Decision
Mr. N and Department of Transport
From Office of the Information Commissioner (OIC)
Case number: OIC-130458-Y1S5D2
Published on
British
and Irish Legal Information Institute
Freely Available British and Irish Public Legal Information
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
Irish Information Commissioner's Decisions
You are here: BAILII >> Databases >> Irish Information Commissioner's Decisions >> Mr. N and Department of Transport [2024] IEIC 130458 (17 December 2024)
URL: http://www.bailii.org/ie/cases/IEIC/2024/130458.html
Cite as: [2024] IEIC 130458
[New search] [Help]
Whether the Department was justified in refusing access to records relating to security screening delays, cleaning, security and baggage retrieval issues at Dublin Airport in June-July 2022 on the basis of sections 32, 35, 36 and 37 of the FOI Act
17 December 2024
In a request dated 29 July 2022, the applicant sought access to copies of correspondence, from 1 June 2022 to the date of his request, between the Department and Dublin Airport Authority (DAA) relating to various issues arising in Dublin Airport, namely security queue delays, baggage retrieval, the cancellation of flights, and/or maintenance and cleaning. The applicant subsequently confirmed to the Department that he was not seeking copies of any press queries and related responses which might fall within the scope of his request.
On 4 August 2022, the Department informed the applicant of its view that the release of some of the records sought may affect the interests of third parties and that it was considering if it was in the public interest to release those records. It said it was required to inform the third parties of the request and to give them an opportunity to make submissions. It appears that the only third party contacted was DAA.
On the same date, the Department notified DAA, pursuant to section 38 of the FOI Act, that it had received a request for access to certain records and that while the records were being considered under sections 35, 36 and 37, the decision maker's preliminary view was that the public interest would, on balance, be better served by granting the request than by refusing it. During the course of this review, the Department provided this Office with a copy of the records it enclosed with its letter to DAA. It appears the Department consulted with DAA in relation to records 1, 1a, 2, 4, 5, 5a, 6, 7, 7a, 9, 9a, 10, 10a, 11, 11a, 12, 14 and 14a (In referring to the records at issue, I have adopted the numbering system used by the Department in the schedule of records it prepared when processing the request. The schedule contains details of 73 records, a number of which contain attachments which are recorded separately on the schedule as records 5a, 7a, 14a, 14b, etc.)
In its response dated 24 August 222, DAA said it had no objection to the release of records 14 and 14a. However, it said it "did not consent to the disclosure of" records 1, 1a, 2, 4, 5, 5a, 6, 7, 7a, 9, 9a, 10, 10a, 11, 11a and 12. DAA cited sections 32, 35 and 36 of the FOI Act in support of its position.
In its decision dated 6 September 2022, the Department part-granted the request. It released records 3, 5, 8, 8a, 10, 13, 14 and 14a, subject to the redaction of personal information under section 37 of the FOI Act. It also released record 1, subject to certain redactions made under sections 32(1)(a), 35(1)(a), 36(1)(b) and 37(1) of the Act. It refused access to the remaining records (1a, 2, 4, 5a, 6, 7, 7a, 9, 9a, 10a, 11, 11a, 12, 14b and 15 to 73) on the basis of sections 32(1)(a), 35(1)(a) and 36(1)(b). The Department's decision letter informed the applicant that he could request an internal review of its decision.
The applicant sought an internal review of that decision. On 3 October 2022, the Department issued its internal review decision, wherein it said it was affirming its original decision. It said, however, that the records that were the subject of third party consultation were outside the scope of the internal review and that the original decision in respect of those records could only be appealed directly to this Office. Excluding records that were previously released or subject to third party consultation, the decision proceeded to focus solely on records 14b and 15 to 73. The Department noted that record 14b is a Ministerial update from DAA while Records 15 to 73 comprise daily security reports from 1 June 2022 to 29 July 2022 inclusive. It said that given the similarity of the security reports to records which were consulted on previously, an additional round of informal consultation with DAA had been undertaken.
In the updated schedule of records provided to the applicant, the Department indicated that it was relying on sections 35(1)(a) and 36(1)(b) in respect of its refusal of record 14b and section 35(1)(a) in respect of its decision to refuse access to records 15 to 73. It also stated that the third party (DAA) had considered section 35(1)(a) to apply to records 14b and 15 to 73 and section 36(1) to apply to record 14b, and that it endorsed this position. However, the decision addressed only the applicability of section 35. Furthermore, while no internal review decision was made on the records that were subject to third party consultation, the schedule of records provided listed the relevant records as withheld in full or in part on the basis of sections 32(1)(a)(iii)/(ix), 35(1)(a) and 36(1)(b). On 11 October 2022, the applicant applied to this Office for a review of the Department's decision.
During the course of the review, this Office informed DAA of the review and the records which had been released to date and invited it to make submissions. In its response, DAA said it consented to the release of records 1, 5a, 7, 7a, 9, 11, 12 and 14b subject to specified redactions, citing sections 35(1)(a), 35(1)(b), 36(1)(b), 36(1)(c) and 37(1). It said it did not consent to the release of records 1a, 2, 4, 6, 9a, 10a, 11a or 15 to 73, citing sections 32(1)(a)(iii) and (ix), 32(1)(b), and 32(1)(c).
Subsequently, this Office's Investigator sought clarification of a number of related matters from both the Department and DAA. Following receipt of those responses, she notified the applicant of the potential relevance of section 35(1)(b) to the records. He was invited to comment but decided not to provide any further submissions.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the submissions made by the Department and DAA and to the applicant's comments in his application for review and subsequent correspondence with this Office. I have also had regard to the contents of the records concerned. I have decided to conclude this review by way of a formal, binding decision.
