Company A and Health Products Regulatory Authority [2024] IEIC 145145 (03 October 2024)

Background
Scope of Review
Preliminary Matters
Analysis and Findings
Decision
Right of Appeal

Whether the HPRA was justified in part-granting access to records relating to an inspection carried out

3 October 2024

Background

This review arises from a decision of the HPRA to part-grant access to records relating to an inspection undertaken pursuant to an FOI request to which section 38 of the FOI Act applies. Section 38 applies where, at some stage in the decision making process, the FOI body has formed the view that the records at issue qualify for exemption under one or more of the relevant exemptions in the FOI Act (i.e. sections 35, 36 and 37 - relating to information that is confidential, commercially sensitive, or third party personal information, respectively) but that the records should be released in the public interest. Where section 38 applies, the FOI body is required to notify an affected third party before making a final decision on whether or not the exemptions, otherwise found to apply, should be overridden in the public interest. The requester, or an affected third party, on receiving notice of the final decision of the FOI body, may apply directly to this Office for a review of that decision. This case concerns an application for review made by an affected third party company (the applicant).

The HPRA received an FOI request for access to any replies sent to the FOI body by specified companies in response to inspection reports relating to nonconformities/breaches regarding the Medicinal Products (Control of Advertising) Regulations 2007 (the 2007 Regulations). In correspondence dated 14 December 2022, the HPRA notified the applicant that it was considering the release of records relevant to the applicant's interests and that its preliminary view was that the public interest would, on balance, be better served by part-granting access to the records. It provided the applicant with a copy of the records, highlighting the parts it intended to redact under sections 35, 36 and 37 of the FOI Act, and on the basis that certain parts of the records do not come within the scope of the specific request. On 10 January 2023, the applicant made submissions to the HPRA arguing that the records should be refused in full. On 20 January 2023, the HPRA informed the applicant of its decision to grant partial access to the records. It said that it concluded that certain information in the records should be released under the FOI Act. It said that while such information may be confidential or commercially sensitive, it considered that the public interest lies in favour of release.

On 27 January 2023, the applicant sought a review by this Office of the HPRA's decision. On 30 May 2023, this Office issued a decision wherein we affirmed the decision of the HPRA to grant partial access to the records in question (OIC-134642-P5T3T2). We found that it was justified in its decision to grant access to the relevant information which the applicant argued to be exempt from release under sections 35 and 36 of the FOI Act. The applicant appealed our decision to the High Court. The matter was remitted, on the consent of the parties, to the Commissioner for a fresh-decision.

I have now concluded my fresh review in this case. In conducting the review, I have had regard to the submissions made by the HPRA and the applicant. In submissions made during the course of this review, the applicant directed my attention to submissions made in the above-referenced earlier review and stated that it was reiterating arguments made. I have considered these earlier submissions as well as submissions made during the course of this particular review. For the avoidance of doubt, while I do not intend to repeat all of the submissions made in full in this decision, I confirm that I have had regard to same. I have also had regard to the contents of the records at issue. I have decided to conclude this review by way of a formal, binding decision.

Scope of Review

The records at issue comprise a cover letter from the applicant to the HPRA (record 1) and the applicant's response to findings in respect of an inspection undertaken by the HPRA in 2019 (record 2). The scope of the review is limited to the parts of the records which the HPRA has decided to release.

During the course of the remitted review, the HPRA identified a small amount of additional information which it said it did not intend to release. Accordingly, such information will not be considered as part of this review. However, I note that the information in question will be considered in the course of a separate review by this Office on foot of an application for review from the original requester.

In its submissions dated 19 October 2023, the applicant provided this Office with a copy of record 2 with additional proposed redactions highlighted. It said that while it continues to maintain that the records should not be disclosed in full, it was proposing certain redactions with a view to resolving matters. It said that"[S]hould the Commissioner decide that the Records should be disclosed in part we would ask the Commissioner to consider these specific redactions" . I should note that the applicant does not appear to have proposed any further redactions in respect of record 1.

In further submissions dated 13 March 2024, the applicant maintained its position that the records in their entirety are commercially sensitive and confidential and that the public interest does not weigh in favour of release. However, it said that it was "open to considering" that the records be released subject to the additional redactions it proposed in its earlier submissions.

