Whether the HSE was justified in refusing access, under sections 15(1)(a) and 37 of the FOI Act, to CCTV footage of the applicant's late father while he was a patient at a named Hospital on particular dates

16 November 2023

Background

In a request dated 18 January 2023, the applicant sought access to all CCTV footage of her late father while he was a patient at a named Hospital (the Hospital) between 9 and 21 December 2022, and 27 December 2022 and 5 January 2023, inclusive. The applicant identified specific locations in or around the Hospital where she believed CCTV footage of her father would have been captured. She also asked that footage of "all persons who entered or left"� the room after the last family member had left her deceased father on 5 January 2023, to the time that his remains were moved to the morgue or another room in the Hospital, as well as "all CCTV capture of all patients, all hospital staff and all visitors"� in a particular corridor in the Hospital on 18 December 2022, be included in the Hospital's response.

On 15 February 2023, the HSE refused the applicant's request in full under section 37 of the FOI Act. The HSE's decision described the applicant's request as seeking access to all CCTV footage regarding her late father, and did not refer to the parts of her request which referred to other patients, staff or visitors. While it accepted that the applicant was her late father's next of kin, it said that the CCTV footage concerned also included images of third parties "� i.e. patients, visitors and staff. In her request for internal review on 21 February 2023, the applicant also noted that she wished all CCTV footage relating to her later father, herself and her sister to be preserved.

On 8 March 2023, the HSE affirmed its decision to refuse access to CCTV footage relating to the applicant's late father on the same basis. It stated that the Hospital did not have the technical facilities to pixelate the images of the third parties. On 9 March 2023, the applicant applied to this Office for a review of the HSE's decision. In her application, she stated that she was unhappy with the HSE's refusal to provide CCTV footage of her late father while he was a patient at the Hospital. She also stated that she had asked the Hospital to preserve all footage relating to her father, herself and her sister.

During the course of this review, the HSE provided this Office with CCTV footage captured between 27 December 2022 and 5 January 2023, which it refused to release under section 37 of the FOI Act. The Investigating Officer queried whether any additional footage existed in respect of the date ranges in question, as the footage provided appeared to capture only a small part of the time-frame identified by the applicant. In response, the HSE stated that no CCTV footage existed of the applicant's late father between 9 December and 21 December 2022. It also said that no further CCTV footage exists for the period 27 December 2022 to 5 January 2023 inclusive, other than that provided to this Office. The HSE indicated that it also wished to rely on section 15(1)(a) of the FOI Act on the ground that further CCTV footage does not exist, other than that withheld under section 37.

The Investigating Officer subsequently contacted the applicant and provided her with details of the HSE's submissions wherein it outlined the searches undertaken to locate additional footage and its reasons for concluding that no further records relating to her late father exist, other than the CCTV recordings withheld under section 37 of the FOI Act. The Investigating Officer invited the applicant to make a submission on the matter, which she duly did.

I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the submissions made by the HSE in support of its decision and to the applicant's comments and submissions to this Office. I have also had regard to the contents of the CCTV records concerned. I have decided to conclude this review by way of a formal, binding decision.

Scope of Review

As set out above, the applicant initially sought access to footage relating to her late father and/or to other individuals. In its original decision on her request, the HSE appeared to proceed on the basis that she was solely seeking access to CCTV footage relating to her father. In her internal review request, the applicant described her request in the same way, i.e., a request for access to all CCTV footage of her late father for the relevant dates. Furthermore, while the applicant asked the Hospital to preserve footage relating to her father, herself and her sister in her internal review, she did not object to the Hospital's description of her request. Similarly, when she applied to this Office for a review of the HSE's decision, she stated that the Hospital had failed to provide her with CCTV of her late father, although she also referred to correspondence requesting the Hospital to preserve all CCTV footage of herself, her sister and their deceased father. I further note that when the Investigating Officer provided the applicant with details of the HSE's submissions, she clearly stated that the review by this Office concerned the decision of the HSE in relation to the applicant's request for CCTV of her late father while he was a patient at the Hospital. I note that the applicant raised no objections to the scope of the review in her response.

