Whether the Defence Forces was justified in refusing access to two records concerning the unauthorised accessing of medical files

14 February 2024

Background

The applicant's FOI request of 21 April 2023 requested access to correspondence between six named personnel (including reports), regarding the alleged unauthorised accessing of medical files. He sought records dating from 1 January 2022 to 31 March 2023.

The Defence Forces' decision of 18 August 2023 listed three records. It said that it was withholding them under sections 32(1)(a)(i) (investigation of offences) and 32(1)(a)(ii) (enforcement of any law) of the FOI Act.

The applicant sought an internal review on 18 August 2023. On 19 September 2023, the Defence Forces affirmed its refusal of the request.

On 19 September 2023, the applicant applied to this Office for a review of the Defence Forces' decision. During the review, the Defence Forces agreed to release record 3. 

I have now completed my review in accordance with section 22(2) of the FOI Act and I have decided to conclude it by way of a formal, binding decision. In carrying out my review, I have had regard to the above exchanges, to correspondence between this Office, the Defence Forces and the applicant, to the contents of the records at issue and to the provisions of the FOI Act.

Scope of Review

The scope of this review is confined to whether the Defence Forces' refusal of access to the two remaining records was justified under the FOI Act.

The applicant expresses concern at how few records the Defence Forces identified further to his request. However, the adequacy of the Defence Forces' searches for records does not form part of my review, because the applicant did not raise the issue at internal review stage. I have advised him of this. He is also aware that it is open to him to make a fresh request to the Defence Forces for the further records which he says should be covered by the FOI request.

The applicant is also dissatisfied with how the Defence Forces has dealt with his FOI requests generally. His initial correspondence with this Office says that his medical records were accessed without authorisation, and that the Defence Forces' refusal to provide him with any information on the issue delayed him from pursuing certain matters with another public body. However, a review carried out under section 22 of the FOI Act cannot examine such issues. Neither can I take account of the applicants views on the matters concerned.

Preliminary Matters

Section 13(4) of the FOI Act provides that, subject to the Act, in deciding whether to grant or refuse an FOI request, any reason that the requester gives for the request and any belief or opinion of the FOI body as to the reasons for the request shall be disregarded.

Section 25(3) of the Act requires me to take all reasonable precautions in the performance of my functions to prevent the disclosure of information contained in an exempt record or that would cause the record to be exempt if it contained that information. Accordingly, I am also limited in the extent to which I can describe certain queries I put to the Defence Forces and its replies.

Release of records under FOI is generally understood to have the same effect as publishing them to the world at large, given that the Act places no constraints on the uses to which the information contained in those records may be put.

Finally, inThe Minister for Communications, Energy and Natural Resources and the Information Commissioner & Ors, [2020] IESC 5 (the eNet judgment), the Supreme Court said that "it is the FOI body that must explain and justify a conclusion that the records are exempt by reference to the relevant provisions of the Act, and equally, it is the FOI body that must explain why the public interest does not justify release in the public interest." I also note that, in the Supreme Court case ofSheedy v the Information Commissioner([2005] IESC 35) Kearns, J. made it clear that a general prediction without any supporting evidence is not sufficient to satisfy the requirement that access to the record could reasonably be expected to result in the outcome envisaged. He stated that "[a] mere assertion of an expectation of [prejudice] could never constitute sufficient evidence in this regard".

However, while FOI bodies must justify their decisions, the eNet judgment in particular also says that a failure by an FOI body to do so does not lead to an inevitable or statutorily mandated outcome. Rather, this Office must adjudicate the merits of the decision to refuse by reason of an analysis of the records and the interests engaged, which might suggest either disclosure or refusal.

Defence Forces' decision making

Finally, I wish to draw the Defence Forces' attention to the FOI Act's requirements for the issuing of original and internal review decisions. In particular, sections 13(1) and 21(4) require FOI bodies to issue original and internal review decisions within four and three weeks, respectively, after receipt of the FOI request or application for internal review. As set out above in the Background section, the Defence Forces did not adhere to these requirements in this case.

