Whether the HRCDC was justified in refusing access to records relating to a consent declaration, under sections 36(1)(b) and 37(1) of the FOI Act

23 February 2021

Background

By way of context, the HRCDC considers applications for consent to conduct health research using personal data without the consent of the individual concerned. On 21 February 2020, the applicant made an FOI request to the HRCDC for the application form and supporting documents on a specified case, as well as a copy of the declaration or other decisions of HRCDC relating to that case. On 30 March 2020, the HRCDC issued a decision. It refused access to the records under section 29 of the FOI Act. On 30 March 2020, the applicant applied for an internal review. On 17 April 2020, the HRCDC issued an internal review decision. It varied its original decision by refusing access to the records under sections 29 and 30 of the FOI Act. On 28 April 2020, the applicant sought a review of that decision.

In conducting my review, I have had regard to the correspondence between the applicant and the HRCDC as outlined above and to the correspondence between this Office and both parties, as well as the content of the records that were provided to this Office by the HRCDC for the purposes of this review. I have also had regard to submissions obtained from a third party. Finally, this review process has taken longer than I would have liked and I extend my apologies to the parties for this.

Scope of this Review

During the review process, on 4 June 2020, the HRCDC granted access to certain information and refused access to the remaining information under sections 36(1)(b) and 37(1) of the FOI Act. It provided the applicant with an updated schedule. On 9 July 2020 the HRCDC then granted access to further information. Moreover, the applicant confirmed that it does not seek access to handwritten signatures, the parts of the email addresses that come before the “@” symbol or to direct or mobile telephone numbers. Having regard to the above, the following records now fall outside the scope of this review: Records 2(3c), 3(3a), 4(3b), 5(2b) and 6(2a).

The question for me is whether the withheld information in Records 1(3d), 7(1) and 8(3e) within the scope of this review is exempt under sections 36(1)(b) and 37(1) of the FOI Act. I have numbered the records in the order in which they appear on the HRCDC’s excel schedule, with the marked numbers in parentheses.

Preliminary Matters

Before considering the exemptions claimed, I wish to note the following points. First, my jurisdiction under section 22 of the FOI Act is to make a new decision, in light of the facts and circumstances as they apply on the date of the review. The Courts have endorsed this approach.

Secondly, while I am required to give reasons for my decision under section 22(10) of the FOI Act, I am also required to take reasonable precautions to prevent disclosure of information in an exempt record, under section 25. This means that the extent to which I can describe the records and the level of detail I can discuss in my analysis are limited.

Thirdly, with certain limited exceptions, the FOI Act does not provide for the limiting of access to records to particular individuals only (e.g. section 37(2)), which I consider below). When a record is released under the FOI Act, it effectively amounts to disclosure to "the world at large" (H.(E.) v Information Commissioner [2001] IEHC 58). The FOI Act places no restrictions on the type or extent of disclosure or the subsequent use to which the record may be put.

Finally, I note that the HRCDC advised the applicant that in order to process the FOI request, it required a named individual (rather than a group or organisation) to submit it. The HRCDC pointed to the use of the term “person” in section 12(1) of the FOI Act. For the avoidance of doubt, section 18 of the Interpretation Act 2005 provides that when reading legislation, the term “person” shall be read as importing a body corporate (whether a corporation aggregate or a corporation sole) and an unincorporated body of persons, as well as an individual. Accordingly, those exercising their right of access under the FOI Act are not required to identify a named individual, contrary to what the HRCDC advised the applicant in this case.

