all stages of the process.
I fully accept that the premature release of information that may or may not end up as a relevant factor that contributed to the formulation of the final report of the investigation would act as a considerable hindrance to the willingness and/or ability of the parties to engage in open and candid exchanges during the course of the investigation. In my view, such open and candid exchanges are a very important part of the process for a number of reasons, including the need to ensure that the principles of fair procedures are followed. As such, it seems to me that the public interest in enhancing accountability around the issues that are the subject of investigation can generally be best served by the publication of the outcome of the investigation, when the issues have been fully teased out and thoroughly considered by both sides. It is also relevant in this case that the draft report and, indeed, some of the correspondence between the parties, contains matters that are not included in the published final report as the relevant part of the investigation has yet to be concluded.
In my view, the public interest in the enhancement of the transparency and accountability of the Department has already been served to a significant extent having regard to the significant amount of information published to date. Indeed, the publication of the final report has certainly significantly enhanced transparency around the position of both parties concerning the legal basis for processing data in connection with the PSC and the transparency of information provided to data subjects in relation to the processing of personal data in connection with the PSC. While this does not mean that no further enhancement of transparency or accountability is required, it is, however, a relevant factor when considering whether release of the records at issue would be contrary to the public interest.
The DPC’s arguments concerning the status of its core records under the FOI Act are also worthy of consideration, i.e. that as a partially included agency, records concerning its core functions could not be obtained directly from the DPC as they are excluded from the Act and that the status of such documents in the hands of the DPC amounts to a recognition that its investigative work should be treated as confidential and should not be subject to public scrutiny whilst any investigation is ongoing. I must admit that it is difficult to comprehend why the Oireachtas saw fit to exclude records relating to the core functions of the DPC from the Act when in the possession of the DPC but not when they are in the possession of other public bodies. Nevertheless, whatever its reasons for not excluding such records as a class, it seems to me that the Oireachtas clearly considered that records relating to the DPC’s core functions are worthy of a higher level of protection than other non-core related records. As such, I consider that the status of the records is also relevant when considering whether their release would be contrary to the public interest.
Having carefully considered the matter and the particular circumstances arising, and having regard in particular to the fact that the final report of the investigation, which is comprehensive and detailed, is publicly available, I find that the release of the records at issue would be contrary to the public interest. I find, therefore, that section 29(1) applies and that the Department was justified in refusing access to the records in question. Having found section 29(1) to apply, I do not deem it necessary to consider the applicability of the other exemptions cited to the records in question.
Section 37
Section 37(1) of the Act provides for the refusal of a request where access to the record sought would involve the disclosure of personal information relating to third parties. The relevant part of record 20 on the BISU Schedule is concerned with the personal circumstances of a member of the staff of the Department. As such, I find that section 37(1) applies and that none of the other provisions of section 37 serve to disapply subsection (1). I find, therefore, that the Department was justified in refusing access to the relevant part of record 20 under section 37(1).
Decision
Having carried out a review under section 22(2) of the Freedom of Information Act 2014, I hereby affirm the Department’s decision to refuse access to the records described in the section above entitled “Scope of the Review” under sections 29(1) and 37(1) of the FOI Act.
Right of Appeal
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.