Furthermore, sections 13(2)(d) and 21(5)(c) require that, where an FOI body decides to refuse to grant a request, the notification of the decision shall specify various matters, including the reasons for the refusal and the findings on any material issues relevant to the decision. As I will comment on further below, the Defence Forces' decisions do not explain how disclosure of the records could result in the harms it claims could arise from such release.

The Defence Forces may wish to have regard to theguidance for FOI bodiesthat is available on thewebsite of the Department for Public Expenditure and Reform's Central Policy Unit(CPU). In addition, the Minister for Public Expenditure and Reform has published a Code of Practice (the Code) for public bodies pursuant to section 48 of the Act, which is also available on the CPU's website. The Code includes key details relevant to the processing of requests and the contents of decisions. Under section 48(3) of the FOI Act, public bodies must have regard to the Code in the performance of their functions under the Act.

Analysis and Findings

The Defence Forces claim that both records are exempt under sections 32(1)(a)(i) and 32(1)(a)(ii) of the FOI Act. However, record 1 identifies a number of individuals. I intend to consider these details under section 37 (personal information).

I informed the applicant that it was open to me to consider section 37 in relation to this excerpt of record 1. Although his response comments on the adequacy of the Defence Forces' searches for records, he does not appear to make any arguments of particular relevance to section 37.

Section 37 -" personal information

Section 37(1)

Section 37(1) of the FOI Act provides that, subject to the other provisions of the section, an FOI body shall refuse a request if access to the record concerned would involve the disclosure of personal information (including personal information relating to a deceased individual).

Section 2 of the FOI Act defines the term "personal information" as information about an identifiable individual that would, in the ordinary course of events, be known only to the individual or his/her family or friends, or information about the individual that is held by a public body on the understanding that it would be treated as confidential. Section 2 also provides that, without prejudice to the generality of the above definition, personal information includes 14 specific categories of information, such as (iii) information relating to the employment or employment history of the individual and (vi) information relating to any criminal history of, or the commission or alleged commission of any offence by, the individual.

However, section 2 also excludes certain information, including names, from what may be considered as personal information where public servants and contractors are concerned. Generally speaking, the exclusion is intended to ensure that section 37 will not be used to exempt the identity of a public servant or contractor in the context of the particular position held, or any records created by the staff member or contractor while carrying out his or her official functions. The exclusion does not deprive staff members or contractors of the right to privacy generally.

Analysis

The relevant details are from the sentence on page 1 of record 1 ending with "-� access are: ", to the sentence on page 2 of the record starting with "References 2 and -�".

Bearing in mind the requirements of section 25(3), I can say that the relevant details, on their face, list and identify individuals with access to a medical records system. I presume that these individuals are either public servants and/or service providers.

However, it is relevant that record 1 was created in the context of the alleged unauthorised accessing of medical files. Furthermore, the Defence Forces says that an ongoing MP investigation may extend to the actions of the named parties. In other words, the details disclose the identity of individuals whose actions may be investigated.

In the circumstances, I am satisfied that the relevant details comprise information falling within example (iii) and/or (vi) above. Having particular regard to the context of alleged wrongdoing, I am also satisfied that the details are not covered by the exceptions in section 2. I am satisfied that they comprise personal information relating to the parties concerned and I find that section 37(1) applies.

Noting the applicant's position that his medical records were accessed without authorisation, it could be argued that the details also comprise personal information relating to him. However, if this is the case, I am satisfied that the applicant's personal information would be inextricably linked to that of the identifiable third parties (joint personal information). Therefore, section 37(7) would be relevant. Section 37(7) provides that, notwithstanding section 37(2)(a) (see below), access to a record shall be refused where access to it would, in addition to involving the disclosure of personal information relating to the requester, also involve the disclosure of personal information relating to an individual or individuals other than the requester. 

I will now consider sections 37(2) and (5) of the FOI Act.

Section 37(2) - exceptions to section 37(1)

Section 37(2) of the FOI Act sets out certain circumstances in which 37(1) does not apply.