In its submissions to this Office, the Department said that records 15 to 73 were supplied by DAA with covering emails, which it said "were not considered relevant" as they did not contain any information relating to the applicant's request. The Department provided copies of those emails to this Office for the purposes of the review. I can confirm that they contain no substantive content and merely state "Please see attached security report for yesterday -“ [date]". This Office has informed the applicant that these emails will not be considered as part of this review and he has not objected to their exclusion.
The Department also withheld certain information from records 3, 5, 8, 8a, 10, 13 and 14 on the basis that it comprised third party personal information. During the course of the review, the applicant confirmed to this Office that he was not seeking access to third party personal information such as the email addresses and direct line/mobile phone numbers of Departmental/DAA officials. He indicated that he was happy for this review to focus on the Department's reliance on sections 32, 35 and 36 to refuse access to the records sought, rather than section 37. Having examined the records concerned, I am satisfied that records 1, 6, 7, 9 and 11 also contain similar personal information, which will not be considered as part of this review.
Moreover, during the course of the review, DAA indicated that it had no objection to the release of records 1, 5a, 7a, 9, 11, 12 and 14b subject to certain redactions. The redactions are quite extensive in some cases. However, as the Department's arguments have mainly focused on DAA's position and DAA has no objection to the release of certain information contained in these records, I am proceeding on the basis that the Department's decision to refuse access to the information contained in records 1, 5a, 7a, 9, 11, 12 and 14b the release of which DAA subsequently consented to is not under review. For ease of reference, I shall set out the information to be released or withheld at the end of this decision.
Accordingly, I have excluded from the scope of this review all of the information contained in records 1, 3, 5, 6, 7, 8, 8a, 9, 10, 11, 13 and 14 which comprises the personal information described above, and the information contained in records 1, 5a, 7a, 9, 11, 12 and 14b to which the DAA subsequently consented to release. All of this means that I have excluded records 3, 5, 8, 8a, 9, 10, 11, 13 and 14 from the scope of the review. Certain information has been redacted from records 1, 6, 7 and 14b on other grounds and is therefore included in the review.
I also note that record 2 is wholly contained within record 4 and does not need to be considered on its own. I have therefore excluded record 2 from the review.
Accordingly, this review is concerned with whether the Department was justified in refusing to release, in full or in part, records 1, 1a, 4, 5a, 6, 7, 7a, 9a, 10a, 11a, 12, 14b and 15 to 73 under sections 32(1), 35(1) and/or 36(1) of the FOI Act.
Before I consider the substantive issues arising, I would like to make a number of preliminary comments. First, I note that in response to an email notifying the applicant that this Office's Investigator considered section 35(1)(b) to be relevant, he indicated that it was very difficult to make meaningful arguments without sight of the records in question. While I appreciate the difficulties in making a submission in such circumstances, I note that section 25(3) of the FOI Act requires me to take all reasonable precautions in the course of a review to prevent disclosure of information contained in an exempt record. This means that the extent to which we can describe the contents of the records in such circumstances is often quite limited.
Secondly, I would like to comment on the Department's handling of the section 38 consultation in this case. A request to which section 38 applies is defined in section 2(1) of the Act as meaning "an FOI request to which section 35(3), 36(3) or 37(5)(a) applies and which, apart from section 38 , would fall to be granted" (my emphasis). This means that section 38 applies in cases where, at some stage in the decision making process, the FOI body has formed the view (subject only to receiving the views of the party who gave the information to the FOI body and/or the party to whom the information relates) that the record in question qualifies for exemption under one or more of the relevant exemptions in the FOI Act relating to third parties (i.e. sections 35, 36 and 37 -“ relating to information that is confidential, commercially sensitive, or third party personal information), but that the record should be released in the public interest.
The Department initially informed DAA that it considered section 35, 36 and/or 37 to apply to records 1, 1a, 2, 4, 5, 5a, 6, 7, 7a, 9, 9a, 10, 10a, 11, 11a, 12, 14 and 14a, but that the public interest, on balance, favoured release. However, following the receipt of DAA's submissions, the Department decided to release some records and decided that the remaining records were exempt in full or in part under section 32, as well as sections 35 and 36.
If, at some stage after it commenced the notification process required by section 38, the FOI body decides that some other exemption applies (regardless of whether section 35, 36 or 37 also applies), such a decision is not a decision on a request to which section 38 applies. This is because, despite the notification process having been commenced, it cannot be said that, apart from section 38, the request would fall to be granted. Accordingly, the remaining records withheld in full or in part under section 32 were no longer records which "apart from section 38" would fall to be granted, as another exemption was engaged.
This means that the Department was correct in notifying the applicant in its original decision that he could apply for an internal review of its decision to refuse access both to the records to which access was refused and did not form part of the consultation process, and to the records that did form part of the initial consultation but to which it found section 32 to apply. However, the Department was not correct in excluding that second set of records from the internal review process. Nevertheless, as the applicant sought an internal review of the entire decision, I am satisfied that this Office is entitled to include all of the relevant records as outlined above in the scope of the review as a failure to conduct an internal review is deemed to comprise a refusal of the request.
I also note that the Department initially failed to notify DAA of its original decision to release certain records that formed part of the initial section 38 consultation. This was also incorrect. It should have notified DAA of its decision at the same time as it issued its decision to the applicant, to afford DAA an opportunity to apply directly to this Office for a review of that decision. I note, for example that the Department consulted DAA on the possible release of records 1, 5 and 10, 14 and 14a and having done so it decided to release those records, in part at least. DAA was entitled to apply directly to this Office for a review of the decision to release those records, but it was not notified of the decision at the time it was made.
I appreciate that section 38 is a complex provision and that it can be quite challenging to ensure that all of the appropriate steps are taken in order to ensure compliance with the provision. Nevertheless, the Department should be aware of the Guidance this Office has made available on its website which provides detailed advice on its operation. I urge the Department to ensure that its decision makers make use of that Guidance in the future as appropriate.
