Company A and Health Products Regulatory Authority [2024] IEIC 145140 (19 August 2024)

Background
Scope of Review
Preliminary Matters
Analysis and Findings
Decision
Right of Appeal

Whether the HPRA was justified in part-granting access to a certain inspection record

19 August 2024

Background

This review arises from a decision of the HPRA to part-grant access to a certain record pursuant to an FOI request to which section 38 of the FOI Act applies. Section 38 applies where, at some stage in the decision making process, the FOI body has formed the view that the records at issue qualify for exemption under one or more of the relevant exemptions in the FOI Act (i.e. sections 35, 36 and 37 - relating to information that is confidential, commercially sensitive, or third party personal information, respectively) but that the records should be released in the public interest. Where section 38 applies, the FOI body is required to notify an affected third party before making a final decision on whether or not the exemptions, otherwise found to apply, should be overridden in the public interest. The requester, or an affected third party, on receiving notice of the final decision of the FOI body, may apply directly to this Office for a review of that decision. This case concerns an application for review made by an affected third party company (the applicant).

The HPRA received an FOI request for access to certain inspection reports relating to non-conformities/breaches regarding the Medicinal Products (Control of Advertising) Regulations 2007 (the 2007 Regulations). In correspondence dated 19 October 2022, the HPRA notified the applicant that it was considering the release of an inspection report relevant to the applicant's interests and that its preliminary view was that the public interest would, on balance, be better served by part-granting access to the record. It provided the applicant with a copy of the record, highlighting the parts it intended to redact under sections 35, 36 and 37 of the FOI Act, and on the basis that certain parts of the record do not come within the scope of the specific request. On 8 November 2022, the applicant made submissions to the HPRA arguing that the entire record should be withheld. On 24 November 2022, the HPRA informed the applicant of its decision to grant partial access to the record. It said that it concluded that the additional information in the record did not meet the necessary requirements of sections 35 and 36 of the FOI Act.

On 30 November 2022, the applicant sought a review by this Office of the HPRA's decision. On 10 May 2023, this Office issued a decision wherein we affirmed the decision of the HPRA to grant partial access to the record in question (OIC-132808-M2K5V9). We found that it was justified in granting access to specific information in the record which the applicant argued to be exempt from release under sections 35 and 36 of the FOI Act. The applicant appealed our decision to the High Court. The matter was remitted, on the consent of the parties, to the Commissioner for a fresh-decision.

I have now concluded my fresh review in this case. In conducting the review, I have had regard to the submissions made by the HPRA and the applicant. In submissions made during the course of this review, the applicant directed my attention to submissions made in the above-referenced earlier review and stated that it was reiterating arguments made. I have considered these earlier submissions as well as submissions made during the course of this particular review. For the avoidance of doubt, while I do not intend to repeat all of the submissions made in full in this decision, I confirm that I have had regard to same. I have also had regard to the contents of the record at issue. I have decided to conclude this review by way of a formal, binding decision.

Scope of Review

The record at issue comprises a covering letter from the HPRA to the applicant and an inspection report pertaining to an inspection undertaken by the HPRA in 2019. The scope of this review is limited to the parts of the record which the HPRA has decided to release.

During the course of the remitted review, the HPRA identified a small amount of additional information which it said it did not intend to release. Accordingly, such information will not be considered as part of this review. However, I note that the information in question was considered in the course of a separate review this Office undertook in Case OIC-136425-V3W2D2.

In its submissions dated 19 October 2023, the applicant provided this Office with a copy of the relevant record with additional proposed redactions highlighted. It said that while it continues to maintain that the record should not be disclosed in full, it was proposing certain redactions with a view to resolving the matter. It said that"Should the Commissioner decide that the Record should be disclosed in part we would ask the Commissioner to consider these specific redactions."

In light of those submissions, this Office sought clarification from the applicant as to whether it was withdrawing its opposition to the release of certain information in the record, in line with the proposed redactions provided. The Investigator proposed removing information which the applicant indicated it was amenable to releasing from the scope of the review.

In further submissions dated 13 March 20124, the applicant maintained its position that the record in its entirety is commercially sensitive and confidential and that the public interest does not weigh in favour of release. However, it said it was "open to considering" that the record be released subject to the additional redactions it proposed in its earlier submissions.

I take this to mean that the applicant was prepared to settle the review if this Office deemed the redactions proposed to be appropriate. The redactions proposed by the applicant were extensive and did not, in my view, provide a reasonable basis for attempting to effect a settlement between the applicant and the original requester.

In relation to the redactions proposed, the applicant said "This position respects the public interest identified by the HPRA of ensuring that the public is aware that [the applicant] was deficient in compliance with certain regulatory obligations while also protecting the commercially sensitive information of [the applicant], the principle of candour between the HPRA and regulated entities and ensuring the continued supply of medicines onto the Irish market". This comment suggests that the applicant accepts that the public interest would be better served by the release of the information it proposed for release. However, for the avoidance of any doubt, I have included in the scope of this review all of the information that the HPRA proposed for release.

This review is therefore concerned solely with whether the HPRA was justified in granting access to the relevant parts of the record it has identified for release.

Preliminary Matters

Before I address the substantive issues arising, I wish to make a number of preliminary comments. It is important to note that under section 22(12)(a) of the Act, a decision to grant a request to which section 38 applies shall be presumed to have been justified unless the person to whom the information relates shows to the satisfaction of the Commissioner that the decision was not justified. This means that the onus is on the applicant to satisfy this Office that the HPRA's decision to grant partial access to the record at issue was not justified.

In addition, although I am obliged to give reasons for my decision, section 25(3) of the FOI Act requires me to take all reasonable precautions in the course of a review to prevent disclosure of information contained in an exempt record. This means that the extent to which I can describe the contents of the record is somewhat limited.