I take this to mean that the applicant was prepared to settle the review if this Office deemed the redactions proposed to be appropriate. The redactions proposed by the applicant were extensive and did not, in my view, provide a reasonable basis for attempting to effect a settlement between the applicant and the original requester.

In relation to the redactions proposed, the applicant said "This position respects the public interest identified by the HPRA of ensuring that the public is aware that [the applicant] was deficient in compliance with certain regulatory obligations while also protecting the commercially sensitive information of [the applicant], the principle of candour between the HPRA and regulated entities and ensuring the continued supply of medicines onto the Irish market". This comment suggests that the applicant accepts that the public interest would be better served by the release of the information it proposed for release. However, for the avoidance of any doubt, I have included in the scope of this review all of the information that the HPRA proposed for release.

This review is therefore concerned solely with whether the HPRA was justified in granting access to the relevant parts of the records it has identified for release.

Preliminary Matters

Before I address the substantive issues arising, I wish to make a number of preliminary comments. It is important to note that under section 22(12)(a) of the FOI Act, a decision to grant a request to which section 38 applies shall be presumed to have been justified unless the person to whom the information relates shows to the satisfaction of the Commissioner that the decision was not justified. This means that the onus is on the applicant to satisfy this Office that the HPRA's decision to grant partial access to the record at issue was not justified.

In addition, although I am obliged to give reasons for my decision, section 25(3) of the FOI Act requires me to take all reasonable precautions in the course of a review to prevent disclosure of information contained in an exempt record. This means that the extent to which I can describe the contents of the record is somewhat limited.

Finally, as has previously been explained to the applicant, a review by this Office is considered to be "de novo", which means that in this case, it is based on the circumstances and the law as they pertain at the time of the decision and is not confined to the basis upon which the FOI body reached its decision. The HPRA has proposed to grant access to the record in part in the public interest. This Office is not limited to examining the application of the public interest balancing test. Rather, in light of the de novo nature of our review, we may consider whether the relevant exemption provisions apply in full, including whether the public interest weighs in favour of release.

Analysis and Findings

The records at issue

In its submissions, the HPRA said it regulates the advertising of human medicinal products in Ireland. It said that its role is to ensure that advertisements for medicinal products are in compliance with the 2007 Regulations. It said that compliance ensures that advertisements are accurate, not misleading and in line with approved product information. The HPRA said it ensures compliance with the 2007 Regulations in a number of ways. It said it performs pre-planned and random compliance reviews of advertisements. It said it also carries out inspections at the offices of marketing authorisation holder companies which advertise human medicinal products in Ireland and investigates complaints in relation to advertisements.

In related submissions made by the HPRA, it said its inspection process may be summarised as follows:

1. Inspection organised

2. Inspection carried out

3. Deficiencies against requirements of the regulations identified

4. Report written by inspectors and sent to inspected party

5. Responses (corrective actions) and timeframes submitted to the HPRA and reviewed by inspectors

6. Further responses or further inspection may be required, based on the responses received

7. Close out of inspection

As noted above, the records at issue in this case comprise a cover letter (record 1) and the applicant's substantive response to a report following an inspection undertaken by the HPRA in September 2019 (record 2). Record 2 comprises a restatement of findings and the applicant's responses to those findings. The applicant's position is that information in the records which the HPRA decided to release is exempt under sections 35 and 36 of the FOI Act.

Section 35(1) - information obtained in confidence

Section 35 of the Act provides as follows:

(1) Subject to this section, a head shall refuse to grant an FOI request if -

a. the record concerned contains information given to an FOI body, in confidence and on the understanding that it would be treated by it as confidential (including such information as aforesaid that a person was required by law, or could have been required by the body pursuant to law, to give to the body) and, in the opinion of the head, its disclosure would be like to prejudice the giving to the body of further similar information from the same person or other persons and it is of importance to the body that such further similar information as aforesaid should continue to be given to the body, or

b. disclosure of the information concerned would constitute a breach of a duty of confidence provided for by a provision of an agreement or enactment (other than a provision specified in column (3) in Part 1 or 2 of Schedule 3 of an enactment specified in that Schedule) or otherwise by law.