Finally, it is important to note that a review by this Office is considered to be "de novo", which means that, in this case, it is based on the circumstances and the law as they pertain at the time of the decision and is not confined to the basis upon which the FOI body reached its decision. Moreover, while the onus is on the Department, pursuant to section 22(12)(b) of the Act, to satisfy this Office that its decision to refuse access to the records at issue was justified, the Supreme Court described the presumption in section 22(12) of the Act as "a starting point" for a review by the Commissioner in its judgment in The Minister for Communications, Energy and Natural Resources and the Information Commissioner & Ors [2020] IESC 57 (the Enet case). The Commissioner's review function is inquisitorial in nature and this Office must adjudicate the merits of the decision to refuse by reason of an analysis of the records and the interests engaged, which might suggest either disclosure or refusal. However, this does not mean that this Office must, or will, continue to ask an FOI body or a third party for sufficient details and arguments until the threshold for an exemption is met.
By way of background, DAA is a public limited company. Among other things, DAA is responsible for the management, operation and development of Dublin Airport. The Minister for Transport (the Minister) is a shareholder in DAA plc and oversees its corporate governance and formulates aviation policy. DAA is specifically listed in Schedule 1, Part 2 of the FOI Act as an exempt agency.
The records at issue
The records in question comprise various emails between the Department and DAA concerning the numbers of security staff and security lanes in operation (records 1, 4, 6 and 7), graphic slides setting out details of Dublin Airport's security staff numbers over various time periods (records 1a and 10a), slide decks containing reports for the Minister (records 5a, 7a, 12 and 14b), letters from DAA to the Minister/Secretary General (records 9a and 11a) and daily security reports (records 15 to 73). The daily security reports contain details of the performance of security arrangements at Dublin Airport, in terms of queueing times, on various dates.
At various points in the process, the Department relied on sections 32(1)(a)(iii) and (ix), 35(1)(a) and 36(1)(b) in respect of its decision to refuse access to the records at issue, in full or in part. In its submissions to the Department and to this Office, DAA also cited sections 32(1)(b) and (c), 35(1)(b) and 36(1)(c).
In its original decision, the Department relied on sections 32(1)(a)(iii) and (ix) in respect of all of the records refused. In its internal review it cited section 32 in relation to the records refused except record 14b (as noted above, it did not address records 15 to 73 in its internal review). In its submissions to this Office, the Department stated that it did not consider section 32 to apply to records 15 to 73.
In its submissions to this office, DAA argued that sections 32(1)(a)(iii) and (ix), (b) and (c) applied to records 1a, 4, 6, 9a, 10a, 11a and 15 to 73. I also note that while DAA did not argue that section 32 applied to records 5a and 12, it stated that they contained "highly technical and security sensitive information".
While I note DAA's arguments, section 32 is discretionary, and the Department has indicated that it is no longer relying on section 32 in relation to records 15 to 73. Furthermore, while DAA argued that sections 32(1)(b)/(c) of the FOI Act applied to some of the information contained in the records at issue, these exemptions are discretionary and were not relied upon by the Department. Accordingly, I shall not consider the application of section 32(1)(a) to records 15 to 73, or sections 32(1)(b) or (c) to the records at issue.
Section 32(1)(a) is a harm based exemption. It applies where access to the records concerned could reasonably be expected to prejudice or impair the matters specified in sub-paragraphs (i) to (x). The relevant parts of section 32(1)(a) provide that an FOI body may refuse to grant an FOI request if access to the record(s) concerned could reasonably be expected to prejudice or impair:
(iii) lawful methods, systems, plans or procedures for ensuring the safety of the public and the safety or security of persons and property, and
(ix) the security of a building or other structure or a vehicle, ship, boat or aircraft.
Where an FOI body relies on section 32(1)(a), it should identify the potential harm to the matters specified in the relevant sub-paragraph that might arise from disclosure. Having identified that harm, it should then consider the reasonableness of any expectation that
the harm will occur. In doing this, it should show how or why releasing the particular record could reasonably be expected to cause the harm which it has identified.
Section 32(1)(a)(iii) is not directly concerned with the safety or security of persons and property. Rather, it is concerned with the protection of lawful methods, systems, plans or procedures for ensuring the safety of the public or the safety or security of persons and property. Where, for example, a system operates to ensure safety and that system could reasonably be expected to be prejudiced or impaired, then this exemption may be relevant.
Subparagraph (ix) of section 32(1)(a) provides for the refusal of a request where the FOI body considers that access to the records sought could reasonably be expected to prejudice or impair the security of a building or other structure or a vehicle, ship, boat or aircraft. The exemption serves to ensure that the security of the various structures or crafts is not prejudiced or impaired. Such prejudice or impairment might occur, for example, if a record was released that disclosed a weakness in the security of a building.
The Department's position
In its original and internal review decisions, the Department did not make any substantive arguments as to the application of section 32 to any of the records in question. However, the factors listed as part of its consideration of the public interest test in each decision appear to indicate that its view was that the release of the records sought could have an adverse effect on the security of Dublin Airport, on passengers using the airport, and on the security and safety of aircraft departing and arriving at the airport. It also stated that the release of the records may prejudice or impair lawful methods for ensuring the safety of the public and the security of Dublin Airport. While these comments were made in relation to its consideration of the public interest, I am satisfied that they are relevant to my examination of its reliance on section 32.
In its submissions to this Office, the Department stated that the records in question contained information in relation to resource allocation and the operation of the
security lanes at the airport which were part of DAA's plans and procedures to "safeguard[..] civil aviation against acts of unlawful interference". It argued that the release of this information could impact the hand baggage screening process and the security of aircraft departing from Dublin Airport.
The Department stated that "[c]onsistent with international best practice", details of DAA's security operations were "security sensitive" and are not generally disclosed to third parties.