Thirdly, as noted above, in its decision letter to the applicant, the HPRA's stated position was that the additional information in the record did not meet the necessary requirements of sections 35 and 36 of the FOI Act. However, it later revised this position and said that information in the records relating to findings of deficiencies is commercially sensitive and confidential but that the public interest weighs in favour of release. The HPRA accepted that its decision letter did not refer to its decision to release information in the public interest. In its submissions, it acknowledged that this was incorrect but noted that, given the ongoing engagement in relation to the request and the records, it believed that its position was now clear. This position was put to the applicant and no further response or specific submissions were received, though the applicant made submissions in respect of the public interest generally. I am satisfied that the applicant is aware of the current position advanced by the HPRA and has been provided with an opportunity to comment on same.

Finally, as has previously been explained to the applicant, a review by this Office is considered to be "de novo", which means that in this case, it is based on the circumstances and the law as they pertain at the time of the decision and is not confined to the basis upon which the FOI body reached its decision. The HPRA has proposed to grant access to the record in part in the public interest. This Office is not limited to examining the application of the public interest balancing test. Rather, in light of the de novo nature of our review, we may consider whether the relevant exemption provisions apply in full, including whether the public interest weighs in favour of release.

Analysis and Findings

The record at issue

In its submissions, the HPRA said it regulates the advertising of human medicinal products in Ireland. It said that its role is to ensure that advertisements for medicinal products are in compliance with the 2007 Regulations. It said that compliance ensures that advertisements are accurate, not misleading and in line with approved product information. The HPRA said it ensures compliance with the 2007 Regulations in a number of ways. It said it performs pre-planned and random compliance reviews of advertisements. It said it also carries out inspections at the offices of marketing authorisation holder companies which advertise human medicinal products in Ireland and investigates complaints in relation to advertisements.

In related submissions made by the HPRA, it said its inspection process may be summarised as follows:

1. Inspection organised

2. Inspection carried out

3. Deficiencies against requirements of the regulations identified

4. Report written by inspectors and sent to inspected party

5. Responses (corrective actions) and timeframes submitted to the HPRA and reviewed by inspectors

6. Further responses or further inspection may be required, based on the responses received

7. Close out of inspection

As noted above, the record at issue in this case comprises a covering letter and an inspection report pertaining to a HPRA inspection of the applicant company in September 2019. The applicant's position is that information in the record which the HPRA decided to release is exempt under sections 35 and 36 of the FOI Act.

Section 35(1) - information obtained in confidence

Section 35 of the Act provides as follows:

(1) Subject to this section, a head shall refuse to grant an FOI request if -

a. the record concerned contains information given to an FOI body, in confidence and on the understanding that it would be treated by it as confidential (including such information as aforesaid that a person was required by law, or could have been required by the body pursuant to law, to give to the body) and, in the opinion of the head, its disclosure would be like to prejudice the giving to the body of further similar information from the same person or other persons and it is of importance to the body that such further similar information as aforesaid should continue to be given to the body, or

b. disclosure of the information concerned would constitute a breach of a duty of confidence provided for by a provision of an agreement or enactment (other than a provision specified in column (3) in Part 1 or 2 of Schedule 3 of an enactment specified in that Schedule) or otherwise by law.

(2) Subsection (1) shall not apply to a record which is prepared by a head or any other person (being a director, or member of the staff of, an FOI body or a service provider) in the course of the performance of his or her functions unless disclosure of the information concerned would constitute a breach of a duty of confidence that is provided for by an agreement or statute or otherwise by law and is owed to a person other than an FOI body or head or a director, or a member of staff of, an FOI body or of such a service provider.

As section 35(1) does not apply where the records fall within the terms of section 35(2), I deem it appropriate to consider the applicability of section 35(2) at the outset. The record at issue in this case was created by HPRA staff in the course of the performance of their functions. Accordingly, for section 35(1) to apply, release of the record must constitute a breach of a duty of confidence that is provided for by an agreement or statute or otherwise by law and is owed to a person other than an FOI body or head or a director, or member of the staff of, an FOI body or of such a service provider.

In its submissions, the applicant said that a large portion of the record involves the recitation of information it provided to the HPRA during the inspection and, as such, the relevant findings are primarily made up of information provided by the applicant, which it considers to be confidential. It said the information was given in circumstances which impose an obligation of confidence on the HPRA. It said the Irish Medicines Board Act 1995 (the 1995 Act) states that members of staff of the HPRA must not disclosure any information obtained while performing their duties, without the consent of the HPRA (section 23 refers). It argued that, as such, the HPRA was under a duty of confidence with respect to the information received while performing its duties under the 1995 Act. It said the information at issue is confidential, even within the applicant's company, with access reserved for selected senior and regulatory personnel.

No argument has been made that the release of the record would constitute a breach of a duty of confidence that is provided for by an agreement in this case. I am also satisfied that the release of the record would not constitute a breach of a duty of confidence that is provided for by statute. While the applicant referenced section 23 of the 1995 Act, the duty of confidence must be provided for by a provision of an enactment other than a provision specified in column (3) in Part 1 or 2 of Schedule 3. Section 23 of the 1995 Act is included in Schedule 3.

I have also considered whether the release of the information in the record would constitute a breach of a duty of confidence that is provided for otherwise by law. A duty of confidence provided for otherwise by law is generally accepted to include a duty of confidence arising in equity.

In the Supreme Court decision in the case ofMahon v Post Publications Ltd [2007] 3 IR 338, Fennelly J confirmed that the requirements for a successful action based on a breach of an equitable duty of confidence, at least in a commercial setting, are found in the judgment of Megarry J inCoco v. A. N. Clark (Engineers) Ltd. [1969] R.P.C. 41, at 47:

"[T]hree elements are normally required if, apart from contract, a case of breach of confidence is to succeed. First, the information itself ... must 'have the necessary quality of confidence about it'. Secondly, that information must have been imparted in circumstances importing an obligation of confidence. Thirdly, there must be an unauthorised use of that information to the detriment of the party communicating it."

Fennelly J summarised or restated the requirements of what he called "the contours" of the equitable doctrine of confidence as follows:

1. "the information must in fact be confidential or secret: it must ... 'have the necessary quality of confidence about it';

2. it must have been communicated by the possessor of the information in circumstances which impose an obligation of confidence or trust on the person receiving it;

3. it must be wrongfully communicated by the person receiving it or by another person who is aware of the obligation of confidence."

