Whether the HSE was justified, under section 37 of the Act, in refusing to provide the applicant with a copy of the CCTV footage of his attendance at a named Hospital during certain specified time-frames on specified dates on the ground that the disclosure of the footage sought would involve the disclosure of personal information relating to third parties

4 February 2021

Background

The applicant attended the Emergency Department at a named Hospital on 10 April 2020 and 25 April 2020. On 26 April 2020, the applicant sought access to a range of information held by the Hospital relating to him, including CCTV footage of him at the Emergency Department on the above dates at specific times. The applicant also provided a description of the clothing he was wearing on those dates.

On 4 June 2020, the HSE issued a decision in which it said it had decided to grant the request in full. On the matter of the CCTV footage sought, it said the retrieval of such records was proving time consuming and images of staff and other members of the public would have to be redacted before release. It said the process as underway and that the records would be released as soon as that process as complete.

On 17 July 2020, the applicant sought an internal review of the HSE’s decision as he had not, at that stage received the CCTV records. On 10 August 2020, the HSE refused access to the CCTV footage sought under section 37 of the Act on the ground that the records contained personal information relating to third parties. It said that the Hospital did not have the technical facilities to redact the images of the third parties as the software licence it had had since expired. On 3 September 2020, the applicant sought a review by this Office of the HSE’s decision.

I have now completed my review in this case. In carrying out my review, I have had regard to the correspondence between the HSE and the applicant, and to communications between this Office and both the applicant and the HSE on the matter. I have also had regard to the contents of the CCTV records held by the HSE. I have decided to conclude this review by way of a formal, binding decision.

Scope of Review

During the course of the review, the HSE provided this Office with a copy of relevant CCTV footage for the dates in question. The Investigating Office sought to clarify whether any additional relevant footage existed in respect of the first date as the footage provided captured only a small part of the time-frame identified by the applicant. In response, the HSE explained that the footage provided was the only footage for the time-frame that captured the applicant. It explained that all cameras were searched for the time-frame using the description the applicant provided with his request and the only relevant footage found for the first date was the footage provided. It suggested that the applicant may have left the Hospital outside of the time-frame identified or that he may have left through another exit. It said no further recordings are held for the specific time-frame and dates sought that capture the applicant.

On 12 January 2021, the Investigating Officer provided the applicant details of the HSE’s response and she invited him to make a submission on the matter. To date, no response has been received. Accordingly, this review is concerned solely with whether the HSE was justified, under section 37 of the Act, in refusing to provide the applicant with a copy of the CCTV footage of his attendance at a named Hospital during certain specified time-frames on specified dates on the ground that the disclosure of the footage sought would involve the disclosure of personal information relating to third parties.

Analysis and Findings

Section 37(1) of the FOI Act provides that, subject to the other provisions of the section, an FOI body shall refuse a request if access to the record concerned would involve the disclosure of personal information. This does not apply where the information involved relates to the requester (section 37(2)(a) refers). Furthermore, section 37(7) provides for the refusal of a request where access to the record concerned would, in addition to involving the disclosure of personal information relating to the requester, also involve the disclosure of personal information relating to an individual or individuals other than the requester, and where it is not feasible to separate the personal information relating to the requester from that relating to the other party. Such information is commonly referred to as joint personal information.

Section 2 of the Act defines “personal information” as information about an identifiable individual that (a) would, in the ordinary course of events, be known only to the individual or his/her family or friends, of the individual or (b) is held by an FOI body on the understanding that it would be treated by it as confidential. Section 2 goes on to provide a non-exhaustive list of fourteen categories of personal information.

Certain information is excluded from the definition of personal information. Where an individual is a member of the staff of an FOI body, paragraph (I) of section 2(1) of the Act provides that personal information does not include;

• the name of the individual,
• information relating to the position held or its functions,
• the terms upon and subject to which the individual holds that position, or
• anything written or recorded in any form by the individual in the course of and for the purpose of the performance of the functions of the position

Similar such information is excluded in the case of service providers under Paragraph II.

The exclusions at Paragraph (I) and (II) do not exclude all information relating to staff members. The exclusions are intended, in essence, to ensure that section 37 cannot be used to exempt the identity of a public servant or a service provider in the context of the particular position held or service provided, or any records created by the staff member while carrying out his or her official functions or while providing the service, or information relating to the terms conditions and functions of positions. The exclusion does not deprive public servants or service providers of the right to privacy generally.

The CCTV footage at issue in this case captures a number of parties other than the applicant. I am satisfied that all such third parties are either staff members of the HSE or staff members of service providers.

In its submissions to this Office, the HSE argued that the release of the images of the third parties in question would involve the disclosure of personal information relating to those third parties. It argued that the exclusions at paragraph (I) and (II) do not apply as the release of those images would involve the disclosure of information that is not captured by those exclusions. I agree. In my view, a clear distinction can be drawn between the name of a staff member contained in an official record and an image of that staff member captured on CCTV footage. It seems to me that additional information going beyond mere identification can be derived from such an image that is unrelated to either the position held by the staff member or its functions. I am satisfied that the release of the CCTV footage at issue in this case would, in addition to disclosing personal information relating to the applicant, also involve the disclosure of personal information relating to third parties. I find, therefore, that section 37(1) applies to the footage.