Accordingly, this review is concerned solely with whether the HSE was justified, under section 37 of the FOI Act, in refusing to provide the applicant with a copy of CCTV footage relating to her late father at a named Hospital on specified dates, and in refusing access, under section 15(1)(a) to further records on the ground that no additional CCTV records relating to her request exist or can be found.

Preliminary Matters

Before addressing the substantive issues arising, I would like to make the following preliminary comments.

First, although I am obliged to give reasons for my decision, section 25(3) of the FOI Act requires me to take all reasonable precautions in the course of a review to prevent disclosure of information contained in an exempt record. This means that the extent to which I can describe the contents of the records is limited.

Secondly, I wish to explain that this Office has no remit to investigate complaints, to adjudicate on how FOI bodies perform their functions generally, or to act as an alternative dispute resolution mechanism with respect to actions taken by FOI bodies. As I explained above, our role is confined to considering whether the decision taken by the HSE is in accordance with the provisions of the FOI Act.

Lastly, I note that in her submissions to this Office, the applicant advanced a number of arguments under the Data Protection Act, 2018 and the General Data Protection Regulation (GDPR). It is important to note that the applicant's request in this case was made under the FOI Act, which is entirely independent of data protection legislation. Requests for access to records under the FOI Act must be processed in accordance with the provisions of the FOI Act. It is also important to note that the scope of this review is confined to records sought by the applicant in her FOI request. It cannot be extended to consider any additional records the applicant may have sought in separate Subject Access Requests (SARs).

Analysis and Findings

Section 15(1)(a)

Section 15(1)(a) of the FOI Act provides for the refusal of a request where the records sought do not exist or cannot be found after all reasonable steps to ascertain their whereabouts have been taken. Our role in a case such as this is to review the decision of the FOI body and to decide whether that decision was justified. This means that I must have regard to the evidence available to the decision maker and the reasoning used by the decision maker in arriving at their decision and must assess the adequacy of the searches conducted by the FOI body in looking for relevant records. The evidence in "search"� cases generally consists of the steps actually taken to search for the records along with miscellaneous and other information about the record management practices of the FOI body, insofar as those practices relate to the records in question. It is important to note that a review by this Office is not concerned with access to records that a requester believes ought to exist.

As noted above, during the course of the review the HSE stated that it wished to rely on section 15(1)(a) of the FOI Act in relation to additional CCTV footage which either does not exist or no longer exists. The HSE provided details of the searches carried out to locate relevant records in this case and its reasons for concluding that further records do not exist. These details have been provided to the applicant and she has been given an opportunity to comment. While I shall not set out the HSE's submissions or the applicant's response in full below, I can confirm that I have had regard to all of the submissions made by the parties concerned.

In their submissions to this Office, both parties referred to the applicant's earlier interactions with the HSE concerning her various requests for access to CCTV footage. The applicant has provided this Office with copies of the email correspondence with the HSE in this regard. I think that it would be useful to set out the relevant parts of their interactions, as follows:

• The applicant emailed the HSE on 11 January 2023, requesting that "all CCTV footage"� from the Hospital from 9 December 2022 to 5 January 2023 "be preserved"� and a copy of said footage be provided to her.
• On the same date, the HSE informed her that it appeared that she was seeking access to CCTV footage relating to her deceased father under GDPR. It explained that GDPR did not apply in such circumstances. It stated that it was open to the applicant to make an FOI request for the footage in question, and it asked her to provide further details such as the relevant dates and times her deceased father entered and exited the Hospital. It also noted that there were no CCTV cameras in certain areas of the Hospital.
• On the same date, the applicant clarified that she was making an SAR for CCTV footage on her own behalf, as a person who was recorded by a CCTV system.
• On 12 January 2023, the HSE acknowledged her clarification and sought details of the dates and times she attended the Hospital, as well as details of her clothing and entry/exit routes.
• On 13 January 2023, the applicant stated that she was "seeking legal advice"� and once again asked the HSE to preserve all CCTV from the Hospital from 9 December 2022 to Thursday 5 January 2023 inclusive.
• On the same date, the HSE informed her that the Hospital did "not have the facility to save all CCTV footage"� between the relevant dates. It said that the system "only keeps footage for 30 days"� and that, therefore, footage of 9-12 December 2022 "has been deleted at this point"�.
• On 17 January 2023, the HSE reiterated that it needed details of the times and dates the applicant attended the Hospital, as well as other relevant information before it could process her SAR. It stated that there was "no legal basis to retain full footage of all [CCTV cameras] for a 28 day period"� when she had not confirmed the relevant dates and times. It referred to Article 12.5 of the GDPR, stated that "[r]equesting 28 days worth of CCTV footage [was] excessive"�, and said for that reason, the Hospital would not be taking action on her request "at this time"�.
• On the same date, the applicant provided the details sought by the HSE so that it could process her SAR. The only dates referred to in this email were 29 December to 5 January 2023 inclusive.

As set out above, on 18 January 2023, the applicant made an FOI request seeking access to all CCTV footage of her late father from 9 to 21 December and from 27 December to 5 January inclusive. Essentially, the applicant is of the view that footage relating to the earlier part of her request existed when she first made contact with the HSE and that it all should have been retained and provided to her.

The HSE identified three sets of CCTV footage relating to the applicant's request, all of which were refused under section 37. The footage was taken on 28 December 2022, 2 January 2023 and 5 January 2023. The general thrust of the HSE's submission is that CCTV footage of the applicant's late father for the period 9 December 2022 - 21 December 2022 no longer exists and that no further CCTV footage relating to the applicant's father for the period 27 December 2022 to 5 January 2023 inclusive exists, other than that withheld under section 37 of the FOI Act.

In its submissions to this Office, the HSE stated that by the time the applicant's FOI request was received by the Hospital on 18 January 2023, the CCTV footage relating to 9-21 December 2022 "had already been deleted"�. It said that its CCTV recordings are only held for 28 days and are then "automatically deleted"� from the system. The HSE said that a copy of the footage for the period between 27 December 2022 and 5 January 2023 was downloaded and saved and that a member of its security staff watched all the available recordings to locate relevant footage. However, the HSE said there was "an issue"� with the downloaded file for 27 December 2022 and that this footage could not be viewed. As noted above, it refused to release CCTV footage of the applicant's father on 28 December 2022 under section 37. It essentially stated that the applicant's father was not captured on CCTV again until his remains were removed to the morgue on 5 January 2023.

As outlined above, the details submitted by the HSE were provided to the applicant by the Investigating Officer. The applicant's position essentially, was that the relevant footage was held by the Hospital when she made her initial request on 11 January 2023 and that she requested that it be preserved. The applicant was of the view that the HSE's reference to footage of 9-12 December having been deleted at that point in its email of 13 January 2023, effectively confirmed that relevant CCTV for later dates was still available on that date. She argued that the HSE's position that no data exists indicates that the data had been "unlawfully destroyed"� which was "in breach of"� GDPR.

The applicant also referred to an email dated 16 March 2023 in relation to her SAR, wherein the General Service Manager and Data Protection Officer of the Hospital stated that a staff member "continues to review"� the relevant CCTV footage "manually for the period involved"�. It said that due to the amount of footage that needed to be reviewed, "the task is not complete as yet."� She argued that this meant that the CCTV requested from 13 December 2022 to 5 January 2023 inclusive "was clearly available"�, had been "saved and stored"� and "[was] being reviewed at that stage"�.

During this review, some confusion arose as to whether CCTV footage was normally retained by the Hospital's systems for 28 or 30 days. As outlined above, the HSE informed the applicant on 13 January 2023 that the CCTV retention period was 30 days. However, in subsequent correspondence with the applicant, the HSE stated that, in the circumstances, it had no legal basis to retain full footage of all cameras for a 28-day period.