While the applicant made submissions in respect of the applicability of section 35(1)(a), it made no specific reference to section 35(2). Nevertheless, it seems to me that the arguments advanced are of relevance to the question of whether section 35(2) applies.

The applicant said that the record contains information about the company's marketing plans and budget breakdowns, interactions with healthcare providers and healthcare companies, brand planning, external funding and other promotional and non-promotional activities. It said the specifics of this information is not in the public domain.

The applicant said that it cooperated with the HPRA as completely as possible with regards to the inspection. It said that staff were made available and responded in detail and with candour to relevant questions. It said that there was no major intervention or supervision from members of its legal department or external legal counsel. It said it ensured staff engagement on the basis that the applicant and the HPRA were acting with the common goal of determining the level of compliance with the relevant legislation. It said that it provided a fulsome response to queries on the understanding that the information provided in the responses was given in confidence and on the understanding that it would be treated as confidential by the HPRA. The applicant said that even within its organisation, information disclosed to the HPRA and contained in the record is considered sensitive, with access reserved for selected senior and regulatory personnel. It said that the minimal redactions proposed by the HPRA do not reflect the extent of the confidential information contained in the record. It referenced particular information which is said was provided on the basis of confidentiality and should be treated in the same manner as the information which the HPRA redacted as exempt. The applicant said that should detailed confidential product and financial information in the record be disclosed, it may have to consider the process by which it discloses information to the HPRA as part of inspections. It recognised the legal requirement to cooperate but noted that the detail of the information provided and input from legal advisers may have to be reconsidered.

In submissions received in respect of the earlier review, the original requester argued that the inspection reports do not involve information obtained in confidence because they are part of a regulatory process where the companies are obliged to cooperate with the regulator and give candid responses to its queries. He argued that they do not involve a voluntary process of disclosure from, for example, members of the public or a concerned employee providing information in private. He suggested that some of the information is relatively old and so its value as commercially sensitive information is highly questionable.

The requester further noted that this Office has previously made a distinction between information communicated to an FOI body, on the one hand, and information that comprises the opinion or observation of the FOI body itself. He argued that where the information consists of opinions and observations formed by members of staff of the FOI body, the opinions and observations are not imparted to them by anyone. He argued that in the present case, the HPRA inspectors prepared their reports as part of their statutory duties and that there is nothing to suggest that disclosure would constitute a breach of a duty of confidence owed to the applicant.

The HPRA's position is that information that is commercially sensitive isprima facie confidential but that the public interest lies in findings of a deficiency being made available to the public. In submissions received, the HPRA drew my attention to a pan-EEA guidance document adopted by the Heads of Medicines Agency and the European Medicines Agency (HMA/EMA Guidance Document on the Identification of Commercially Confidential Information and Personal Data within the Structure of the Marketing Authorisation (MA) Application - Release of Information After the Granting of a Marketing Authorisation ). It said that the document addresses commercially confidential information in a human medicines context and specifically deals with inspection reports. It referenced section 3.3 of the document which states that "[i]nformation on the outcome of inspections (e.g. compliance/non-compliance/outstanding issues to be addressed) is not regarded as confidential, however specific details e.g information regarding facilities and equipment are considered commercially confidential".

The HPRA said that it expects that marketing authorisation holders are aware of this pan-EEA approach in terms of findings of non-compliances/deficiencies. It noted that its approach is slightly more nuanced in that it acknowledges that information may cause commercial harm, is therefore commercially sensitive, but should be released in the public interest.

The above guidance document was brought to the attention of the applicant and it was provided with an opportunity to comment. In response, it said that it does not believe that the guidance note can be relied upon in an overarching manner. It said that the guidance note refers to "information on the outcome of inspections" and that it is not clear how this general statement would apply to the specific statutory definitions and tests in the FOI Act. It said that page 1 of the guidance note recognised the overarching need to consider disclosure in the context of national legislation. It also said that the guidance note covers "GMP inspections and GMP activities" and that the record at issue in this case does not fall properly within the scope of the note. It said that the initial request to the HPRA related to a "non-GMP inspection re commercial activities and projects post Marketing Authorisation".

The acronym GMP in the above submissions appears to refer to Good Manufacturing Practice (GMP). I note that the scope of the guidance document referenced by the HPRA relates to information contained in Marketing Authorisation dossiers. Section 3 of the guidance note states that "these principles apply both to the granting of access to the MA dossier after approval of a marketing authorisation application and to the disclosure of assessment reports".

In response to queries posed in respect of the above guidance, the HPRA said that the principle outlined in the document is that inspection reports are not, in and of themselves, a class of documents which should or will be withheld in full. It noted that it often sees parties asserting that an inspection report should be refused in full but that "clearly, the European approach does not validate this". It said that it does not accept the applicant's position that inspection reports referenced are limited to GMP inspections. It said that the reference to inspections in the guidance document is not solely limited to GMP inspections and it is understood to encompass all inspections that may arise in relation to the activities regulated by a competent authority once a human medicine is placed on the market. It said that, in any event, the guidance document is indicative of the pan-EEA approach, establishing that an inspection report is not to be wholly refused. It referenced the persuasive quality of the guidance document and noted that very little will turn on whether the guidance is limited to GMP inspections.

Having considered the entirety of the guidance note, it seems to me that while it is principally concerned with information relating to the marketing authorisation application, section 3.3 is still instructive in respect of European standards and access to information on inspections. The HMA and EMA consider that information on the outcome of inspections relating to marketing authorisations is generally not regarded as confidential. It seems to me that such an approach can provide an insight into the confidentiality or otherwise of information on the outcome of other types of inspections.