In its submissions, the applicant referred specifically to subsection (a) of the exemption provision. However, in later submissions, it also referenced a particular legislative provision in a separate enactment. As such, I deem it appropriate to also consider whether subsection (b) applies to exempt the information in question.

Submissions

In its submissions, the applicant said that at the time of the inspection, it cooperated with the HPRA as completely as possible. It said that it has provided detailed information in the record in respect of the findings of the HPRA. It said that it made personnel available "to the greatest possible extent" and it said that it responded to the HPRA's questions "in detail and with candour". It said that it provided responses "on the understanding that the information provided (which included commercially sensitive information) was given in confidence and on the understanding that it would be treated as confidential by the HPRA".

The applicant said that the record contains information about its marketing plans, interactions with healthcare professionals, organisations and vendors, brand planning, external funding and other activities. It said that the specifics of the information are not in the public domain. It referenced the publication of information contained in the record by the HPRA in March 2020 but said that such publication was in an "anonymous form". It said that within its organisation, information contained in the record is considered sensitive and access is reserved for selected senior and regulatory personnel. It referenced the "potential harm that could result in disclosure of this information to our competitors or the wider public".

The applicant's position is that the redactions made by the HPRA "do not fully reflect the extent of the confidential information contained in the record". It said that information in respect of promotional and non-promotional strategy and vendor relations is information that was provided on the basis of confidentiality. It said that should the information be disclosed it "may have to consider the process by which it discloses information to the HPRA as part of these types of inspections" though it said it recognises that it is required by law to cooperate.

In later submissions, it submitted that the information in the records was given in circumstances which impose an obligation of confidence on the HPRA. It said the Irish Medicines Board Act 1995 (the 1995 Act) states that members of staff of the HPRA must not disclose any information obtained while performing their duties, without the consent of the HPRA (section 23 refers). It argued that, as such, the HPRA was under a duty of confidence with respect to the information received while performing its duties under the 1995 Act.

The applicant said that the responses it provided to the HPRA should be regarded as confidential. It said that while it believes it is in the company's interest to engage with the HPRA and provide explanations and context in its response, it also has an interest in protecting commercially sensitive and confidential information. It said that the giving of future information in responses by relevant regulated entities could be prejudiced if there was an awareness that responses could be disclosed. It referenced the introduction of more legal analysis and oversight.

The applicant referenced guidance published by this Office and correctly noted that it is not necessary that disclosure would definitely prejudice the supply of information; rather what is required is that disclosure would be likely to prejudice the supply of similar information. It submitted that the candid and open communication of information in response documents may be prejudiced by the disclosure of the records and that such disclosure would therefore prejudice the supply of such information in future HPRA investigations.

The HPRA's position is that information that is commercially sensitive is prima facie confidential. In its submissions, it said that it redacted information which it understood comprises commercially sensitive information which was therefore given to the HPRA in confidence. It said that the findings of a deficiency, while considered commercially sensitive and also therefore confidential, were not redacted. It said that it considers that such findings should be released in the public interest. In respect of the question of whether release would be likely to prejudice the giving to the FOI body of further similar information, the HPRA said that "given the powers of the HPRA in terms of obtaining information, it is arguable that this limb of the confidentiality test is difficult to demonstrate". With reference to the specific subsection in question, it said that "the FOI Act clearly foresaw eventualities whereby confidential information included information that was required to be given to the FOI body under law". It said that the exchange and collection of the relevant information is necessary for the HPRA to adequately and appropriately conduct inspections.

In submissions received, the HPRA drew my attention to a pan-EEA guidance document adopted by the Heads of Medicines Agency and the European Medicines Agency(HMA/EMA Guidance Document on the Identification of Commercially Confidential Information and Personal Data within the Structure of the Marketing Authorisation (MA) Application - Release of Information After the Granting of a Marketing Authorisation) . It said that the document addresses commercially confidential information in a human medicines context and specifically deals with inspection reports. It referenced section 3.3 of the document which states that "[i]nformation on the outcome of inspections (e.g. compliance/non-compliance/outstanding issues to be addressed) is not regarded as confidential, however specific details e.g information regarding facilities and equipment are considered commercially confidential".