Following receipt of the applicant's submissions, the Investigating Officer asked the HSE to clarify the Hospital's retention period for CCTV footage. The Investigating Officer also informed the HSE that it appeared to her that if the retention period was 28 days, footage from 21 December 2022 would have existed on the date of the applicant's request. Or, in the alternative, if the retention period was 30 days, it appeared to her that footage from 19 December 2022 would have existed on the date of the applicant's request.

In response, the HSE said that the correct retention period of CCTV footage was 28 days. It acknowledged that the applicant had been given conflicting information in this regard. It essentially stated that CCTV footage from 21 December 2022 would have been deleted on 18 January 2023, which was the same date the applicant's request was received. It said the footage from 21 December 2022 would have been deleted "during the time it took to pass the request to the Hospital and for them to notify security to save the footage"�.

The HSE said that on 17 January 2023 at 21:32, the applicant provided the necessary information. It said at this point, the HSE considered that it had received a valid SAR. It said the scope of this request was for "Inclusive Dates: Friday, 29th December 2022 up to and including Thursday, 5th January 2023"�.

On the matter of the letter dated 16 March 2023 from the Hospital's DPO, the HSE argued this letter to the applicant referred in general terms to the amount of footage involved. It argued that it "in no way indicates"� that footage between the specific dates of 13 December 2022 and 5 January 2023 was available at that point.

The applicant appears to be of the view that all CCTV footage from the Hospital for the period 9 December 2022 "� 5 January 2023 should have been preserved following her SAR on 11 January 2023. She also appears to be of the view that the HSE's letter of 16 March 2023 confirmed that all CCTV footage request between 13 December 2022 "� 5 January 2023 inclusive was available and being reviewed at that stage. Having carefully examined the letter dated 16 March 2023, it is not apparent to me that the HSE confirmed the existence of all CCTV footage between 13 December 2022 "� 5 January 2023. Rather, it seems to me that the applicant's SAR was not accepted by the HSE until 18 January 2023, at which point footage within the scope of her SAR was retained.

In her submissions to this Office, the applicant said she did not accept that there was an issue with the downloaded file in relation to footage for 27 December 2022. She said she sought CCTV capture of her late father arriving at the Hospital by ambulance on 27 December 2023 and the time of the ambulance's arrival. She stated her belief that the time her father was physically moved from the ambulance within the grounds of the Hospital and taken into the Hospital "will have been captured"� by CCTV. She argued that there would be CCTV of her late father in different parts of the Hospital during the period 9 to 21 December 2022.

I outlined above that the scope of the applicant's FOI request is for CCTV of her late father while he was a patient at the Hospital between 9 December 2022 and 21 December 2022 inclusive, and between 27 December 2022 and 5 January 2023 inclusive. I also outlined above that this review is confined to whether the HSE's decision on the applicant's FOI request is justified under the FOI Act, in other words, whether it was justified in refusing access, under section 15(1)(a), to further CCTV footage falling within the scope of the request on the ground that no additional records exist or can be found.

It is important to note that the FOI Act is concerned with access to records held by public bodies. If the record sought is not held by the body, then that is the end of the matter. Accordingly, the question I must consider is whether the HSE has, at this stage, provided an adequate explanation as to why further records (other than those withheld under section 37 of the FOI Act) do not exist or no longer exist. Having regard to the HSE's submissions, I am satisfied that it has.