The information at issue in the record comprises findings made by the HPRA. The requester has correctly stated that this Office has previously drawn a distinction between information communicated to an FOI body and information which comprises the opinion or observations of the FOI body or its staff. The Commissioner generally takes the view that in so far as information consists of opinions and observations formed by members of staff of an FOI body, the opinions and observations concerned are not imparted to them by anyone. However, I accept that the disclosure of findings may, in certain cases, also involve the disclosure of information communicated by a relevant party. It can occasionally be difficult to separate observations formed by staff members from information provided. The former may be predicated on the latter. That said, even if information communicated by the third party is contained within an opinion or observation, such information would still need to meet the requirements of the equitable doctrine of confidence outlined above.

As such, even if I was to accept that the inspection findings outlined in the record contain information communicated to the HPRA, for the reasons outlined below I am not satisfied that the information was communicated in circumstances which impose an obligation of confidence or trust on the HPRA.

The circumstances in which the information was communicated must be such that a duty or obligation of confidence is imposed. Relevant considerations might include, for example, whether there were any assurances of confidentiality; the expectations of the parties and the reasonableness of any such expectation; the nature of the information; the purpose for which the information was provided; the functions being performed by the FOI body and the relevance of the information to those functions; and the broader context in which the information is provided and may be disclosed.

The applicant in this case is engaged in regulated activities and the HPRA is the relevant regulatory body. I accept, as a general proposition, that regulated entities such as the applicant would reasonably expect that sensitive commercial information that might come to the attention of the HPRA in the course of an inspection would be treated as confidential. Indeed, it seems to me that the HPRA appropriately considered the contents of the record at issue in this case and withheld information which it deemed to be confidential or commercially sensitive. It has, in my view, reasonably sought to protect certain commercially sensitive information provided by the applicant, including details in respect of Standard Operating Procedures (SOPs) and internal controls, staff numbers, specific products names, third party providers and personal information relating to staff of the applicant company. This approach appears to be in keeping with the European guidance referenced above.

However, this does not mean that all information should be treated as confidential. The relevant parts of the record at issue that fall within the scope of this review essentially comprise a brief high-level summary of the activities of the applicant, the scope of the HPRA's inspection, the advertising activities inspected, the findings following inspection, and the HPRA's conclusions and recommendations. The substantive part of the report comprises the HPRA's findings.

The HPRA is a public body that is subject to the provisions of the FOI Act. When carrying out its functions under the Act it is required to have regard, among other things, to the need to achieve greater openness in its activities and to promote adherence by it to the principle of transparency in government and public affairs. The international guidance referenced above supports an approach of the HPRA not treating as confidential information on the outcome of inspections (e.g. compliance/non-compliance/outstanding issues to be addressed). Moreover, in circumstances where the applicant is a regulated entity under a statutory obligation to cooperate with its regulator, I do not accept that the applicant could reasonably have expected that the HPRA's findings would remain confidential. Considering the totality of the evidence before me, I do not accept that the fact that the disclosure of findings relating to the inspection may involve the disclosure of information provided by the applicant during a statutory inspection could, of itself, impose a broad obligation of confidence on the HPRA such that the release of the details of those findings could give rise to a breach of a duty of confidence.

I would add that I do not accept the applicant's argument that section 23 of the 1995 Act supports its argument that the HPRA was under a duty of confidence with respect to the information received while performing its duties under that Act. By including section 23 of the 1995 Act in the Third Schedule, it seems to me that the Oireachtas clearly did not intend section 23 to prohibit the release of information under FOI. In any event, it is not clear to me that section 23 serves to prohibit the release of information by the HPRA. The section provides that a person shall not, without the consent of the Board, disclose any information obtained by him or her while performing (or as a result of having performed) duties as a member, or a member of the staff of, or an adviser or consultant to, the Board. The Board in question is the Irish Medicines Board, which is now the HPRA. In my view, the purpose of section 23 is to ensure that the staff of the HPRA do not inappropriately disclose information obtained as a result of performing their functions. It does not prohibit the HPRA itself from disclosing information it deems appropriate for release on foot of an FOI request.

In summary, therefore, in light of the above analysis, I find that the release of the information in the record would not constitute a breach of an equitable duty of confidence in this case. Accordingly, I find that, pursuant to section 35(2), section 35(1) does not apply to exempt the information at issue from release.

Section 36(1)(b) - commercially sensitive information

Section 36(1)(b) of the FOI Act provides that an FOI body shall refuse to grant a request if the disclosure of the record sought could reasonably be expected to result in a material financial loss or gain to the person to whom the information relates, or could prejudice the competitive position of the person in the conduct of his or her profession or business or otherwise in his or her occupation. The essence of the text in section 36(1)(b) is not the nature of the information but the nature of the harm which might be occasioned by its release.

The harm test in the first part of section 36(1)(b) is that disclosure "could reasonably be expected to result in material loss or gain". This Office takes the view that the test to be applied is not concerned with the question of probabilities or possibilities but with whether the decision maker's expectation is reasonable. The harm test in the second part of section 36(1)(b) is that disclosure of the information "could prejudice the competitive position" of the person in the conduct of their business or profession. The standard of proof to be met here is considerably lower that the "could reasonably be expected" test in the first part of this exemption. However, this Office takes the view that, in invoking "prejudice", the damage that could occur must be specified with a reasonable degree of clarity.

In its submissions, the applicant said that the entirety of the record is commercially sensitive in the context of the second limb of section 36(1)(b). It pointed to specific information which it said is commercially sensitive and which would prejudice the competitive position of the applicant by giving competitors valuable market insight into the structure of the company. It said that the detail in the record is extensive and provides a comprehensive snapshot of the applicant's marketing plans, interactions with vendors, relationships with healthcare professionals (HCPs) and healthcare organisations (HCOs), brand planning, external funding and other promotional and non-promotional activities.

It said that the record, if released, would provide detailed information to competitors as to the bespoke structure of the company's business and marketing strategy. It provided an example to support its position: a pharmaceutical company entering the Irish market from the US could review the record and gain valuable market insight into the applicant's successful business model. It could copy the unique way in which the company structures its business and approaches sales and this would prejudice the competitive position of the applicant against the new entrant. It said that the same reasoning applies for existing competitors in the Irish market.