In particular, section 37(2)(a) provides for the grant of access to personal information relating to the requester. As explained above, it could be argued that the details comprise the joint personal information of the applicant and the identifiable third parties. However, I am satisfied that if this is the case, section 37(2)(a) would not apply in light of the provisions of section 37(7).

I am satisfied that the remaining circumstances set out in section 37(2) do not arise.

Section 37(5)

Section 37(5) provides that a request that would fall to be refused under section 37(1) may still be granted where, on balance (a) the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or (b) the grant of the request would benefit the person to whom the information relates. I have no reason to consider that section 37(5)(b) applies.

Before I consider the applicability of section 37(5)(a), there are a number of important points to note. First, section 13(4) provides that, subject to the Act, in deciding whether to grant or refuse an FOI request, any reason that the requester gives for the request and any belief or opinion of the FOI body as to the reasons for the request shall be disregarded. In relation to the question of the public interest, this means that I cannot have regard to an applicant's motives for seeking access to the records at issue, except in so far as those motives reflect, or overlap with, what might be regarded as true public interest factors in favour of release of the records, i.e. insofar as the concerns raised in relation to the request may also be matters of general concern to the wider public.

Secondly, it is important to note that the release of records under the FOI Act must be regarded, in effect, as release to the world at large, given that the Act places no constraints on the uses to which a record released under the Act can be put. With certain limited exceptions provided for under the Act, which are not relevant here, FOI is not about granting access to information to particular individuals only. Furthermore, as noted above, a requester's reasons for making a request are generally not of relevance. Thus, records are not released under FOI for any limited or restricted purpose.

All of this means that, in considering whether a right of access exists to records under section 37(5)(a) of the Act, any decision to grant access would be on the basis that there is an overriding public interest in the release of the records effectively to the world at large that outweighs the privacy rights of the third party individuals concerned.

In considering where the balance of the public interest lies in this case, I have had regard to section 11(3) of the Act which provides that in performing any functions under the Act, an FOI body must have regard to, among other things, the need to achieve greater openness in the activities of FOI bodies and to promote adherence by them to the principles of transparency in government and public affairs and the need to strengthen the accountability and improve the quality of decision making of FOI bodies. However, in doing so, I have again had regard to the eNet judgment. In relevant part, the Supreme Court found that a general principle of openness does not suffice to direct release of records in the public interest and "there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure". Although the Court's comments were made in cases involving confidentiality and commercial sensitivity, I consider them to be relevant to the consideration of public interest tests generally.

The applicant's most recent correspondence indicates that the matters he was pursuing with the other public body have now concluded. In any event, he says that there is a public interest in knowing about the management of systems for storing confidential medical data, which are paid for by public monies. He says also that it is in the public interest to know how, and when, issues are investigated when they arise.

In my view, disclosing the relevant details would provide a small amount of insight into how the Defence Forces stores, and manages the security of, medical data. Disclosure would also provide a very limited insight into the ongoing MP investigation, by identifying those whose actions might be examined.

On the other hand, the FOI Act recognises the public interest in the protection of the right to privacy both in the language of section 37 and the Long Title to the Act (which makes clear that the release of records under FOI must be consistent with the right to privacy). It is also worth noting that the right to privacy has a constitutional dimension, as one of the un-enumerated personal rights under the Constitution. Privacy rights will therefore be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy. Moreover, even where an overriding public interest in granting the request exists, there is a discretionary element to the application of section 37(5)(a).

In considering the weight of this public interest, it is relevant that disclosure of the details must be regarded as being effectively, or at least potentially, to the world at large. In my view, revealing to the world at large that a person's actions may become subject to an investigation would result in a significant breach of that person's right to privacy.

I have given the matter careful consideration. I do not accept that the public interest in releasing the details outweighs, on balance, the privacy rights of the various third parties. I find, therefore, that section 37(5)(a) does not apply.

Section 32(1)(a)(i) - investigation of offences/procedures employed

Section 32(1)(a)(ii) - enforcement etc. of any law

I will now consider the Defence Forces' application of sections 32(1)(a)(i) and (ii) to record 2 and to the remainder of record 1 (the remaining details).