The HPRA said that it expects that marketing authorisation holders are aware of this pan-EEA approach in terms of findings of non-compliances/deficiencies. It noted that its approach is slightly more nuanced in that it acknowledges that information may cause commercial harm, is therefore commercially sensitive, but should be released in the public interest.

The above guidance document was brought to the attention of the applicant and it was provided with an opportunity to comment. In response, it said that it does not believe that the guidance note can be relied upon in an overarching manner. It said that the guidance note refers to "information on the outcome of inspections" and that it is not clear how this general statement would apply to the specific statutory definitions and tests in the FOI Act. It said that page 1 of the guidance note recognised the overarching need to consider disclosure in the context of national legislation. It also said that the guidance note covers "GMP inspections and GMP activities" and that the record at issue in this case does not fall properly within the scope of the note. It said that the initial request to the HPRA related to a "non-GMP inspection re commercial activities and projects post Marketing Authorisation".

The acronym GMP in the above submissions appears to refer to Good Manufacturing Practice (GMP). I note that the scope of the guidance document referenced by the HPRA relates to information contained in Marketing Authorisation dossiers. Section 3 of the guidance note states that "these principles apply both to the granting of access to the MA dossier after approval of a marketing authorisation application and to the disclosure of assessment reports".

In further submissions, the HPRA said that it does not accept the applicant's position that inspection reports referenced are limited to GMP inspections. It said that the reference to inspections in the guidance document is not solely limited to GMP inspections and it is understood to encompass all inspections that may arise in relation to the activities regulated by a competent authority once a human medicine is placed on the market. It said that, in any event, the guidance document is indicative of the pan-EEA approach, establishing that an inspection report is not to be wholly refused. It referenced the persuasive quality of the guidance document and noted that very little will turn on whether the guidance is limited to GMP inspections.

Having considered the entirety of the guidance note, it seems to me that while it is principally concerned with information relating to the marketing authorisation application, section 3.3 is still instructive in respect of European standards and access to information on inspections. The HMA and EMA consider that information on the outcome of inspections relating to marketing authorisations is generally not regarded as confidential. It seems to me that such an approach can provide an insight into the confidentiality or otherwise of information on the outcome of other types of inspections.

In submissions received in respect of the earlier review, the original requester referenced the requirements under section 35(1)(a) and said that he "cannot see how the four requirements are met in this case". He said that where the information in a record consists of opinions and observations formed by members of staff of an FOI body, the opinions and observations are not imparted by anyone, meaning the first two requirements cannot be fulfilled. He also referenced the question of the future supply of information and said that the HPRA is acting within its statutory powers by carrying out its compliance inspections, which are underpinned by a regulatory framework. He said that the information supply is clearly not voluntary but is part of a regulatory process and the company in question has a duty to cooperate with HPRA inspectors and provide candid responses. He said that the suggestion that releasing unredacted reports or related records would imperil future inspections is not credible.

Analysis

For a record to be exempt under section 35(1)(a) of the FOI Act, four requirements must be satisfied, namely that:

● the information was given to an FOI body in confidence;

● the information was given on the understanding that it would be treated by the FOI body as confidential;

● disclosure of the information would be likely to prejudice the giving to the body of further similar information from the same persons or other persons; and

● it is important to the body that such further similar information should continue to be given to the body.

Record 1 is a brief cover letter attaching the applicant's responses which are contained in record 2. I am not satisfied that the cover letter, which contains no substantive information about the inspection, findings or actions proposed, could be considered to meet any of the above requirements. I do not accept that it constitutes information obtained in confidence.

As noted above, record 2 comprises a restatement of HPRA inspection findings and the applicant's responses to those findings. In respect of the requirements of section 35(1)(a), the first question I must consider is whether the information was given to the HPRA in confidence and on the understanding that it would be treated by the FOI body as confidential. In determining whether the information was given or imparted in confidence, a number of factors may be relevant, for example, the expectations of the person giving the information, any assurances sought regarding the information, or the purpose for which the information was provided. In respect of whether the information was given on the understanding that it would be treated as confidential, factors that may be relevant include the purpose for which the information was sought or provided, the practice, procedure or policy of the FOI body with regard to such information generally, or the nature of the relationship between the provider of the information and the FOI body.

