Whether the LSRA was justified in redacting, under section 37(1) of the FOI Act, the name and email address of a legal practitioner and the name and address of a legal practice under section 37 of the FOI Act

7 June 2022

Background

The FOI request that is the subject of this review was made on foot of a notification the applicant received from the LSRA that there had been a data breach, wherein a PDF attachment containing information about him had been sent by email to a solicitor in error. On 16 September 2021, the applicant sought access to any files held containing his personal details or data that were shared with any company, legal practice, organisations or individuals outside of the LSRA, including the names and addresses of anyone that received any such data or details without the applicant's prior agreement and permission.

In a decision dated 20 October 2021, the LSRA part-granted the request. It released 9 records in total, redacting certain information from four of the records under section 37(1) of the Act. The applicant sought an internal review of that decision, following which the LSRA affirmed its original decision. On 7 February 2022, the applicant applied to this Office for a review of the LSRA's decision.

During the course of the review, the Investigating Officer notified the solicitor to whom the applicant's information had been incorrectly sent of the review and invited the solicitor to make a submission on the matter. No such submission was received.

I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the applicant's comments in his application for review and to the submissions made by the LSRA in support of its decision. I have also had regard to the contents of the records concerned. I have decided to conclude this review by way of a formal, binding decision. In referring to the records at issue, I have adopted the numbering system used by the LSRA in the schedule of records it prepared when processing the request.

Scope of Review

This review is concerned solely with whether the LSRA was justified in its decision to redact, under section 37 of the FOI Act, certain information from records 2, 3, 4, and 7.

Preliminary Matters                                                                        

In his application for review, the applicant argued that his personal data continues to be compromised on the basis that the LSRA had failed to retrieve his data. He also explained why he requires access to the withheld information.

It is important to note that this Office has no role in examining how the LSRA dealt with the data breach in question. Our role is confined to reviewing the decision taken by the LSRA on the applicant's FOI request. Moreover, it is important to note that section 13(4) of the Act provides that in deciding whether to grant or refuse a request, any reason that the requester gives for the request shall be disregarded. This means that we cannot have regard to the applicant's motives for seeking access to the information in question, except in so far as those motives reflect what might be regarded as public interest factors in favour of release of the information where the Act requires a consideration of the public interest.

Analysis and Findings

Section 37(1) provides that, subject to the other provisions of the section, an FOI body shall refuse a request if access to the record concerned would involve the disclosure of personal information relating to an individual other than the requester. The redacted information comprises the name and email address of the relevant solicitor, and the name and address of the legal practice.

Section 2 of the FOI Act defines personal information as information about an identifiable individual that either (a) would ordinarily be known only to the individual or to members of his/her family or to his/her friends, or (b) is held by an FOI body on the understanding that it would be treated by the FOI body as confidential. Furthermore, the Act details fourteen specific categories of information that is personal without prejudice to the generality of the foregoing definition, including (iii) information relating to the employment or employment history of the individual.

I find that the disclosure of the name and address of the relevant legal practice would not involve the disclosure of personal information relating to an identifiable individual and that section 37(1) does not, therefore, apply. Accordingly, I find that the LSRA was not justified in redacting the name and address of the legal practice from record 2 or the name of the practice from records 3, 4 or 7 under section 37(1). Accordingly, I direct the release of this information.

On the other hand, having regard to the definition of personal information, I am satisfied that the disclosure of the name and email address of the relevant solicitor would involve the disclosure of personal information relating to that individual. As such I find that section 37(1) applies. However, that is not the end of the matter as section 37(1) is subject to the other provisions of section 37.

There are some circumstances, provided for at section 37(2), in which the exemption at section 37(1) does not apply. I am satisfied that none of the circumstances identified at section 37(2) arise in this case. Section 37(5) provides that a request that would fall to be refused under section 37(1) may still be granted where, on balance, (a) the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or (b) the grant of the information would be to the benefit of the person to whom the information relates. I am satisfied that the release of the information at issue in this case would not be to the benefit of the individual to whom the information relates and that section 37(5)(b) does not apply.

In relation to the applicability of section 37(5)(a), in carrying out any review this Office has regard to the general principles of openness and transparency set out in section 11(3) of the FOI Act. Section 11(3) provides that an FOI body must have regard to the need to achieve greater openness in the activities of FOI bodies and to promote adherence by them to the principles of transparency in government and public affairs and the need to strengthen the accountability and improve the quality of decision making of FOI bodies. It is important to note that in The Minister for Communications, Energy and Natural Resources and the Information Commissioner & Ors [2020] IESC 57 (-�the eNet Case-�), the Supreme Court found that a general principle of openness does not suffice to direct release of records in the public interest and -�there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure-�. Moreover, the Court found that the exemption provision recognises that there is a public interest in ensuring the protection afforded by the provision and that this may normally be served by the operation of the exemption itself. Although the Court's comments were made in cases involving confidentiality and commercial sensitivity, I consider them to be relevant to the consideration of public interest tests generally.

In relation to the issue of the public interest, it is also important to have regard to the comments of the Supreme Court in The Governors and Guardians of the Hospital for the Relief of Poor Lying-In Women v. the Information Commissioner [2011] IESC 26. It is noted that a public interest should be distinguished from a private interest.

The FOI Act recognises the public interest in the protection of the right to privacy both in the language of section 37 and the Long Title to the Act (which makes clear that the release of records under FOI must be consistent with the right to privacy). It is also worth noting that the right to privacy has a constitutional dimension, as one of the unenumerated personal rights under the Constitution. Moreover, unlike other public interest tests provided for in the FOI Act, there is a discretionary element to section 37(5)(a), which is a further indication of the very strong public interest in the right to privacy. Privacy rights will therefore be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy.

In his application for review to this Office and in correspondence with the LSRA, the applicant contended that his personal data has been, and continues to be, compromised. He said he wishes to take this matter to court to protect his rights under data protection legislation. In essence, his argument appears to be that the public interest in granting the request in order to vindicate his personal right to privacy outweighs the public interest in the protection of the right to privacy generally.

While I understand the applicant's concerns regarding the data breach, it seems to me that the disclosure of the identity of the relevant legal practice would allow the applicant to pursue the matter.  Moreover, when considering where the balance of the public interest lies in this case, it is important to note that the release of records under FOI is regarded, in effect, as release to the world at large, given that the Act places no constraints on the uses to which a record released under the Act may be put. I am not aware of any sufficiently specific, cogent and fact-based reason for finding that the public interest in granting access to the name and email address of the relevant individual outweighs, on balance, the right to privacy of the individual in question. I find, therefore, that section 37(5)(a) does not apply.

In conclusion, therefore, I find that the name and email address of the individual as contained in the records at issue are exempt from release under section 37(1) of the Act.

Decision

Having carried out a review under section 22(2) of the FOI Act, I hereby vary the LSRA's decision. I find that the LSRA was not justified in refusing access to the name and address of the legal practice under section 37 of the FOI Act, and I direct the release of that information to the applicant.

Right of Appeal

Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision.  In summary, such an appeal, normally on a point of law, must be initiated by the requester not later than eight weeks after notice of the decision was given, and by any other party not later than four weeks after notice of the decision was given.

Stephen Rafferty
Senior Investigator