It also noted that the records contained information relating to the number of security personnel working in Dublin Airport on any given day and/or the total number of security staff employed by DAA, as well as the number of security lanes which may or may not be open. While the Department acknowledged that the records related to a particular point in time when there was a shortage of fully trained security personnel, its position remained that the release of this information could expose the airport to a security breach. It also argued that the release of the records could result in prohibited articles getting past airport security and onto airplanes with "potentially disastrous results".
DAA's position
DAA argued that the release of the records in question could have a detrimental effect on its ability to provide effective, safe and secure passenger processing at Dublin Airport.
In its initial submissions to this Office, DAA provided redacted versions of the records concerned, although it did not indicate which exemption(s) it considered to apply to the information marked. Of the records being considered under section 32 as part of this review, it stated that it considered this exemption to apply to records 1a, 6, 9a, 10a, 11a. In its subsequent submissions to this Office, DAA gave examples of what it regarded as "security sensitive information" contained in the records, such as security staff levels by certification type forecast on a week-by-week basis, information relating to external security gateposts and details of its role in relation to enhanced background security checks.
DAA contended that the release of the records would provide a greater level of insight into Dublin Airport's security operations than that in the public domain in relation to any other Irish or EU airport. It also stated that, essentially, it withheld access to certain information from its own staff, as there was a risk that they could be targeted by criminal gangs seeking to circumvent the airport's security. While this argument was made in relation to section 32(1)(b) and (c), I am satisfied that it is also relevant to my consideration of section 32(1)(a).
While DAA acknowledged that it had commented on the level of security staff it had at a certain point in time, it said that it "[had] never and [would] never" publish a breakdown by category of each Airport Screening Unit by certification training type. It argued that the disclosure of the records sought would allow for the identification of peaks of passengers and where they would be concentrated, as well as the times of the year when it carries out its annual security training programme, its seasonal security recruitment campaign, or when it had high numbers of seasonal security staff working in the airport. In particular, it referred to specific information contained in record 9a and stated that the level of detail in the record relating to the airport's external gateposts was not in the public domain. DAA argued that the release of such granular information could facilitate surveillance by "potential terrorists" which could risk creating a security vulnerability.
In submissions to this Office, DAA also identified certain information contained in the records as "Security Sensitive information", including information relating to its role as central processing organisation in respect of enhanced background security checks. While it did not specifically state this, I am taking this as an argument that section 32 also applies this information.
Essentially, the thrust of DAA's submissions was that the level of detail in the records sought would reveal specific information relating to operational security matters which could reasonably be expected to facilitate surveillance which could result in a breach of security at Dublin Airport. Its position was that their release would prejudice its lawful methods, systems, plans or procedures for ensuring the safety of the public and airport staff and the security of Dublin Airport and/or aircraft.
The applicant's position
In his internal review request, to which he referred in his application for review to this Office, the applicant stated that the Department had provided no explanation as to how the release of the records sought would prejudice or impair methods, systems, plans, or procedures for the safety of the public, nor how release would compromise the security of a building or an aircraft. He noted that the records sought related to difficulties encountered by DAA in summer 2022, which appeared to have been resolved and were "due to an unusual confluence of events arising from the pandemic", which were not likely to be repeated.
Analysis
I have had careful regard to the parties' submissions, as well as to the content and the context of the records concerned. As set out above, both the Department and DAA were of the view that the release of certain information contained in the records sought could prejudice DAA's lawful methods, systems, plans or procedures for ensuring the safety of the public and the safety or security of persons and property, and the security of Dublin Airport and the aircraft arriving and departing therefrom.
During the course of this review, this Office's Investigator notified DAA that, having carefully reviewed the parties' submissions, and the specific content of the records concerned, it seemed to her that the majority of the information in the records was effectively historic at this point and/or was already in the public domain, at least to some extent. The Investigator referred specifically to information relating to the numbers of security staff and waiting times to get through security, which appeared to already be in the public domain by way of media reports, DAA press releases and answers to Oireachtas Committees, among other things, and invited it to comment. In its response, DAA maintained its position that the release of the records sought could be expected to cause the harms identified above.
As set out above, the records in this case relate to a particular point in time, where a number of factors combined to give rise to various issues including lengthy delays in security queues in Dublin Airport. As set out in a press release on DAA's website, dated 27 June 2022, Dublin Airport had lost over 1,000 employees due to a "combination of a voluntary severance scheme, career breaks, staff attrition and the non-backfill of roles at the height of the pandemic" and "other major cost-cutting efforts". DAA stated that as a result, Dublin Airport entered 2022 with significantly diminished staffing capacity, ahead of the "steepest rise in air travel in its history" on foot of the lifting of Covid-19-related travel restrictions.
I am willing to accept, as a general proposition, that the release of certain information relating to security operations at an airport could be expected to prejudice its security operations, e.g. records whose disclosure could reasonably be expected to reveal exploitable weaknesses in security procedures and/or systems. However, despite the arguments of both DAA and the Department, I am not persuaded that the records at issue in this case reveal such sensitive matters. For example, they do not indicate specific security lapses at certain specified times, such as scanners not being used due to the level of demand on security services. In fact, it seems to me that they reveal quite the opposite; that even when the Airport was badly understaffed, with mostly newly hired and partially-trained staff dealing with rapidly escalating passenger numbers,security standards were maintained in Dublin Airport . Furthermore, it seems to me that the delays and queues were caused because all passengers, regardless of the issues arising, were required to go through security screening before being allowed airside in the Airport. On that basis, it is not clear to me how the harms identified might arise from the release of the records sought.