I note that in reply to the applicant's SAR on 11 January 2023, the HSE replied on the same day and suggested she make a FOI request if she sought CCTV of her late father. It seems to me that it would have been prudent for the HSE to keep a copy of the relevant CCTV footage once the applicant contacted it on 11 January 2023, regardless of any pending clarification on her SAR request and/or subsequent FOI request that she would make. It is unfortunate that the HSE did not act sooner given the context of the applicant's correspondence and its knowledge that CCTV footage is automatically deleted after 28 days. Nevertheless, I accept that the CCTV footage for the period 9 December 2022 and 20 December 2022 was deleted prior to the applicant's FOI request on 18 January 2023, and that CCTV footage for 21 December 2022 was deleted on the same date. I also accept that the HSE's failure to retain the CCTV for 21 December 2022 arose as a result of time taken to transfer the request to the Hospital to retain the footage. On the matter of CCTV for the period between 27 December 2022 and 5 January 2023, I am satisfied that no further records exist, other than those withheld by the HSE under section 37 of the FOI Act. 

For the sake of completeness, I should add that section 52 of the Act provides that where a request has been made in respect of a record, a person who without lawful excuse and with intention to deceive destroys or materially alters a record shall be guilty of an offence and be liable on summary conviction to a class B fine. While the applicant contended that the Hospital deliberately deleted the record to prevent her from accessing CCTV footage of her late father, she has presented no evidence in support of that contention. I have no reason to believe that additional CCTV records were destroyed with the intention to deceive in this case.

It is a matter of some concern that the Hospital provided the applicant with incorrect information concerning the CCTV footage retention period. Nevertheless, in the absence of any evidence to suggest otherwise, I do not believe the applicant was intentionally provided with incorrect information. However, I expect that the Hospital will have learnt from its mistake and I expect it to have revised its procedures at this stage to ensure that it provides accurate information to requesters in future.

I note that the applicant also expressed concerns about the Hospital's failure to comply with its data protection policies. However, as set out above, this review is solely concerned with whether the HSE's decision on her FOI request was justified under the provisions of the FOI Act.

Accordingly, I find that the HSE was justified in refusing, under section 15(1)(a) of the FOI Act, the applicant's request on the ground that further records do not exist apart from those refused under section 37.
Section 37

Section 37(1) of the FOI Act provides that, subject to the other provisions of the section, an FOI body shall refuse a request if access to the record concerned would involve the disclosure of personal information. This does not apply where the information involved relates to the requester (section 37(2)(a) refers). Furthermore, section 37(7) provides for the refusal of a request where access to the record concerned would, in addition to involving the disclosure of personal information relating to the requester, also involve the disclosure of personal information relating to an individual or individuals other than the requester, and where it is not feasible to separate the personal information relating to the requester from that relating to the other party. Such information is commonly referred to as joint personal information.

Section 2 of the Act defines "personal information"� as information about an identifiable individual that (a) would, in the ordinary course of events, be known only to the individual or his/her family or friends, of the individual or (b) is held by an FOI body on the understanding that it would be treated by it as confidential. Section 2 goes on to provide a non-exhaustive list of fourteen categories of personal information, including (i) information relating to the medical history of the individual.

In addition, Paragraph (I) of section 2 of the Act excludes certain information from the definition of personal information, including "... in a case where the individual holds or held office as a director, or occupies or occupied a position as a member of the staff, of a public body, the name of the individual or information relating to the office or position or its functions or the terms upon and subject to which the individual holds or held that office or occupies or occupied that position or anything written or recorded in any form by the individual in the course of and for the purpose of the performance of the functions aforesaid ...".

The exclusion at Paragraph (I) does not exclude all information relating to staff members. The exclusion is intended, essentially, to ensure that section 37 cannot be used to exempt the identity of a public servant in the context of the particular position held, or any records created by the staff member while carrying out his or her official functions, or information relating to the terms conditions and functions of positions. The exclusion does not deprive public servants of the right to privacy generally.

The CCTV footage at issue in this case captures a number of third parties, including the applicant's deceased father, member(s) of the public and staff members of the Hospital.