In earlier submissions, the applicant said that the information in the record would provide competitors with significant information on the direction the company is headed in the future and could serve to undercut it in the market going forward. It said that the information would be used by competitors to target the applicant, for example in relation to engagement with specific vendors and relationships with HCPs and HCOs. It noted that the remaining un-redacted information presents valuable information for competitors on the particular markets in receipt of funds as indicative of the company's wider market positioning strategy. It acknowledged that the information in question dates from 2019 but said that details of financial allocations, budgeting, relationships and strategy is still relevant to competitors. It noted that the Commissioner has previously accepted that even where information requested is several years old, there was an inherent competitive advantage in knowing the plans of competitors in a market where planning and regulatory frameworks can contribute to long lead in time for projects. It said that the disclosure of the record would result in the company being compromised in its ability to compete in the pharmaceutical industry in Ireland with other pharmaceutical companies who are not subject to the disclosure of the same information.

In later submissions, the applicant directed attention to specific information in the record which it said is not limited to deficiencies but also covers detailed information about internal documents and procedures. In this regard, I note that in respect of certain sections of the record referenced, the HPRA has agreed to redact additional information relating to advertising and promotional budget percentages and costing associated with certain activities. Such information is therefore outside the scope of this review.

The original requester argued that the information in the record is "relatively old" and that its value as commercially sensitive information is "highly questionable". He said he was unclear as to what specific harm could reasonably be expected to occur were the records to be released.

In its submissions, the HPRA said that information in the record relating to findings of deficiencies identified is commercially sensitive but that it considered that the information should be released in the public interest. It said that details of particular SOPs and internal controls, staff numbers in particular areas, specific product names and personal information was redacted as the HPRA regarded this information as commercially sensitive and considered that private interests in not releasing such information over-rode any public interest in release.

The HPRA noted that marketing authorisation holder companies are commercial entities, usually pharmaceutical companies that manufacture medicinal products. It said that such entities are in competition with each other for market share and sales through interaction with, and advertisement to, the public, healthcare professionals and others working in the sector. The HPRA said that in the case of deficiencies found, the release of such information may cause a financial loss to a marketing authorisation holder in that it may impact public confidence in the company and reduce market share and sales. It said that indications of a lack of regulatory compliance may impact share price, contractual negotiations, financial arrangements and other commercial activity. It said that for those reasons, it considered such information to be commercially sensitive.

In respect of the second part of section 36(1)(b), the HPRA noted that the test is lower. It said that as information about market share, market strategy or marketing activities is specific and proprietary, the release of the information would make the relevant company less competitive in the market as against its competitors. It said that competitors could tailor their own strategies in response to the information. It said that, in the case of deficiencies found, release of the information may impact the competitive position of the applicant as it may reduce the number of people purchasing its products due to concerns about the level of compliance with relevant legislative requirements.

The HPRA also made specific submissions in respect of information in the record. In respect of information relating to the structure of the applicant company, the HPRA outlined its opinion that the information would be considered publically available. It directed my attention to the website of the applicant company and said that much of the information is available online. It also made submissions in respect of certain information in the record relating to budgeting, finance and financial grants. It said that it had redacted all product names and by doing so had significantly reduced any potential for commercial harm. It did agree to redact limited additional information in this section of the record.

The HPRA said that in the response it received from the applicant as part of the consultation process, the company said that certain information relating to financial matters was already in the public domain. It referenced the Transfers of Value (ToV) process in this regard. The HPRA said that an industry body, the Irish Pharmaceutical Healthcare Association (IPHA), publishes information on transfers of value from pharmaceutical companies to doctors and other healthcare professionals. It said that the publishing of such information is not an activity that the HPRA regulates, although it said that it does review such information and related activities during its inspections. It said that it can offer no specific commentary on the practice but that it does understand that the financial information in the inspection report relating to sponsorships and grants which was not redacted is published by the IPHA as part of the ToV process and has been since 2016. It said that the information is therefore in the public domain and not amenable to exemption under the FOI Act.

The applicant also made submissions in respect of the ToV process and the HPRA's position. It argued that the HPRA was incorrect and that the FOI Act does not contain a blanket prohibition to the effect that information in the public domain is not amenable to exemption. It referenced section 15(1)(d) and said that it provides that the fact that information is already in the public domain is a discretionary ground upon which an FOI body can refuse an FOI request. It said that the record contains a level of detail and specificity that is not contained in the ToV. It said that the ToV discloses a list of healthcare professionals, addresses and financial disclosures. It said that, in contrast, the record contains detailed breakdowns of its advertising practices and strategies along with internal procedures. It said that the redactions proposed by the HPRA would result in a significant quantity of commercially sensitive and confidential information that is not in the public domain being released.

While I am limited in the extent to which I can describe the record and its contents, I believe it would be useful to outline the type of information at issue in this case. The applicant's position is that information relating to its structure and marketing authorisations and findings in respect of deficiencies identified should be withheld.

In respect of the first category of information, I am not satisfied that high level information about the structure of the company and the number of marketing authorisations held could give rise to the harms set out in section 36(1)(b). The applicant's position is that such information, located at the end of page 3 of the record, is commercially sensitive information which would prejudice the competitive position of the company by giving competitors valuable market insight into the structure of the company. I respectfully disagree. The information highlighted by the applicant for redaction is high-level and while it gives an overview of the company's operation, scale, and scope, I do not accept that the level of detail disclosed could reasonably be expected to result in material financial loss or gain or prejudice to its competitive position. The applicant's own website contains similarly high-level information and directs visitors to a third party website for more information on its products. It seems to me that competitors could glean similarly limited insights from the applicant's website. Even taking into account the low bar associated with the second half of the exemption, I am not satisfied that the release of such high-level information could result in the requisite harms.

The second category of information which the applicant argued is exempt from release relates to the inspection findings of the HPRA. The applicant's submissions again focus primarily on the perceived insights that release of the record could provide to competitors. I have carefully considered the specific contents of the record and the information which the applicant argued should be protected. While I am limited in the extent to which I can describe the details contained in the record, I acknowledge that certain findings made by the HPRA refer to brand presentations and plans and the advertising activities of the company. However, such references are high level and made in the context of the specific findings in question.