DAA also argued that the release of information concerning the number of lanes opened at peak times or details of the operation of external gateposts would facilitate terrorists or other parties in breaching Dublin Airport's security. It seems to me that anyone wanting to identify the peak times at an airport or the number of security lanes usually open could gather much, if not all, of this information by simply examining the departure and arrivals information freely available online and/or by visiting the airport.
However, I note that the final page of record 5a (page 33) contains specific details relating to the security screening process itself and that record 9a contains specific details relating to the operational hours of the external gateposts to Dublin Airport. I accept that the release of this information, which I accept is not otherwise in the public domain, could reasonably be expected to prejudice or impair the methods and procedures for ensuring the safety of the public and the safety or security of persons and property, and/or the security of Dublin Airport or aircraft arriving or departing therefrom.
Apart from those two instances, however, neither DAA nor the Department has, in my view, identified any other specific information which might give rise to the harms the relevant exemptions seek to protect against. Rather, general assertions of harm to the security and safety of passengers have been made. Section 32 is not a class based exemption; an FOI body must be in a position to show that it considers it reasonable to expect that the harm identified will arise from the release of the particular information at issue. Disclosure of historic details of the number of security staff or security lanes, or the fact that at the relevant time, not all staff were trained in all aspects of security operations, could not, in my view, reasonably be expected to give rise to the harms identified. Furthermore, while DAA described information relating to its role as central processing organisation in relation to enhanced background checks as "security sensitive", it has not explained the harms that might arise from release of any of the specific information at issue. In addition, while I am willing to accept that the records contain a level of detail relating to Dublin Airport's security operations that is not otherwise available, neither party has satisfactorily explained how the harms expected would occur from the release of the remainder of the information at issue. Nor is it apparent to me from a review of the information how such harms might arise as a result of its release, other than the two particular matters identified above.
There appears to be no doubt that the period to which the information at issue relates was a particularly fraught period for DAA and the Department, when the public and the media were seeking answers as to how delays and related matters at Dublin Airport were to be resolved. However, despite the contentions of both the Department and DAA that the disclosure of the records sought could reasonably be expected to cause the harms identified, I am satisfied that the issues concerned arose due to a very specific combination of circumstances which had not arisen previously and for which DAA was, unsurprisingly, ill-prepared at that time. It seems to me that the various factors at play resulted in a unique situation that would be unlikely to be repeated to the extent that the information at issue in this case could reasonably be expected to give rise to the harms identified. It must be assumed that DAA will have learned from its past experiences and that measures will have been taken to avoid the recurrence of similar issues in the event of, say another major public health emergency.
In any event, it seems to me that the records in this case relate in the most part to DAA's management of limited resources -“ i.e. where the problems were, how the recruitment and training of security staff was being managed, how long people had to queue to get through security, how many security lanes were open, what the cleaning issues were and how the matter of baggage handling was being managed. Furthermore, as set out above, and as acknowledged by the parties to this case, much of the information contained in the records is in the public domain or is similar to information which is in the public domain. A brief internet search demonstrates that DAA published many press releases during the relevant period. I am also satisfied that the number of security staff at the airport was discussed at length across the media, by DAA and by the Minister at the relevant time.
Having carefully considered the matter, I am not satisfied that the release of the majority of the information contained in the records could prejudice or impair DAA's lawful methods, systems, plans or procedures for ensuring the safety of the public and the safety or security of persons and property or the security of a building or other structure or a vehicle or aircraft. However, I accept that the release of the final page of record 5a and certain information contained in record 9a could reasonably be expected to cause the harms identified.
In the circumstances, I find that the Department was justified in refusing access, under sections 32(1)(a)(iii) and (ix) of the FOI Act, to page 33 of record 5a and to all text under the heading "Gate Posts -“ Background" on page 9 of record 9a. I find that it was not justified in refusing access to the remaining records at issue under section 32(1) of the FOI Act.
Section 32(3) provides that section 32(1) does not apply in certain limited circumstances and where the public interest would, on balance, be better served by granting the request. I am satisfied that none of those limited circumstances arise in this case and that section 32(3) does not serve to disapply section 32(1) in respect of the small amount of information to which I have found section 32(1) to apply.
In the records schedule provided at internal review stage, the Department cited section 36(1)(b) in relation to records 1, 1a, 4, 5a, 6, 7, 7a, 9a, 10a, 11a, 12 and 14b. I understand that this is still its position. In its submissions to this Office, DAA argued that sections 36(1)(b) and (c) applied to records 4, 5a, 6, 7, 7a, 9, 9a, 10a, 11, 11a, 12 and 14b. While the Department did not rely on section 36(1)(c) to refuse access to the records sought, it is a mandatory exemption. Accordingly, I will consider the application of section 36(1)(b) and (c) to the records withheld, other than records 15 to 73 and the information I have found to be exempt above on the basis of section 32.
Section 36(1)(b) provides for the mandatory refusal of a request if the record concerned contains financial, commercial, scientific or technical or other information whose disclosure could reasonably be expected to result in a material financial loss or gain to the person to whom the information relates, or could prejudice the competitive position of that person in the conduct of his or her profession or business or otherwise in his or her occupation. The essence of the test in section 36(1)(b) is not the nature of the information but the nature of the harm which might be occasioned by its release.
The harm test in the first part of section 36(1)(b) is that disclosure "could reasonably be expected to result in material loss or gain". This Office takes the view that the test to be applied is not concerned with the question of probabilities or possibilities but with whether the decision maker's expectation is reasonable. The harm test in the second part of section 36(1)(b) is that disclosure of the information "could prejudice the competitive position" of the person in the conduct of their business or profession. The standard of proof to be met here is lower than the "could reasonably be expected" test in the first part of this exemption. However, this Office takes the view that, in invoking prejudice, the damage that could occur must be specified with a reasonable degree of clarity.