Certain information in record 2 comprises restated findings made by the HPRA. The requester has correctly stated that this Office has previously drawn a distinction between information communicated to an FOI body and information which comprises the opinion or observations of the FOI body or its staff. The Commissioner generally takes the view that in so far as information consists of opinions and observations formed by members of staff of an FOI body, the opinions and observations concerned are not imparted to them by anyone. However, I accept that the disclosure of findings may, in certain cases, also involve the disclosure of information communicated by a relevant party. It can occasionally be difficult to separate observations formed by staff members from information provided. The former may be predicated on the latter. That said, even if information communicated by the third party is contained within an opinion or observation, such information would still need to meet the requirements of the exemption provision.

The applicant in this case is engaged in regulated activities and the HPRA is the relevant regulatory body. I accept, as a general proposition, that regulated entities such as the applicant would reasonably expect that sensitive commercial information that might come to the attention of the HPRA in the course of an inspection would be treated as confidential. Indeed, it seems to me that the HPRA appropriately considered the contents of the record at issue in this case and withheld information which it deemed to be confidential or commercially sensitive. It has, in my view, reasonably sought to protect certain commercially sensitive information provided by the applicant, including details in respect of Standard Operating Procedures (SOPs) and internal controls, staff numbers, specific products names, third party providers and personal information relating to staff of the applicant company. This approach appears to be in keeping with the European guidance referenced above.

However, this does not mean that all information relating to an inspection can be considered to have been given in confidence or on the understanding it would be treated as confidential. The HPRA is a public body that is subject to the provisions of the FOI Act. When carrying out its functions under the Act it is required to have regard, among other things, to the need to achieve greater openness in its activities and to promote adherence by it to the principle of transparency in government and public affairs. The international guidance referenced above supports an approach of the HPRA not treating as confidential information on the outcome of inspections (e.g. compliance/non-compliance/outstanding issues to be addressed). The applicant is an entity regulated by the HPRA. It is under a statutory obligation to cooperate with its regulator. I do not accept that the applicant could reasonably have considered that the information it provided to the HPRA in record 2 was given in absolute confidence, nor do I accept that it was provided on the understanding that it would be treated as confidential. The fact that the HPRA has accepted that certain information in the record is confidential by virtue of its commercial sensitivity does not necessarily mean that all the information in the record is confidential. I would also note that the withheld information is not within the scope of this review and I am not making a determination as to whether that information actually meets the requirements of section 35(1)(a).

It is the circumstances in which the information was imparted and received that is important in determining whether the first two requirements of subsection (a) are met. I do not accept that a regulated entity providing responses to its regulator after a statutory inspection, where that regulator has redacted information it considers to be confidential and commercially sensitive, could be considered to be providing information in confidence or on the understanding that it would be treated by the HPRA as confidential.

Nor do I accept that the information at issue meets the latter requirements of section 35(1)(a). I am not satisfied that the release of the applicant's responses and proposed actions in respect of the HPRA's finding would be likely to prejudice the giving of further similar information from the same person or other persons. Compliance with the 2007 Regulations is required and the Irish Medicines Board Act, 1995, provides that contravention is an offence. It seems to me that it is very much in the interest of relevant entities to provide information to the HPRA during the course of an inspection and to provide explanations, responses and action plans in respect of regulatory findings. Accordingly, I am not satisfied that disclosure would be likely to prejudice the giving to the HPRA of further similar information.

I find, therefore, that the applicant has not satisfactorily shown that the remaining information at issue in the records is exempt from release under section 35(1)(a).

In its submissions, the applicant referenced section 23 of the Irish Medicines Board Act which concerns the disclosure of information. For the avoidance of doubt, I do not accept that the Irish Medicines Board Act imposes a duty of confidence on the HPRA such that the information at issue is exempt under section 35(1)(b). A duty of confidence may be provided for by a provision in an enactment. However, if the provision concerned is specified in Schedule 3 of the FOI Act, section 35(1)(b) does not apply. Section 23 of the Irish Medicines Board Act is specified in Schedule 3 and therefore cannot be relied on for the purposes of section 35(1)(b). In any event, it is not clear to me that section 23 serves to prohibit the release of information by the HPRA. The section provides that a person shall not, without the consent of the Board, disclose any information obtained by him or her while performing (or as a result of having performed) duties as a member, or a member of the staff of, or an adviser or consultant to, the Board. The Board in question is the Irish Medicines Board, which is now the HPRA. In my view, the purpose of section 23 is to ensure that the staff of the HPRA do not inappropriately disclose information obtained as a result of performing their functions. It does not prohibit the HPRA itself from disclosing information it deems appropriate for release on foot of an FOI request. I am satisfied that section 35(1)(b) does not serve to exempt the information at issue.