However, that is not the end of the matter as section 37(1) is subject to the provisions of subsections (2) and (5). Section 37(2) of the FOI Act sets out certain circumstances in which the exemption at section 37(1) does not apply. I am satisfied that none of the circumstances in section 37(2) applies to the record in this case.

Section 37(5) provides that a request that would fall to be refused under section 37(1) may still be granted where, on balance, (a) the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or (b) the grant of the request would benefit the person to whom the information relates. I am satisfied that subsection (b) does not apply in the circumstances of this case.

On the matter of whether the public interest in granting access to the information at issue would, on balance, outweigh the privacy rights of the individuals concerned, I have had regard to the comments of the Supreme Court in The Governors and Guardians of the Hospital for the Relief of Poor Lying-In Women v The Information Commissioner [2011] 1 IR 729, [2011] IESC 26) (“the Rotunda case”). It is noted that a public interest (“a true public interest recognised by means of a well known and established policy, adopted by the Oireachtas, or by law”) should be distinguished from a private interest.

Furthermore, McDermott J., in his December 2016 judgment in the case of F.P. v The Information Commissioner [2014 No. 114 MCA] (“the F.P. case”), which was subsequently upheld by the Court of Appeal, said that private as opposed to public interests were not a sufficient basis upon which to exercise the discretion in favour of the appellant under the relevant public interest test in that case. He also said that “the ‘public interest’ in granting access is not to be determined on the basis of the appellant’s personal circumstances or desire to explore or pursue civil proceedings or criminal complaints.”

On the matter of the type of public interest factors that might be considered in support of the release of the information at issue in this case, I have had regard to the findings of the Supreme Court in The Minister for Communications, Energy and Natural Resources v The Information Commissioner & Ors. In her judgment, Baker J. indicated that the public interest in favour of disclosure cannot be the same public interest as that broadly stated in the Act. She said the public interest in disclosure must be something more than the general public interest in disclosure and the reason must be found from the scrutiny of the contents of the record. She said there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure.

While the comments of the Supreme Court in both judgments cited above were made in relation to provisions of the FOI Act other than section 37, I consider them to be relevant to the consideration of public interest tests generally.

Both the language of section 37 and the Long Title to the FOI Act recognise a very strong public interest in protecting the right to privacy (which has a Constitutional dimension, as one of the un-enumerated personal rights under the Constitution). Unlike other public interest tests provided for in the FOI Act, there is also a discretionary element to section 37(5)(a), which is a further indication of the very strong public interest in the right to privacy. Privacy rights will therefore be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy. Furthermore, it is important to note that the release of records under FOI is, in effect, regarded as release to the world at large, given that the Act places no constraints on the uses to which information released under the Act may be put.

In its submissions, the HSE argued that staff had a legitimate expectation that their employer wold not disclose their images to the world at large. Given the inherently private nature of the information, I know of no public interest factors in favour of the release of the images of the third parties in question that would, on balance, outweigh their privacy rights. I find, therefore, that section 37(5)(a) does not apply in this case.

For the sake of completeness, I have also considered whether there is an obligation on the HSE under the FOI Act to grant partial access to the CCTV footage with the redaction of third party images.

While the Act does not generally require a public body to create a new record in order to grant a request (apart from a specific requirement under section 17(4) that I will address shortly), section 2 of the Act defines “record” as including “a copy or part” of anything falling within the definition of a record. Furthermore, section 18(1) provides, that "if it is practicable to do so", access to an otherwise exempt record shall be granted by preparing a copy, in such form as the head of the FOI body concerned considers appropriate, of the record with the exempt information removed.

The personal information relating to the applicant that is contained in the records at issue in this case is inextricably linked to personal information relating to third parties. As such, I am satisfied that the HSE is not in a position to grant access to parts of the record that would allow for the removal of exempt information. I am also satisfied that the pixilation of the CCTV footage is not required under section 18 as this would, in my view, involve the creation of a new record, as opposed to simply providing access to part of a record.

Section 17(4) provides that the FOI body must take reasonable steps to search for and extract the records to which the request relates where the request relates to data contained in more than one record held electronically, even if this involves the creation of a new record. The reasonable steps that must be taken are those that involve the use of any facility for electronic search or extraction that existed on the date of the request and was ordinarily used by the FOI body.

In this case, the HSE said that while the CCTV footage could be redacted by pixilating the facial images of the third parties concerned, the Hospital no longer holds the required software licensing agreement to carry out this function. It said it did not consider engaging a service provider to pixilate the images as practicable without incurring a substantial cost to the Hospital. It said purchasing the software or engaging a service provider would impact greatly on the service where there are limitations on the resources, both pay and non-pay budgets. I accept that the Hospital is not in a position to use any available, pre-existing facility for search and extraction to provide a pixelated version of the records at issue and that section 17(4) does not apply in this case.

In conclusion, therefore, I find that the HSE was justified in refusing the applicant’s request for a copy of CCTV footage of him at the Emergency Department at a named Hospital during certain specified time-frames on specified dates under section 37(1) of the FOI Act.

Decision

Having carried out a review, under section 22(2), I hereby affirm the decision of the HSE to refuse access, under section 37 of the Act, to a copy of the CCTV footage of the applicant’s attendance at a named Hospital during certain specified time-frames on specified dates on the ground that the disclosure of the footage sought would involve the disclosure of personal information relating to third parties.

Right of Appeal

Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated no later than four weeks after notice of the decision was given to the person bringing the appeal.

 

Stephen Rafferty

Senior Investigator