The applicant's position is that the detail in the record is "extensive" and would provide detailed information to competitors in respect of the company's business and marketing strategy. I disagree. While the record contains a number of findings, I have considered the actual detail proposed for release. The record does not contain any substantive information about the company's marketing or advertising strategies, other than high level references to presentations and sponsorship activities and findings in respect of same. As noted above, the HPRA has withheld product names and references to internal procedures. The record does contain some limited information in respect of sponsorship activities but it seems to me that any insights offered are already available to competitors through the IPHA's ToV process. I am also conscious that the record in question is now five years old and that some of the matters referenced therein date from 2017 and 2018. Overall, it seems to me that the applicant has significantly overstated the level of detail contained in the records and the resultant insight that competitors could gain.

For the avoidance of doubt, while I note that certain third parties are referenced in the record in the context of the applicant's grant and sponsorship activities, I am not satisfied that any harm could flow to those parties by virtue of the level of detail provided, the historical nature of the engagements, and the fact that certain information is already published through the ToV process.

The applicant's submissions were largely focused on the harms which it anticipated would flow from its competitors gaining an insight into its business strategy and approach. The HPRA, on the other hand, also noted that release may reduce the number of people purchasing the applicant's products due to concerns about the level of compliance with relevant legislative requirements.

I remain unconvinced that the level of detail contained in the record could realistically provide competitors with meaningful insights into the applicant's business. However, in similar cases involving the HPRA and other pharmaceutical companies, I have found that, given the low standard of proof required for the harm in the second part of section 36(1)(b) to apply, the release of details of the findings of deficiencies identified during a HPRA inspection could prejudice the competitive position of the companies concerned. While noting the nature of the deficiencies identified, I accept that the proposed release of the record could potentially prejudice its competitive position in respect of consumer sentiment. While I believe that the specific nature of the findings and the fact that they are largely historical significantly reduces the risk of harm, I accept that the relevant test has been met. I find that section 36(1)(b) applies to information relating to HPRA findings contained in the record.

Having found that section 36(1)(b) applies, I must proceed to consider whether sections 36(2) or 36(3) serve to disapply subsection (1).

Sections 36(2) and 36(3)

Section 36(2) provides for the release of information to which section 36(1) is found to apply in certain circumstances. I am satisfied that none of the circumstances identified at section 36(2) arise in this case.

Section 36(3) provides that section 36(1) does not apply to a case in which the FOI body considers that the public interest would, on balance, be better served by granting than refusing to grant the request.

In considering where the balance of the public interest lies in this case, I have had regard to section 11(3) of the Act which provides that in performing any functions under the Act, an FOI body must have regard to, among other things, the need to achieve greater openness in the activities of FOI bodies and to promote adherence by them to the principles of transparency in government and public affairs and the need to strengthen the accountability and improve the quality of decision making of FOI bodies. In doing so, I have also had regard to the judgment of the Supreme Court inThe Minister for Communications, Energy and Natural Resources and the Information Commissioner & Ors [2020] IESC 57 ("theeNet case"). In that case, the Supreme Court found that a general principle of openness does not suffice to direct release of records in the public interest and "there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure".

Public interest submissions

In earlier submissions made, the applicant said it considered the public interest in transparency and benefit to the public and the public interest in ensuring that private companies can engage in open disclosure with public bodies without compromising their competitive position. It said that while there may be certain instances in which the public interest in disclosure outweighs that of withholding the record, it did not believe this to apply in the current case. It referenced a previous statement of the Commissioner in which he said that he did not believe that the FOI Act was designed as a means by which the operations of private enterprises were to be opened up to scrutiny. It said that the public interest in ensuring information that is commercially sensitive is not subject to public disclosure is in part due to the "chilling effect" that disclosure would have on the dialogue required between regulators and regulated entities. Its position is that disclosure of such information would be to the detriment of functional and effective regulation which it said is integral to the public interest. It said it "appreciates that there is a specific public interest in ensuring regulated entities -� act within the confines of the law". However, it said the HPRA findings identified in the record have already been made public in an anonymised form during a presentation given by the HPRA. The applicant also sought to draw a distinction between the current case and a previous decision of this Office relating to the regulation of fertility clinics. It argued that the subject matters of the current record "arguably have less of an immediate impact on individuals".

In later submissions, the applicant referenced theeNet decision. It acknowledged that there was a public interest in records relating to the HPRA's regulatory activities being made public "in appropriate circumstances". It said that this would enable the public to ensure that the HPRA is carrying out its regulatory functions. However, it said that the public interest does not justify the disclosure of the specific information at issue. It said that such a public interest is not sufficiently connected to the contents of the record in question and exists at a general policy level. It said that given the limited contribution of the record to that public interest, when weighed against the real harm to the commercial interests of the company that would be caused by disclosure, the balance of the public interest lies in not releasing the record.

In further submissions, the applicant again noted that any public interest justifying the disclosure of the record needs to be identified from a scrutiny of the record, as required byeNet . It said that the record discloses very little about how the HPRA conducts its investigations; the record primarily focuses on the applicant and its operations. It said that the public interest should not justify the release of a record that consists primarily of information relating to a private enterprise. It said that if the public interest is in ensuring that the public can witness the HPRA enforcing its regulatory regime, this public interest does not justify the disclosure of an inspection report which specifically identifies the applicant and includes detailed information about it. It said that the release of a completely anonymised report would achieve this public interest.

It said that even if the Commissioner identifies public interests that justify the release of the record, it contends that the public interests in disclosure are insufficient to outweigh the public interest in ensuring commercially sensitive information remains confidential. It said that the annual reports of the HPRA disclose evidence and information relating to its activities in the regulation of relevant entities and their advertising practices. It said that such public reports demonstrate that regulated entities operate within the standard of the law and provide detail on how the HPRA conducts its inspections and regulatory functions. It said that aggregate information on inspections is already available. It said that it does not believe that release of the record would significantly add to public awareness and would have very little appreciable impact on the public interests identified.