Section 36(1)(b) - commercially sensitive information

Section 36(1)(b) of the FOI Act provides that an FOI body shall refuse to grant a request if the disclosure of the record sought could reasonably be expected to result in a material financial loss or gain to the person to whom the information relates, or could prejudice the competitive position of the person in the conduct of his or her profession or business or otherwise in his or her occupation. The essence of the text in section 36(1)(b) is not the nature of the information but the nature of the harm which might be occasioned by its release.

The harm test in the first part of section 36(1)(b) is that disclosure "could reasonably be expected to result in material loss or gain". This Office takes the view that the test to be applied is not concerned with the question of probabilities or possibilities but with whether the decision maker's expectation is reasonable. The harm test in the second part of section 36(1)(b) is that disclosure of the information "could prejudice the competitive position" of the person in the conduct of their business or profession. The standard of proof to be met here is considerably lower that the "could reasonably be expected" test in the first part of this exemption. However, this Office takes the view that, in invoking "prejudice", the damage that could occur must be specified with a reasonable degree of clarity.

Submissions

In its submissions, the applicant said that the entirety of information in the records is commercially sensitive in the context of the second limb of section 36(1)(b). It said that the detail in the records is extensive and provides a comprehensive snapshot of its marketing plans, interactions with vendors, relationships with Healthcare Professionals (HCPs) and Healthcare Organisations (HCOs), brand planning, external funding and other promotional and non-promotional activities.

It said that the records, if released, would provide detailed information to competitors as to the bespoke structure of the applicant's business and marketing strategy. It provided an example to support its position: a pharmaceutical company entering the Irish market from the US could review the record and gain valuable market insight into the applicant's successful business model. It could copy the unique way in which the company structures its business and approaches sales and this would prejudice the competitive position of the applicant against the new entrant. It said that the same reasoning applies for existing competitors in the Irish market.

In earlier submissions, the applicant said that the information in the records would provide competitors with significant information on the direction the company is headed in the future and could serve to undercut it in the market going forward. It said that the information could be used by competitors to target the company for example in relation to engagement with specific vendors and relationships with HCPs and HCOs. It said that the remaining unredacted information includes detail in respect of conferences, events and grants given. It said that this represents valuable information for its competitors on the particular markets in receipt of funds and is indicative of the company's wider market positioning strategy. The applicant acknowledged that the information in the records dates from 2019/2020. However, it said that detail in respect of financial allocations, budgeting, relationship and promotional and non-promotional strategy is still relevant to its competitors and may be used to extrapolate useful information. It noted that the Commissioner has previously accepted that even where information requested is several years old, there was an inherent competitive advantage in knowing the plans of competitors in a market where planning and regulatory frameworks can contribute to long lead in time for projects. It said that the disclosure of the record would result in the company being compromised in its ability to compete in the pharmaceutical industry in Ireland with other pharmaceutical companies who are not subject to the disclosure of the same information.

In later submissions, the applicant said the information proposed to be released is not limited to deficiencies but also covers detailed information about internal documents and procedures. It drew attention to information in one particular paragraph of record 2. It said that the level of detail harms its interest in maintaining appropriate confidentiality over internal strategies.

The original requester argued that the records are a number of years old and said that it is unclear as to what specific harm could reasonably be expected to occur were the records to be released.

In its submissions, the HPRA said that information in the records relating to findings of deficiencies identified is commercially sensitive but that it considered that the information should be released in the public interest. It said that details of particular SOPs and internal controls, staff numbers in particular areas, specific product names and personal information was redacted as the HPRA regarded this information as commercially sensitive and considered that private interests in not releasing such information over-rode any public interest in release.