In her submissions to this Office, the applicant argued that "even where footage is exempt [under FOI], it may be lawful to provide it on a case-by-case basis without infringing data protection legislation if the data controller has taken the reason for the request into account"�. She was of the view that it would "be necessary for the HSE to contract out the redaction process to a specialist organisation in order to comply with its data protection obligations"�. She argued that it was unreasonable for the HSE to withhold the CCTV capture of her late father based on not having the facility to pixelate the images of third parties, "especially, in light of the fact that the third parties will most likely be employees of the HSE and not the public at large and therefore, no harm would be caused to any third party."�

In its submissions to this Office, the HSE argued that the release of the images of the third parties in question would involve the disclosure of personal information relating to those third parties. The HSE essentially argued that the exclusions at Paragraph (I) and (II) do not apply, as the release of those images would involve the disclosure of information that is not captured by those exclusions.

This Office has previously distinguished between the name of a staff member contained in an official record and an image of that staff member captured on CCTV footage, and considered that additional information going beyond mere identification can be derived from such an image that is unrelated to either the position held by the staff member or its functions. Given the nature of the records at issue, I am satisfied that their release would involve the disclosure of personal information relating to individual(s) other than the applicant and that section 37(1) applies. However, that is not the end of the matter as section 37(1) is subject to the provisions of subsections (2) and (5).

Section 37(2)

Section 37(2) of the FOI Act sets out certain circumstances in which the exemption at section 37(1) does not apply. I am satisfied that none of the circumstances in section 37(2) applies to the record in this case.

Section 37(5)

Section 37(5) provides that a request that would fall to be refused under section 37(1) may still be granted where, on balance, (a) the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or (b) the grant of the request would benefit the person to whom the information relates. No argument has been made that the release of the records to the applicant would benefit the third parties shown in the records concerned, nor is it apparent to me how release would do so. I am satisfied that subsection (b) does not apply in the circumstances of this case.

Before I consider the applicability of section 37(5)(a), there are a number of important points to note. First, section 13(4) provides that, subject to the Act, in deciding whether to grant or refuse an FOI request, any reason that the requester gives for the request and any belief or opinion of the FOI body as to the reasons for the request shall be disregarded. In relation to the question of the public interest, this means that I cannot have regard to the applicant's motives for seeking access to the records at issue, except in so far as those motives reflect, or overlap with, what might be regarded as true public interest factors in favour of release of the records, i.e. insofar as the concerns raised in relation to the request may also be matters of general concern to the wider public.

Secondly, it is important to note that the release of records under the FOI Act must be regarded, in effect, as release to the world at large, given that the Act places no constraints on the uses to which a record released under the Act can be put. With certain limited exceptions provided for under the Act, such as under sections 37(2)(a), and 37(8) (which I consider below), FOI is not about granting access to information to particular individuals only and as noted above, a requester's reasons for making a request are generally not of relevance. Thus, records are not released under FOI for any limited or restricted purpose.

All of this means that in considering whether a right of access exists to records under section 37(5)(a) of the Act, any decision to grant access would be on the basis that there is an overriding public interest in the release of the records effectively to the world at large that outweighs the privacy rights of the third party individuals concerned.

In considering where the balance of the public interest lies in this case, I have had regard to section 11(3) of the Act which provides that in performing any functions under the Act, an FOI body must have regard to, among other things, the need to achieve greater openness in the activities of FOI bodies and to promote adherence by them to the principles of transparency in government and public affairs and the need to strengthen the accountability and improve the quality of decision making of FOI bodies. However, in doing so, I have also had regard to the judgment of the Supreme Court in The Minister for Communications, Energy and Natural Resources and the Information Commissioner & Ors [2020] IESC 57 ("the Enet case"�). In that case, the Supreme Court found that a general principle of openness does not suffice to direct release of records in the public interest and "there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure"�. Although the Court's comments were made in cases involving confidentiality and commercial sensitivity, I consider them to be relevant to the consideration of public interest tests generally.

In her submissions to this Office, the applicant argued that it was in the public interest to have all CCTV footage of her father released. She said that her father's next of kin have evidence that his admittance to the Hospital led to his death. She stated that formal complaints had been made to the relevant medical bodies in relation to the medical professionals involved in her father's care. The applicant argued that the information at issue would form part of an investigation into her late father's death at the Hospital. She also said that it was important to her family that they help to prevent any other person admitted to the Hospital from receiving the treatment their father received which, in her view, resulted in his death. The applicant was of the view that such an investigation would not only be of benefit to her late father and his concerned family, but also to others.