Rather, the applicant said that the public interests in support of disclosure must be balanced against the strong public interest in refusing disclosure. It referenced the need to ensure that commercially sensitive information is protected and that private entities can protect their proprietary interests. It also submitted that release may impact public confidence and reduce market share and sales. It said that the information would disclose valuable information to competitors and impinge upon the open and transparent relationship between regulated entities and the HPRA. However, it also stated that it remained fully committed to engaging and cooperating with the HPRA and acknowledged that to do so is a requirement of the relevant legislation. In sum, the applicant submitted that the public interest in disclosure is outweighed by the strong public interest in ensuring that commercially sensitive information is protected.

As noted above, the HPRA's position is that while information relating to deficiencies in terms of advertising compliance is commercially sensitive, such information should be released in the public interest. In its submissions, it said that it is of the view that the public interest lies in findings of a deficiency being made available to the public. It said that it regulates certain activities relating to the advertisement of medicines and that the public have a strong interest in knowing that advertising activities are undertaken within the standards prescribed by law. It said that it is important to the public, for public health reasons generally and specifically for those who use the applicant's products, that the findings of deficiencies are something that can be accessed by the public, under FOI or otherwise.

The HPRA referenced a number of previous decisions of this Office. It referred to the Commissioner's decision-making in those cases and cited reasoning in respect of the public interest. It said that its decision-making was analogous to the previous reviews and that it believes that the release in the public interest of the fact of a deficiency in terms of compliance with legal requirements is the correct approach. It said that in previous decisions, this Office distinguished between releasing information on deficiencies on the one hand, in order for the public to know how a regulated entity's legislative obligations are enforced by the HPRA, and, on the other hand, refusing information specific to a company in terms of internal controls, marketing strategy etc. It said that this is in line with its approach in the current case. In respect of information on deficiencies, the HPRA referenced an interest in the public knowing how a regulated entity's legislative obligations are enforced by the HPRA.

The HPRA also made submissions in respect of an argument advanced by the applicant that the release of a completely anonymised report would achieve the public interest. It said that if the report was anonymised to remove references to the company, a large part of the otherwise redacted text would fall to be released. It said that this would not be the correct approach as the public have a strong interest in knowing specifically which marketing authorisation holders are, or are not, found to be deficient in terms of advertising compliance.

In light of the specific public interest arguments advanced by the public body, and the fact that such detailed analysis was not included in the decision making records issued, this Office notified the applicant of material matters outlined in the HPRA submissions. While the applicant made further submissions in response, these focused on discrete matters relating to the EMA/HMA guidance document above, the IPHA ToV process and its position in respect of additional redactions it outlined in earlier submissions. It did not make any new substantive arguments in respect of the public interest though it said that the HPRA was seeking to release more information than is required to achieve the public interest.

In his submissions in the earlier review, the original requester argued that there is an "obvious public interest" in details concerning non-compliance being released. He said the public should be "given insight into certain practices in the marketing and promotion of drugs among healthcare professionals, especially when the regulator has been critical of such practices".

Public interest analysis

I have carefully considered the submissions received and the content of the record at issue. Section 36(1) is an express recognition of the fact that there is a public interest in the protection of commercially sensitive information. As a general principle, and acknowledging the applicant's submissions in this regard, I do not believe that the FOI Act was designed as a means by which the operations of private enterprises were to be opened up to scrutiny. However, as noted above, information relating to particular products and internal procedures has been redacted by the HPRA, as well as information which it considers to be outside the scope of the request. I have also determined that limited information about the applicant company and its structures does not meet the harm test at section 36(1)(b).

As such, what is at issue here is information about the applicant company in the context of specific findings made by the HPRA. It seems to me that by redacting certain information, the HPRA has sought to mitigate the risks of releasing information that may give rise to the harms identified in section 36(1)(b). Moreover, as noted above, it seems to me that much of the information contained in the records relating to findings is relatively high-level. I have also considered the specific findings at issue, and while I cannot disclose any substantive detail in this regard, it seems to me that any anticipated negative impact on public perception would be very limited. My view is that the likely impact of disclosure on the interest underpinning the exemption is low.

I would also note that while the applicant is a private enterprise, it is one engaged in regulated activities. The disclosure of the information at issue would disclose information relating to the applicant's compliance with the 2007 Regulations and the inspection process in respect of same. It seems to me that Directive 2001/83/EC, to which the 2007 Regulations give effect, and the Regulations have at their heart the protection of public health. For example, Recital 2 of the Directive provides that "the essential aim of any rules governing the production, distribution and use of medicinal products must be to safeguard public health", while Recital 45 provides that "Advertising to the general public, even of non-prescription medicinal products, could affect public health, were it to be excessive and ill-considered. Advertising of medicinal products to the general public, where it is permitted, ought therefore to satisfy certain essential criteria which ought to be defined".

I do not accept the applicant's arguments that release of the record would have "little appreciable impact on the public interests identified". It seems to me that while high-level information about the HPRA's inspection activities may be publically available, the release of inspection reports provides for a level of scrutiny not available in other contexts. Nor do I accept that the nature of the inspection reports limits their importance when compared to other HPRA inspection processes. It seems to me that ensuring that pharmaceutical companies advertise medicinal products in compliance with relevant legislation is an important regulatory goal in the context of public health policy.

Overall, it seems to me that there is a significant public interest in;

the public knowing that entities involved in the advertising of human medicinal products operate within the standards prescribed by law, in this case the 2007 Regulations which the HPRA is required to enforce, and
the public knowing how public bodies carry out inspections in individual cases and that the regulatory functions assigned to them achieve the purpose of the relevant regulations.

Having considered the content of the records in this case, my view is that release of the specific information in the records will serve these public interests by demonstrating the extent of the applicant's compliance with legal standards and by demonstrating the extent of the enforcement activity carried out by the HPRA following the inspection of the applicant.

In my view, the public interests identified are even stronger in circumstances where the matters involved concern public health. It seems to me that the HPRA has sought to strike a balance by deciding to release relevant information that would serve these public interests whilst simultaneously striving to protect sensitive information relating to the applicant the release of which might affect its commercial interests. As I have indicated above, a number of factors serve to mitigate any harms which could arise from disclosure of the remaining information in the relevant records. These include the historical nature of the information and the nature of the specific findings made by the HPRA.