The HPRA said that marketing authorisation holders are commercial entities, usually pharmaceutical companies that manufacture medicinal products. It said that such companies are in competition with each other for market share and sales of their product, through interaction and advertisement to the public and through interaction and advertisement with healthcare professionals and others working in the sector. It provided examples of the form such competition can take. It said that in the case of deficiencies found, release of related information may cause a financial loss in that it may impact public confidence in the marketing authorisation holder and reduce market share and sales. It said that indications of a lack of regulatory compliance may impact on share price, contractual negotiations, financing arrangements and other commercial matters and that the HPRA therefore considered the information to be commercially sensitive.

In respect of the second part of section 36(1)(b), the HPRA noted that the test to be applied is lower. It said that as information about market share, market strategy or marketing activities is specific and proprietary, the release of the information would make the relevant company less competitive in the market as against its competitors. It said that competitors could tailor their own strategies in response to the information. It said that, in the case of deficiencies found, release of the information may impact the competitive position of the applicant as it may reduce the number of people purchasing its products due to concerns about the level of compliance with relevant legislative requirements.

The HPRA also made specific submissions in respect of information in the records. It said that during its consultation with the applicant, the company identified certain information relating to financial matters which it said was already in the public domain. It referenced the Transfers of Value (ToV) process in this regard. The HPRA said that an industry body, the Irish Pharmaceutical Healthcare Association (IPHA), publishes information on transfers of value from pharmaceutical companies to doctors and other healthcare professionals. It said that the publishing of such information is not an activity that the HPRA regulates and that it can offer no specific commentary on the practice but it appears that the financial information in the records that was not redacted and which relates to sponsorship was published by the IPHA since 2016, is therefore in the public domain and would not be amenable to exemption under the FOI Act. In respect of certain other information, which concerned references to a campaign and third parties, the HPRA said that it did not accept the applicant's arguments that a relationship would be negatively affected. It said that the fact that the applicant sponsors the relevant campaign is in the public domain. It said it is difficult to see how the information is either commercially sensitive or confidential.

The applicant also made submissions in respect of the ToV process and the HPRA's position. It argued that the HPRA was incorrect and that the FOI Act does not contain a blanket prohibition to the effect that information in the public domain is not amenable to exemption. It said that section 15(1)(d) of the FOI Act provides that the fact that information is already in the public domain is a discretionary ground upon which an FOI body can refuse an FOI request. It said that the records contain a level of detail and specificity that is not contained in the ToV. It said that the ToV discloses a list of healthcare professionals, addresses and financial disclosures. It said that, in contrast, the record contains detailed breakdowns of its advertising practices and strategies along with internal procedures. It said that the redactions proposed by the HPRA would result in a significant quantity of commercially sensitive and confidential information that is not in the public domain being released.

Analysis

While I am limited in the extent to which I can describe the records and their contents, I believe it would be useful to outline the type of information at issue in this case. As I have noted, record 1 comprises a cover letter which contains no substantive information about the relevant inspection findings or actions proposed by the applicant. I am not satisfied that any of the information remaining at issue in the record meets the harm requirements of section 36(1)(b). Record 2 comprises a restatement of HPRA inspection findings and the applicant's responses and proposed actions. The applicant's submissions focus primarily on the perceived insights that release of the record could provide to competitors. I have carefully considered the specific contents of the record and the information which the applicant argued should be protected. I acknowledge that certain findings and responses refer and relate to brand presentations and plans and the advertising activities of the company. However, such references are high level and made in the context of the specific inspection findings in question.

The applicant's position is that the detail in the record is "extensive" and would provide detailed information to competitors in respect of the company's business and marketing strategy. I disagree. While the record contains reference to findings, responses and proposed actions, I have considered the actual detail proposed for release. The record does not contain any substantive information about the company's marketing or advertising strategies, other than high level references to presentations and sponsorship activities and findings in respect of same. As noted above, the HPRA has withheld product names and references to internal procedures. In respect of the responses and actions proposed by the applicant, while I note that the record contains some detailed information, the information largely relates to how the applicant will ensure compliance with the 2007 Regulations. It does not seem to me that release of the information would provide competitors with insights which could result in any of the harms envisaged by section 36(1)(b). While I must be circumspect in my descriptions, much of the responses are administrative in nature. The record does contain some limited information in respect of sponsorship activities but it seems to me that any insights offered are already available to competitors through the IPHA's ToV process. I am also conscious that the record in question is now 4 years old, that it relates to an inspection undertaken in 2019, and that it contains references to matters which date from 2017 and 2018. Overall, it seems to me that the applicant has significantly overstated the level of detail contained in record 2 and the resultant insights that competitors could gain.