Analysis and Findings

Section 36(1) - Commercial Sensitivity

The HRCDC claims that section 36(1)(b) of the FOI Act applies to the withheld information in Records 7(1) and 8(3e) (except the withheld names of individuals in Record 7(1), which I consider under section 37 below). Section 36(1)(b) provides that an FOI body shall refuse to grant an FOI request if the record concerned contains financial, commercial, scientific or technical or other information whose disclosure could reasonably be expected to result in a material financial loss or gain to the person to whom the information relates, or could prejudice the competitive position of that person in the conduct of his or her profession or business or otherwise in his or her occupation. The harm test in the first part of section 36(1)(b) is that disclosure "could reasonably be expected to result in material loss or gain". This Office takes the view that the test to be applied is not concerned with the question of probabilities or possibilities but with whether the decision maker's expectation is reasonable. The harm test in the second part of section 36(1)(b) is that disclosure of the information "could prejudice the competitive position" of the person in the conduct of their business or profession. The standard of proof to be met here is considerably lower than the "could reasonably be expected" test in the first part of this exemption. However, this Office takes the view that, in invoking "prejudice", the damage which could occur must be specified with a reasonable degree of clarity. As the Supreme Court observed in The Minister for Communications, Energy and Natural Resources and the Information Commissioner & Ors [2020] IESC 57, it is not sufficient for the FOI body to merely assert that disclosure could prejudice its competitive position; an FOI body must also have a reasonable basis for that position.

Section 36(1) does not apply if the public interest would, on balance, be better served by granting rather than refusing the request (section 36(3) refers).

Submissions

The HRCDC says that the records relate to a third party commercial entity. It says that they relate to the study design and methodology developed and implemented by that entity, as well as its internal security measures. It submits that this information is not in the public domain and could potentially facilitate other parties in developing similar studies for their own purposes. It submits that releasing scientific and technical information could prejudice the third party’s competitive position as a commercial company. It says that the public interest does not extend to releasing scientific and technical on the study design and the protection of data, to such a degree that it outweighs the withholding of this commercially sensitive information. It says that if applicants feel they cannot provide what they believe to be commercially sensitive information relevant to their application, it may affect the quality of applications and the FOI body’s decision-making process.

During the review, the Investigator consulted the relevant third party company. The third party says that the records contain sensitive technical details and proprietary methods, the disclosure of which would benefit competitors who are developing research programmes with similar objectives. They say that disclosure would dilute intellectual property rights in their processes and methodologies, which would impact the conduct of their business and prejudice their competitive position. They submit that the public interest is not best served by disclosing technical and proprietary information.

The applicant says that section 36(2)(d) of the FOI Act applies, as the third party would have been aware that the information was of a category that may be disclosed under FOI. Regarding the public interest, the applicant submits that it is relevant that the approval procedure is intended to substitute a requirement for explicit consent under GDPR. It says that a data controller cannot impose conditions on a person giving consent and the information supplied by the third party is information it would have to disclose to a data subject without imposing conditions. It further submits that significant weight should be given to transparency in relation to a consent declaration that allows the processing of special category personal data without explicit consent. The applicant says that many people may be affected by the consent declaration and should be made aware as far as possible of the basis for it.

Analysis and Findings on section 36

The withheld information on page 73 of Record 7(1) and page 1 of Record 8(3e) outlines the types of personal data which the study will collect. That information is already disclosed on page 5 of Record 7, which was released to the applicant. I therefore do not accept that releasing it elsewhere would “disclose” the information concerned. In any event, having examined its content, I am not satisfied that its release could prejudice the competitive position of the company, or could otherwise result in the harms alleged. I find that section 36(1)(b) does not apply to the withheld information on page 73 of Record 7(1) and page 1 of Record 8(3e). I find that the HRCDC was not justified in refusing access to this information under section 36(1)(b) of the FOI Act.

The remaining information comprises detailed information on the study’s methodology and the company’s measures to protect personal data, including the company’s anonymisation methods and internal information security measures. I have examined this information and the parties’ submissions and had regard to the nature of the third party’s business. I am satisfied that its release could prejudice the competitive position of the company by being disclosed to the world at large and therefore potentially benefitting competitor companies who are developing similar programmes. I find that section 36(1)(b) applies to the remaining information.