Section 36(1)(c) provides for the mandatory refusal of a request if the record concerned contains information whose disclosure could prejudice the conduct or outcome of contractual or other negotiations of the person to whom the information relates. The standard of proof required to meet this exemption is relatively low in the sense that the test is not whether prejudice or harm is certain to materialise but whether it might do so. Having said that, this Office expects that a person seeking to rely on this exemption would be able to show that contractual or other negotiations were in train or were reasonably foreseen which might be affected by the disclosure and would be able to explain how exactly the disclosure could prejudice the conduct or the outcome of such negotiations.
Department's submissions
In its submissions to this Office the Department stated that the records at issue contained financial, commercial and "technically sensitive communications" between DAA and the Department relating to DAA's business and operations at Dublin Airport. Its submissions appeared to echo those of DAA, set out below. The Department stated that the records revealed details of the issues and challenges arising on a detailed and day-by-day basis. Its position was that the release of the records could have a detrimental effect on DAA's business. It also stated that some of the records contained information relating to the terms and conditions under which staff were employed at the airport and commercially sensitive information in relation to premium services provided at the airport, which it stated would be of benefit to DAA's competitors.
DAA's submissions
In its submissions to this Office, DAA argued, among other things, that its competitive position could be prejudiced by the release of information relating to its Platinum Services offering. Platinum Services includes private check-in, security, access to a private lounge and chauffeur-driven transport to the aircraft for a fee. I understand that DAA provides Platinum Services to customers directly and that at least two general aviation (GA) operators (who provide ground services for private flights, among other things) also use Platinum Services as part of their packages for their own GA customers flying in or out of Dublin Airport.
DAA stated that pages 12-19 of record 5a contains details relating to Platinum Services including activity levels, the names of customers, operator details and government movements. It argued that the release of this information would provide Platinum Services customers and other GA operators with a commercial insight into DAA's Platinum Services strategy and enable those entities to target customer groupings, utilising DAA information to negotiate and poach customers. It said the release of this information could also be of commercial disadvantage to GA operators at Dublin Airport, as other entities could leverage the information to target customers.
DAA argued that the disclosure of information contained in the records relating to a third party cleaning provider and issues arising with this service at the relevant time could prejudice DAA's competitive position in respect of future tenders and/or future negotiations with prospective cleaning services tenderers. It also contended that the release of information relating to problems with the cleaning services provided at the relevant time could be to the disadvantage of the provider in question.
DAA referred to page 10 of record 5a which contains information relating to a third party IT company that provided IT payroll services. It acknowledged that it had commented about a cyber-attack that affected the company in the media at the relevant time, but argued that record 5a provided a detailed breakdown of how the attack affected DAA and its staff, which was not in the public domain. Essentially, DAA argued that the release of such details at this time could lead to a material loss or prejudice the competitive position of the third party company. It also argued that the release of information relating to these matters could prejudice the outcome of any related legal action DAA might take.
DAA further said that commercially sensitive information in the records also included information on engagements with the Department of Transport in respect of the potential development of temporary car parking n DAA lands, but it did not explain how the release of such information might give rise to any of the harms identified in section 36(1). It also identified a number of negotiations which it said could be affected by the release of the records concerned, including those with staff, specific partners, customers and various service providers. It argued that the release of certain information would damage its standing and relationships with the parties concerned and prejudice its commercial negotiations. It also stated that the information in question was not published and that it provided an insight into DAA and the incumbent operators at the airport.
Applicant's submissions
In his internal review request, the applicant stated that the Department's decision had not explained how the release of the records withheld could cause a material financial loss, nor whether its position was that the loss would be the Department's or DAA's. He made no further argument to this Office in relation to the application of section 36.
Analysis
While DAA and the Department were both asked to identify the specific information contained in the records which it considered to fall under section 36(1)(b), the Department did not do so. However, as noted above, DAA identified particular types of information to which it considered section 36 to apply. In any event, as also noted above, the parties' failure to provide detailed submissions in support of their arguments is not the end of the matter. Accordingly, I have had careful regard to the contents of the records at issue.
I accept that DAA and Dublin Airport have commercial competitors in terms of other airports from which passengers could fly, or where commercial partners could choose to base their operations. I also accept that detailed information about DAA's commercial services could be of interest to its competitors in certain circumstances.
DAA argued that the release of information relating to its Platinum Services offering would be of interest to those seeking to poach its customers, or the customers of the GA operators currently using the service. My understanding is that DAA operates Platinum Services and that no other company is operating a similar service from the airport, but that third party commercial companies can enter an agreement with DAA to offer some or all of the Platinum Services options to their own clients. From my own research, it appears as though a number of organisations are advertising VIP meet and greet arrival and departure services at Dublin Airport, which may compete with Platinum Services to some extent.
I am satisfied that the GA operators named in the records advertise their services commercially and that it is in the public domain that they have dealings with DAA in this regard. I do not accept that the release of information showing that they were concerned about the proposed closure of the Platinum Services option in the summer of 2022 could reasonably be expected to cause any material financial harm or prejudice their competitive position in 2024.
In relation to the DAA's assertion that damage would be caused to its competitive position in relation to Platinum Services if the information in the records was to be released, I note that the records do not contain an exhaustive list of all clients using this option. Instead, they contain a breakdown of the categories of customers that use the service and a reference to the names of the two GA operators using the service at the relevant time. Only a small number of client organisations are named in the records.
I note that records 4, 5a, 7a, 12 and 15 to 73 contain various references to third party companies. These references relate to the management of issues arising at the Airport during the relevant time period concerning cleaning and baggage handling, as well as references to third party airlines being affected by the delays. I am satisfied that the majority of the issues referred to (in record 5a in particular), which relate to third party service providers concerning baggage handling, cleaning, attendance software failures and other matters were reported on and in the public domain at the relevant time. In fact, the majority of these matters were the subject of discussion before a Joint Committee on Transport and Communications, which DAA's chairperson and other executives attended to give evidence about these matters.