In the circumstances, I am satisfied that the public interest would, on balance, be better served by granting access to the information at issue. I find, therefore, that section 36(3) serves to disapply section 36(1)(b) in this case.

Section 36(1)(c) - contractual or other negotiations

Section 36(1)(c) provides for the mandatory refusal of a request if the record concerned contains information whose disclosure could prejudice the conduct or outcome of contractual or other negotiations of the person to whom the information relates. The standard of proof required to meet this exemption is relatively low in the sense that the test is not whether prejudice or harm is certain to materialise but whether it might do so. Having said that, this Office expects that a person seeking to rely on this exemption would be able to show that contractual or other negotiations were in train or were reasonably foreseen which might be affected by the disclosure and would be able to explain how exactly the disclosure could prejudice the conduct or the outcome of such negotiations.

At the outset, it is important to note that the HPRA did not claim that any of the information in the records was exempt by virtue of section 36(1)(c). That said, it did make limited submissions to the effect that the release of information in respect of regulatory compliance may impact contractual negotiations. It did not substantiate this position.

During the course of the initial review (OIC-132808), the applicant made limited submissions in respect of the application of subsection (c). It said that disclosure of the detail contained in the record would not just benefit competitors but would reduce its ability to secure value in negotiations with vendors. It drew particular attention to the disclosure of its relationship with a named vendor and said that release could affect the confidence of that vendor in the applicant's capacity to meet its contractual obligations putting continued patient support at risk. It said that the information in question would not be the subject of disclosure under the annual ToV reports which only cover HCPs and HCOs. It said that disclosing details around patient support groups and supports provided could also affect the confidence of the patient association representatives in liaising/engaging with the applicant in the future. In submissions made during the course of the current, remitted review, the applicant did not reference or make any arguments in respect of section 36(1)(c), though the relevant Investigator drew its attention to sample questions which relate to the provision in a request for focused submissions. However, the applicant did refer to the earlier submissions made and said that it was reiterating all the arguments made therein. As such, I will consider the application of the subsection.

In respect of the named vendor referenced in the applicant's original submissions, I note that the HPRA has redacted the name of the vendor throughout the record. I do not accept that the remaining high-level information relating to the vendor could result in the harms described by the applicant. Given the specific nature of the information, I do not accept that release could reasonably be expected to negatively affect the confidence of the vendor in the applicant. It seems to me that all vendors and parties engaged with the applicant will or should be aware that they are working with a regulated entity.

The applicant also argued that disclosing details of patient support groups and support provided to them could affect their confidence in engaging with the applicant. It provided limited submissions in this regard and has not identified specific contractual or other negotiations. Having considered the contents of the records, I note that only high-level references are made to patient support groups. As such, I am not satisfied that disclosure of this information could prejudice the conduct or outcome of contractual or other negotiations. It seems to be that the applicant has overstated any possible impact of release of the information on patient support groups.

In addition to the specific submissions referenced above, the applicant also made a broad statement that release of the record would reduce its ability to secure value in negotiations with vendors. No further substantive submissions were made. Having considered the nature of the information proposed for release, I do not accept that disclosure could reasonably be expected to undermine the applicant's negotiations in this way. As noted above, the applicant is a regulated entity and is subject to various legislative requirements. I do not accept that the release of a record relating to such regulation, noting the specific contents and findings therein, could reasonably be expected to result in any such harms. Nor have substantive arguments to that affect been advanced.

Accordingly, I find that the applicant has not satisfied this Office that section 36(1)(c) applies to any of the information in the record.

Other provisions cited

In its submissions to this Office during the course of the original review, the applicant referenced a number of other provisions of the FOI Act. As it stated that it was reiterating arguments previously made, I propose dealing with same briefly.

With reference to the applicability of section 15(1)(d), the applicant said that "relevant sections of the findings from the regulatory inspection are already in the public domain". Section 15 provides for the refusal to grant FOI requests on specified administrative grounds. Section 15(1)(d) provides for the discretionary refusal of a request where the information is already in the public domain. The HPRA said that the record in question and the specific findings of deficiencies are not in the public domain. In any event, it seems to me that it would not be appropriate for me to direct the HPRA to redact occasional sentences or pieces of text from the record on the ground that the applicant can identify such information as being in the public domain. It seems to me that it would not be readily apparent to the reader of the record that such information is publicly available. Moreover, I note that section 15(1)(d) is not mandatory and provides that an FOI body "may" refuse to grant the request in certain circumstances.

The applicant also argued that the release of a redacted copy of the record is not appropriate where the redactions would "render the released material of negligible value". It referenced section 18 of the FOI Act in this regard. It also said that the entirety of the record, "other than salutations", should be redacted. I have considered the applicant's arguments in respect of confidentiality and commercial sensitivity above. Section 18(1) provides, that "if it is practicable to do so", access to an otherwise exempt record shall be granted by preparing a copy, in such form as the head of the FOI body concerned considers appropriate, of the record with the exempt information removed. Section 18(1) does not apply, however, if the copy provided for thereby would be misleading (section 18(2) refers). I am satisfied that the copy of the record for release that is in line with my findings in this case would not be misleading.

Decision

Having carried out a review under section 22(2) of the FOI Act, I hereby affirm the HPRA's decision. I find that it was justified in its decision to grant access to specific information in the record which the applicant argued to be exempt under sections 35 and 36 of the FOI Act.

Right of Appeal

Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.

Stephen Rafferty

Senior Investigator

	[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
	Irish Information Commissioner's Decisions
You are here: BAILII >> Databases >> Irish Information Commissioner's Decisions >> Company A and Health Products Regulatory Authority [2024] IEIC 145140 (19 August 2024) URL: http://www.bailii.org/ie/cases/IEIC/2024/145140.html Cite as: [2024] IEIC 145140

Irish Information Commissioner's Decisions

Company A and Health Products Regulatory Authority