Section 36(2)

Section 36(2) provides for the release of information to which section 36(1) is found to apply in certain circumstances. I am satisfied that none of the circumstances identified at section 36(2) arises in this case. The applicant says that section 36(2)(d) of the FOI Act applies, as the third party would have been aware that the information was of a category that may be disclosed under FOI. Section 36(2)(d) provides that an FOI body shall grant the FOI request if the information contained in the record was given to the FOI body concerned by the person to whom it relates and the person was informed on behalf of the body, before its being so given, that the information belongs to a class of information that would or might be made available to the general public. The HRCDC says that it has a remit to publish an overview of basic information outlining the research study, but it would not publish technical and detailed scientific information. It says that before commercially sensitive information was given to the HRCDC, the third party was not informed that the information belongs to a class of information that would, or might be, made available to the general public. In the circumstances, I have no basis on which to find that section 36(2)(d) applies.

Section 36(3)

Section 36(3) of the FOI Act requires me to consider whether, on balance, the public interest would be better served by granting than by refusing the request. On the one hand, section 36 itself recognises the public interest in protecting commercial sensitivity. In this case I accept that there is a public interest in protecting commercially sensitive information relating to the company’s competitive position, which also facilitates the HRCDC approval process in allowing companies to submit information relevant to their application. On the other hand, I must consider whether there is a public interest in disclosing the specific content of the remaining information. In carrying out any review, this Office has regard to the general principles of openness and transparency set out in section 11(3) of the FOI Act. Section 11(3) provides that an FOI body must have regard to the need to achieve greater openness in the activities of FOI bodies and to promote adherence by them to the principles of transparency in government and public affairs and the need to strengthen the accountability and improve the quality of decision making of FOI bodies. However, it is important to note that in The Minister for Communications, the Supreme Court found that a general principle of openness does not suffice to direct release of records in the public interest and “there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure”.

The applicant submits that the third party would have had to disclose the information it supplied to the HRCDC, regarding processing of special category data, to a data subject without imposing conditions. I do not consider that it is my remit to determine whether the third party might have been obliged to disclose any or all of the information to data subjects under the GDPR. My function is to decide whether the information is exempt under the FOI Act. The applicant also submits that there is a significant public interest in transparency around the consent declaration and its basis. As the Supreme Court found in The Minister for Communications, the question for me is whether the public interest that might be gained or lost by the release of the specified documents having regard to their content, might for reasons relevant to the document and the record and their contents, be better served by either release or refusal.  

The remaining information discloses detailed information on the study’s methodology and the company’s measures to protect personal data, including the company’s anonymisation methods and internal information security measures. I find no relevant public interest in granting access to the specific content of these records which on balance outweighs the public interest in protecting its commercial sensitivity. As stated in previous decisions, the Commissioner takes the view that the FOI Act was designed to increase openness and accountability in the way in which public bodies conduct their operations; generally speaking, it was not designed as a means to open up the operations of private enterprises to scrutiny. I see no basis for concluding that it would serve the public interest to grant access to the information at issue in the present circumstances.

It is the case that the HRCDC has released the majority of the records sought by the applicant, including content on the way in which personal data is handled and processed. It is my view that in so doing, the HRCDC has struck an appropriate balance between optimising transparency around the consent declaration, while seeking to protect the commercial interests of the relevant third party. Having regard to the content of the remaining information, on balance, I find that the public interest would not be better served by granting access to it.

Accordingly, I find that the HRCDC was justified in refusing access to the remaining information under section 36(1)(b) of the FOI Act.

Section 37 - Personal information

Section 37(1)

The HRCDC claims section 37(1) of the FOI Act over the withheld information in Record 1(3d) and the remaining names of individuals in Record 7(1) (pages 25, 31, 45 and 72). Section 37(1) provides that access to a record shall be refused if it would involve the disclosure of personal information. The FOI Act defines the term “personal information” as information about an identifiable individual that would, in the ordinary course of events, be known only to the individual or his/her family or friends, or information about the individual that is held by a public body on the understanding that it would be treated as confidential. The FOI Act details fourteen specific categories of information which is personal without prejudice to the generality of the foregoing definition. These include “(i) information relating to the educational, medical, psychiatric or psychological history of the individual” and “(iii) information relating to the employment or employment history of the individual”. It is important to note that information which comes within any of the fourteen categories is also personal information. As the Supreme Court determined in The Governors and Guardians of the Hospital for the Relief of Poor Lying-In Women v. the Information Commissioner [2011] IESC 26, there is no requirement for information falling within (i) to (xiv) to also meet the requirements of paragraphs (a) or (b).