Section 32(1)(a)(i) provides that a head may refuse to grant an FOI request if access to the record concerned could, in the opinion of the head, reasonably be expected to prejudice or impair the prevention, detection or investigation of offences, the apprehension or prosecution of offenders or the effectiveness of lawful methods, systems, plans or procedures employed for the purposes of the matters aforesaid. Section 32(1)(a)(i) provides that a head may refuse to grant an FOI request if access to the record concerned could, in the opinion of the head, reasonably be expected to prejudice or impair the enforcement of, compliance with or administration of any law. These exemptions are subject to a public interest test; however, the public interest test requires consideration only where certain limited circumstances exist (section 32(3)).

Generally speaking, section 32(1)(a) is a harm based exemption. Where an FOI body relies on this provision, it should identify the potential harm to the matters specified in the relevant sub-paragraph that might arise from disclosure. For instance, in relation to a claim under section 32(1)(a)(i), the FOI body should identify the relevant function or the relevant lawful methods, systems, plans or procedures. In relation to a claim under section 32(1)(a)(ii), it should identify the relevant law and explain whether it is the enforcement of, the compliance with, or the administration of that law that is at issue. In relation to both exemptions, it should then describe the nature of the prejudice or impairment expected (the harm), and explain how release of the particular record is expected to cause that harm and why it is considered that the harm identified could reasonably be expected to occur.

A mere assertion of an expectation of harm is not sufficient. Furthermore, while granting access to a record may be likely to have some effect, or while a record may relate to matters specified in paragraphs (i) to (x), it is not necessarily the case that disclosure could reasonably be expected to prejudice or impair the relevant specified matter.

Analysis of the parties' arguments

The applicant says that he has been affected by his medical records having been accessed without authorisation, and as described earlier, that there are various public interests in disclosure of the records.

I have already mentioned the limited explanation given in the Defence Forces' decisions. These say only that the withheld records may be pertinent or relevant to a Military Police (MP) investigation, and that their release at this time could reasonably be expected to prejudice, impair or compromise such an investigation. When inviting its submissions, I outlined my views on the nature of the withheld records. I cannot include my views here due to the requirements of section 25(3), but I also said that I could see no reason for the records to qualify for exemption under section 32(1)(a)(i) or (ii).

The Defence Forces' submission refers to the ongoing MP investigation, and to that part of record 1 which I have found to be exempt under section 37. However, it does not comment on the rest of record 1, or explain how disclosure thereof could give rise to the harms it envisages. It explains why record 2 was created, and says that disclosure of certain details therein "could cause a significant amount of disruption to the Defence Forces if released". However, it neither describes this disruption nor explains how it could result from disclosure of the relevant information in record 2. It does not identify any relevant law for the purposes of its claim under section 32(1)(a)(ii).

While the remaining details may in some way relate to an ongoing MP investigation or to the enforcement of unspecified military and/or other laws (or, as asserted, cause disruption if released), this does not mean that they qualify for exemption under sections 32(1)(a)(i) or (ii). It is not apparent to me from the particular nature of details at issue, or from the Defence Forces' submission, how their disclosure could reasonably be expected to cause in the harms set out in these provisions of the FOI Act. Having given the matter careful consideration, I find that the remaining details are not exempt under section 32(1)(a)(i) or section 32(1)(a)(ii). In the circumstances, there is no need for me to consider section 32(3).

Decision

Having carried out a review under section 22(2) of the FOI Act, I hereby vary the Defence Forces' decision. I find that section 37(1) applies to part of record 1 (i.e. from the sentence on page 1 ending with "-� access are: ", to the sentence on page 2 starting with "References 2 and -�"). I find that the remainder of record 1, and record 2, are not exempt from release and I direct the Defence Forces to grant access to the details concerned.

Right of Appeal

Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated by the applicant not later than eight weeks after notice of the decision was given, and by any other party not later than four weeks after notice of the decision was given.

Anne Lyons
Investigator