It seems to me that the thrust of the applicant's arguments relates to the potential use of the CCTV footage in question as part of an investigation into her father's death or in relation to her complaints about relevant medical personnel. What she has identified appear to me to be essentially private rather than public interests, relating to her family's own complaints with the Hospital. However, it also seems to me that her reasons for seeking access to the records are reflective of a public interest in ensuring that patients at the Hospital receive appropriate levels of care and treatment.

On the other hand, the FOI Act recognises the public interest in the protection of the right to privacy both in the language of section 37 and the Long Title to the Act (which makes clear that the release of records under FOI must be consistent with the right to privacy). It is also worth noting that the right to privacy has a constitutional dimension, as one of the unenumerated personal rights under the Constitution. Privacy rights will therefore be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy. Moreover, even where an overriding public interest in granting the request exists, there is a discretionary element to the application of section 37(5)(a).

As noted above, release under FOI is the equivalent to release to the word at large. I have accepted above that there is a reasonable expectation that CCTV images of staff and other individuals captured on the premises of public bodies will be held in confidence and that they comprise their personal information. I am satisfied that each identifiable individual shown on the CCTV footage concerned has a right to privacy. However, I am also satisfied that while the right to privacy is protected by the Constitution, the protection afforded is a spectrum.

In that regard, it seems to me that there is a difference between, the right to privacy of say, staff members in uniform walking down a corridor while carrying out their functions, or members of the public walking by, and that of a patient seen in the same corridor. This Office takes the view that medical records are inherently private and sensitive. I am satisfied that the same would apply to images of patients in a hospital. In my view, a patient's right to privacy in relation to CCTV footage captured of them in a hospital setting would carry significant weight. That is not to say that a staff member or a member of the public has no right to privacy, but rather that the content, context and circumstances of the images or CCTV footage would have to be considered when weighing the public interest factors at play.

I have carefully examined the CCTV footage in question. It appears to have been taken on the corridor of the Hospital, which seem to be accessible to staff, patients and members of the public. I am satisfied that the only patient captured in the footage concerned is the applicant's deceased father. I am also satisfied that the other individuals visible in the footage appear to be wearing uniforms or their normal clothes and are not obviously patients. That is to say that they are not wearing hospital gowns or nightwear and are not receiving treatment. Based on the information currently available to me, it seems to me that the personal information of such individuals contained in the records is not particularly sensitive. Accordingly, I am satisfied that the weight accorded to the right of privacy of these individuals would not be as strong as that accorded to any patients seen in the same footage.

Nonetheless, in this case, as set out above, I do not consider that there is a strong weight in favour of the release of the records concerned. I can appreciate the reasons why the applicant is seeking access to the records at issue. However, she has not explained how the records will form part of any investigation into her late father's death, nor is it apparent to me from the footage concerned. While I cannot go into any detail as to its contents, it seems to me that the footage in question would provide limited insight into her father's care or into how the HSE carried out its functions in this regard. In the circumstances of this case, it is unclear to me how the release of these specific records would further the public interest identified above.

Having regard to the above, and in light of the strong protection afforded to privacy rights under the FOI Act, I cannot discern a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure of the CCTV footage in this case. Accordingly, I find that the public interest in the release of the CCTV in question for the purposes of ensuring that patients at the Hospital receive appropriate levels of care and treatment does not outweigh the right to privacy of the individuals concerned. I find, therefore, that section 37(5)(a) does not apply in this case.