I note that the applicant says that the definition of personal information expressly excludes information on members of staff or service provider to an FOI body, including the name of an individual and information relating to the position. Following correspondence with this Office, the HRCDC granted access to information relating to staff of FOI bodies.

The information that remains at issue comprises the names and educational qualifications of employees of third party organisations that are not FOI bodies. The applicant says that the definition of personal information only includes information that is either private or confidential. It says that any information in the public domain or which the individual would not consider private or confidential does not fall within the exception. The applicant also submits that the GDPR requires the Data Protection Officer to be accessible to data subjects and senior staff would not expect confidentiality. As noted earlier, information which falls within the categories specified at (i) to (xiv) constitutes personal information. The details concerned comprise information relating to the educational and employment history of third party individuals. In the circumstances, I am satisfied that section 37(1) applies to the withheld information. This finding is subject to other provisions of section 37, which I examine below.

Section 37(2)

Section 37(2) of the FOI Act sets out certain circumstances in which the exemption at section 37(1) does not apply. I am satisfied that none of the circumstances in section 37(2) apply to the information which I have found to be exempt under section 37(1) above. That is to say, (a) it does not relate to the applicant; (b) the third parties have not consented to the release of the information; (c) the information is not of a kind that is available to the general public; (d) the information does not belong to a class of information which would or might be made available to the general public; and (e) the disclosure of the information is not necessary to avoid a serious and imminent danger to the life or health of an individual.

Section 37(5) - The Public Interest

Section 37(5) of the FOI Act provides that access to the personal information of a third party may be granted where the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or the grant of the request would benefit the person to whom the information relates. It has not been argued that releasing the records would benefit the people to whom the information relates and I find that section 37(5)(b) does not apply in the circumstances.

I have outlined relevant considerations in weighing up the public interest above. Although the Court’s comments in The Minister for Communications were made in cases involving confidentiality and commercial sensitivity, I consider them to be relevant to the consideration of public interest tests generally.

The language of section 37 and the Long Title to the FOI Act recognise a very strong public interest in protecting the right to privacy, which has a Constitutional dimension, as one of the un-enumerated personal rights under the Constitution. Also, the strong protection afforded to privacy rights under FOI is consistent with Article 8 of the European Convention on Human Rights. It is noteworthy that unlike other public interest tests provided for in the FOI Act, there is a discretionary element to section 37(5)(a), which is a further indication of the very strong public interest in the right to privacy. Accordingly, when considering section 37(5)(a), privacy rights will be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy.  It is also relevant to note that release of the information must effectively be regarded as release to the world at large.

I find no relevant public interest in granting access to the information that, on balance, outweighs the public interest in upholding the privacy rights of the individuals whose personal information would be disclosed by releasing the withheld information. In the circumstances, I find that section 37(5)(a) does not apply. I find that the HRCDC was justified in refusing access to the information withheld under section 37(1) of the FOI Act.

Decision

Having carried out a review under section 22(2) of the FOI Act, I vary the HRCDC's decision. I affirm its decision on certain information under sections 36(1)(b) and 37(1) of the FOI Act, as outlined above. I annul its decision on the remaining information and direct its release. For the avoidance of doubt, the information which falls for release is as follows: page 73 of Record 7(1) and page 1 of Record 8(3e).

Right of Appeal

Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision.  In summary, such an appeal, normally on a point of law, must be initiated by the applicant not later than eight weeks after notice of the decision was given, and by any other party not later than four weeks after notice of the decision was given.

 

Deirdre McGoldrick

Senior Investigator