Having carefully considered the matter, I am also satisfied that the majority of the references to third parties contained in the records concerned do not reveal any particular operational or other details, or information not already in the public domain, relating to the third party companies concerned which could reasonably be expected to cause a material loss to the companies or to prejudice their competitive position. Nor has the Department or DAA argued that they would cause such harms.
I accept that the records contain certain information in relation to DAA's Platinum Services offering, including a reference to some of its customers and some numbers relating to the number of passengers using its services during relevant times. However, I do not accept that this or other information contained in the records is detailed or specific enough to grant any competitors an insight into DAA's or other third parties' operations, costs, strategic plans or future negotiations or other matters in such a way that it would allow a competitor an advantage.
I have considered the parties' arguments in this case carefully and had close regard to the context and content of the records concerned. While the parties have asserted various harms that might arise from release, neither the Department nor DAA has explained how the release of high level details such as the number and category of passengers using DAA's Platinum services in 2022 would be of use to its competitors, such that it could result in a material financial loss to DAA, or how the release to the world at large of this information could prejudice its competitive position. Furthermore, while DAA has argued that the release of information relating to operational cleaning issues in 2022 or the potential redeployment of staff in 2022 could negatively impact future negotiations with its cleaning services provider or its staff, it has not explained how the release of this information could reasonably be expected to cause the harms identified. Neither has DAA explained how the release of factual information relating to the disruption caused to its IT systems could affect potential legal proceedings or related negotiations.
As I have outlined above, the records in this case relate to a particular point in time, where a variety of issues arose due to a very specific combination of circumstances which had not arisen previously. The records contain details of the impacts of those issues on the various commercial services. They do not, in my view, contain information that affords a commercial insight into DAA's Platinum Services strategy such that its disclosure might usefully enable other entities to target customer groupings and poach customers as claimed by DAA. It is not apparent to me from the content of the records that the release of the limited details at issue might prejudice the competitive position of DAA's commercial partners or other third party companies or that it could reasonably be expected to result in material loss or gain to any of the parties concerned. Nor is it apparent to me how any negotiations could be prejudiced by the release of the information sought. Accordingly, having carefully considered the matter, I find that the Department was not justified in refusing access to the records at issue under section 36(1)(b) or (c) of the FOI Act.
In its submissions to this Office, the Department effectively stated that the internal reviewer was of the view that records 15 to 73 were releasable due to the nature and age of the content, but that in the absence of formal consultation with DAA, he did not consider it appropriate to release the records in question. However, I note that in the records schedule accompanying its internal review decision, the Department relied on section 35(1)(a) in respect of all of the records withheld. Accordingly, I will consider the Department's reliance on section 35(1)(a) in relation to all of the remaining records at issue. As noted above, in its submissions to this Office, DAA cited sections 35(1)(a) and 35(1)(b) in support of the refusal of certain records.
Section 35(1) provides that an FOI body shall refuse to grant an FOI request if;
(a) the record concerned contains information given to an FOI body in confidence and on the understanding that it would be treated by it as confidential and the body considers that its disclosure would be likely to prejudice the giving to the body of further similar information from the same person or other persons and it is of importance to the body that such further similar information as aforesaid should continue to be given to the body, or
(b) disclosure of the information concerned would constitute a breach of a duty of confidence provided for by a provision of an agreement or enactment (other than a provision of an enactment specified in Schedule 3) or otherwise by law.
A duty of confidence provided for "otherwise by law" is generally accepted to include a duty of confidence arising in equity. This Office accepts that breach of an equitable duty of confidence is comprehended by section 35(1)(b).
In the Supreme Court decision in the case of Mahon v Post Publications Ltd [2007] 3 IR 338 Fennelly J confirmed that the requirements for a successful action based on a breach of an equitable duty of confidence, at least in a commercial setting, are found in the judgment of Megarry J in Coco v. A. N. Clark (Engineers) Ltd. [1969] R.P.C. 41, at 47:
"[T]hree elements are normally required if, apart from contract, a case of breach of confidence is to succeed. First, the information itself ... must 'have the necessary quality of confidence about it'. Secondly, that information must have been imparted in circumstances importing an obligation of confidence. Thirdly, there must be an unauthorised use of that information to the detriment of the party communicating it."
Fennelly J summarised or restated the requirements of what he called "the contours" of the equitable doctrine of confidence as follows:
1. "the information must in fact be confidential or secret: it must ... 'have the necessary quality of confidence about it';
2. it must have been communicated by the possessor of the information in circumstances which impose an obligation of confidence or trust on the person receiving it;
3. it must be wrongfully communicated by the person receiving it or by another person who is aware of the obligation of confidence."
I have adopted this approach in considering whether the disclosure of information in the records at issue would constitute a breach of an equitable duty of confidence owed.
Section 35(1)(a)
The Department and DAA both stated that the remaining records had been provided in confidence, on the understanding that they would be treated as confidential, that their disclosure would be likely to prejudice the giving to the Department of further similar information from DAA, and that it was of importance to the Department that such further similar information should continue to be given.
DAA stated that it was "crucial" for it to be able to share information on a confidential basis with the Department in relation to significant issues, such as Dublin Airport security performance and aviation policy. It said that it was fundamental to the maintenance of appropriate interaction between DAA and the Department that key information concerning State security could be shared in confidence. DAA also stated that it would never comment publically on certain aspects of its security operations in the level of detail set out in the records. It further stated that if the records at issue were released it would simply refuse to provide such security sensitive information to the Department in future.
The Department stated that it was important for commercial semi-state companies to have the ability to communicate with it in regard to matters of security on a confidential basis. While it acknowledged that some time had passed since the records concerned were created, its position was that DAA had always provided certain information with an expectation that it would be treated as confidential and would not be released to a third party. It contended that the release of any such information could seriously adversely affect the relationship between DAA and the Department.