Section 37(8)

Section 37(8) of the FOI Act provides that notwithstanding subsection (1), the Minister may provide by regulations for the grant of a request where the individual to whom the record concerned relates is dead and the requester concerned is a member of a class specified in the regulations. The relevant regulations are the Freedom of Information Act 2014 (Section 37(8)) Regulations 2016 (S.I. 218 of 2016) (the 2016 Regulations).  The 2016 Regulations provide for the grant of access to the records of a deceased individual if the requester is the spouse or the next of kin of the individual and having regard to all the circumstances, the public interest, including the public interest in the confidentiality of personal information, would on balance be better served by granting than by refusing the request.

In her submissions to this Office, the applicant argued that her deceased father would have consented to the release of all relevant CCTV footage and all of his medical records to his children as next of kin when living. During the course of this review, the HSE stated that it did not dispute that the applicant was the daughter of the deceased and that she was his next of kin under the 2016 Regulations.

However, the fact that the applicant is the next of kin of the deceased does not mean that she is automatically entitled to access any of the CCTV footage. As I have found above, the CCTV footage in question contains images of individuals other than the applicant's deceased father and/or comprises the joint personal information of the deceased which is inextricably linked with that of other individuals, and cannot be separated. The 2016 Regulations do not provide for the release of the personal information of any party other than the relevant deceased person. Neither do they provide for the release to such a requester of the personal information of the deceased person where that is joined to the personal information of any other party. Accordingly, in the circumstances of this case, I am satisfied that the 2016 Regulations do not apply.

Sections 17(4) and 18

For the sake of completeness, I have also considered whether there is an obligation on the HSE under the FOI Act to grant partial access to the CCTV footage with the redaction of third party images.

As noted above, the applicant is of the view that the HSE should "contract out the redaction process to a specialist organisation"� so that the footage can be released.  She also indicated that she considered it "unreasonable"� for the HSE to withhold CCTV footage of her late father on the basis that it did not have the facility to pixelate the images of third parties, who were "most likely "� employees of the HSE"�.

It is important to note that the FOI Act does not require public bodies to create records if none exist, apart from a specific requirement, under section 17(4), to extract records or existing information held on electronic devices. Under section 17(4), where a request relates to data contained in more than one record held on an electronic device by the body concerned, the body must take reasonable steps to search for and extract the records to which the request relates. The reasonable steps are those that involve the use of any facility for electronic search or extraction that existed on the date of the request and was ordinarily used by the FOI body. Where these reasonable steps result in the creation of a new record, that record is, for the purposes of considering whether or not such a new record should be disclosed in response to the request, deemed to have been created on the date of receipt of the request.

In its submissions, the HSE said that while the Hospital holds the CCTV footage electronically, it does not have any in-house facility available to it to pixelate the facial images of the third parties concerned. In the circumstances, I accept that the Hospital is not in a position to use any pre-existing facility for search and extraction in order to provide a pixelated version of the CCTV footage at issue and that section 17(4) does not apply in this case.

Section 18(1) provides, that "if it is practicable to do so", access to an otherwise exempt record shall be granted by preparing a copy, in such form as the head of the FOI body concerned considers appropriate, of the record with the exempt information removed. Section 2 of the Act defines "record"� as including "a copy or part"� of anything falling within the definition of a record.

The personal information relating to the applicant's late father that is contained in the CCTV at issue in this case is inextricably linked to personal information relating to third parties. As I have found that the HSE is not required to redact the images of third parties from the CCTV, I am satisfied that section 18 does not apply in this case.

In conclusion, therefore, I find that the HSE was justified in refusing the applicant's request for a copy of CCTV footage of her late father at a named Hospital on specified dates under section 37(1) of the FOI Act.

Decision

Having carried out a review, under section 22(2), I hereby affirm the decision of the HSE to refuse access, under section 37 of the FOI Act, to CCTV footage on the ground that its disclosure would involve the disclosure of personal information relating to third parties. I find that the public interest, on balance, does not favour its release. I also affirm its decision to refuse access, under section 15(1)(a) of the FOI Act, to additional records falling within the scope of the applicant's request on the ground that no further records exist.

Right of Appeal

Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.

Sandra Murdiff
Investigator