In his request for an internal review, the applicant stated that it was unclear on what basis the information in the records at issue had been given to the Department in confidence. He said that the Department had been subject to the FOI Act for 25 years and that DAA "would have a high level of awareness" of this, particularly as it was subject to a "similar information access mechanism through the AIE Regulations". He argued that the records concerned comprised "correspondence between two public bodies" and that there could be "no assumption of a blanket of confidence" over material relating to issues arising in Dublin Airport which were "already in the public domain", and which appeared to have since been resolved.
Analysis
I have carefully examined the information in the records in question. As noted above, I am of the view that the relevant information was provided at a critical time, when DAA was under severe pressure due to staffing and other issues. Having regard to DAA's arguments, I am willing to accept that some of the information was particularly sensitive at the time it was provided. I also accept that that it is important to the Department to continue to receive further similar information from DAA so that it can monitor issues arising in regard to airport security and other relevant matters.
In considering whether the release of the information in the records at issue would prejudice the giving of further similar information by DAA to the Department, I accept that in certain circumstances, DAA might provide the Department with certain sensitive information in order to ensure that the Minister had a full picture of the situation whilst simultaneously expecting that such information would be treated as confidential. For example, I accept that the information to which I have found sections 32(1)(a)(iii) and (x) to apply would have been given to the Department by DAA in the expectation that it would be treated as confidential and that the release of such information could well prejudice the future supply of such information. Indeed, I again note DAA's assertion that if the records at issue were released it would simply refuse to provide such security sensitive information to the Department in future.
However, as I have already found section 32(1)(a) to apply to certain security-related information, I do not need to consider the applicability of section 35 to that information.
Furthermore, as I have outlined above, the vast majority of the information is such that I have found sections 32 and 36 not to apply to it. The remaining information at issue concerns issues that arose at Dublin Airport during a particular period. DAA is a state-owned body that is under the aegis of the Department. The issues arising at Dublin Airport during the period to which the records at issue relate were the subject of intense public and political scrutiny at the time. As such, the Minister understandably sought and received relevant information and regular updates from DAA in relation to how those issues were being addressed and the progress made by DAA in addressing them, with a view to responding to that detailed scrutiny. I am also satisfied that DAA provided regular updates in the full knowledge that certain of the information provided would be put into the public domain. In such circumstances, I simply cannot accept that the release of such information would prejudice the giving of further similar information to the Department in the future, if such issues arose again. Accordingly, I find that the Department was not justified in refusing to release the remaining information on the basis of section 35(1)(a).
Section 35(1)(b) -“ duty of confidence
DAA and the Department have also argued that a duty of confidence is owed to DAA in respect of the remaining records which I have not already found to be exempt under section 32 above. They argued that certain records had been marked as confidential and that the information concerned had been imparted in circumstances imposing a duty of confidence.
As set out above, I accept that the information to which I have found sections 32(1)(a)(iii) and (x) to apply would have been given to the Department by DAA in the expectation that it would be treated as confidential. Having careful regard to the content of the remaining records, and for the same reasons as set out above under section 35(1)(a), I simply do not accept that the information in question had "the necessary quality of confidence about it". As also set out above, I am satisfied that DAA provided these regular updates in the full knowledge that certain of the information provided would be put into the public domain.
In those circumstances, I do not believe that the first or second requirements of the test set out above are met in respect of the records at issue, with the exception of certain information contained on page 18 of record 5a. The information comprises comments made by certain identified third party users of Platinum Services in respect of the proposed cancellation of those services during the period in question. In the particular circumstances, I accept that the third parties in question would reasonably have expected that their comments would be treated as confidential by DAA and not disclosed to the wider public. I accept, therefore, that the information has the necessary quality of confidence about it and that it was communicated in circumstances which impose an obligation of confidence or trust on the DAA and, in turn, on the Department. In terms of whether the disclosure of the information would be to the detriment of the various third parties, I note that detriment can arise simply where the relevant information is disclosed without the consent of the third party to whom the information relates. In the circumstances, I find that section 35(1)(b) applies to the second, third, fourth and sixth bullet points on page 18. I find that it does not apply to the first and fifth bullet points on the basis that the third parties referenced in those points are FOI bodies. Section 35(2) provides that section 35(1) shall not apply to a record which is prepared by an FOI body or its staff or a service provider in the course of the performance of his or her functions unless disclosure of the information concerned would constitute a breach of a duty of confidence that is provided for by an agreement or statute or otherwise by law and is owed to a person other than an FOI body its staff or such a service provider.
Having carried out a review under section 22(2) of the FOI Act, I hereby vary the Department's decision. While I affirm its decision to refuse access to page 33 of record 5a and to all text under the heading "Gate Posts -“ Background" on page 9 of record 9a under sections 32(1)(a)(iii) and (ix) of the FOI Act and to the second, third, fourth and sixth bullet points on page 18 of record 5a under section 35(1)(b), I find that it was not justified in refusing access to the remainder of the records at issue under the various exemptions cited and I direct their release.
In the interests of clarity, I am directing the release of the following records to the applicant:
-¢ Records 1a, 4, 7a, 10a, 12, 14b and 15-73 in full
-¢ Records 1, 6 and 7, subject to the redaction of the email addresses and direct line/mobile phone numbers of Departmental/DAA officials
-¢ Record 5a, subject to the redaction of the second, third, fourth and sixth bullet points on page 18 and page 33 in full,
-¢ Record 9a, subject to the redaction of the text on page 9 under the heading "Gate Posts -“ Background".
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated by the requester not later than eight weeks after notice of the decision was given, and by any other party not later than four weeks after notice of the decision was given.
Stephen Rafferty
Senior Investigator