For the avoidance of doubt, while I note that certain third parties are referenced in record 2 in the context of the applicant's grant and sponsorship activities, I am not satisfied that any harm could flow to those parties by virtue of the level of detail provided, the historical nature of the engagements, and the fact that certain information is already published through the ToV process.

The applicant's submissions were largely focused on the harms which it anticipated would flow from its competitors gaining an insight into its business strategy and approach. It made limited submissions in respect of the impact that release might have on public confidence, market share and sales. The HPRA also noted that release may reduce the number of people purchasing the applicant's products due to concerns about the level of compliance with relevant legislative requirements.

I remain unconvinced that the level of detail contained in the record could realistically provide competitors with meaningful insights into the applicant's business. However, in similar cases involving the HPRA and other pharmaceutical companies, I have found that, given the low standard of proof required for the harm in the second part of section 36(1)(b) to apply, the release of details relating to findings of deficiencies identified during a HPRA inspection could prejudice the competitive position of the companies concerned. In light of the specific nature of the findings, it seems to me that any harm that might flow from release of the information at issue wold be quite limited. Moreover, the release of the information at issue wold also involve the disclosure of the applicant's responses and proposed actions, which it seems to me further reduces any potential harm associated with the disclosure of the record. Again, it seems to me that the applicant's concerns are overstated. I also note that the inspection report which the applicant was responding to formed the subject matter of a recent review by this Office (OIC-145140-K0S8D5). I affirmed the HPRA's decision to part-grant the inspection report and directed the release of same. The matter has not been appealed by the applicant. As such, the findings made by the public body will soon be in the public domain. It seems to me that this further limits the harms which could occur should the applicant's responses be released.

However, given the low standard of proof required for the relevant harm to apply, and noting the HPRA's position and the position taken by this Office in similar decisions, I am prepared to accept that the release of details of the HPRA findings and the applicant's response to same could prejudice the applicant's competitive position. I find that section 36(1)(b) applies to the information at issue in record 2.

As I have found that section 36(1)(b) applies, I must also consider whether sections 36(2) or section 36(3) serve to disapply section 36(1). Section 36(2) provides for the release of information to which section 36(1) is found to apply in certain circumstances. I am satisfied that none of the circumstances identified at section 36(2) arises in this case.

Section 36(3) - the public interest

Section 36(3) provides that section 36(1) does not apply to a case in which the FOI body considers that the public interest would, on balance, be better served by granting than refusing to grant the request.

In considering where the balance of the public interest lies in this case, I have had regard to section 11(3) of the Act which provides that in performing any functions under the Act, an FOI body must have regard to, among other things, the need to achieve greater openness in the activities of FOI bodies and to promote adherence by them to the principles of transparency in government and public affairs and the need to strengthen the accountability and improve the quality of decision making of FOI bodies. In doing so, I have also had regard to the judgment of the Supreme Court inThe Minister for Communications, Energy and Natural Resources and the Information Commissioner & Ors [2020] IESC 57 ("the eNet case"). In that case, the Supreme Court found that a general principle of openness does not suffice to direct release of records in the public interest and "there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure".

In earlier submissions made, the applicant said that it considered the public interest in transparency and benefit to the public and the public interest in ensuring that private companies can engage in open disclosure with public bodies without compromising their competitive position. It referenced a previous statement of the Commissioner in which he said that he did not believe that the FOI Act was designed as a means by which the operations of private enterprises were to be opened up to scrutiny. It said that while there may be certain instances in which the public interest in disclosure outweighs that of withholding the record, it does not in this case. Its position is that the public interest is better served by refusing to disclosure the record. For the avoidance of doubt, in the introduction to its submissions, the applicant confirmed that its reference to "the record" relates to the response document (record 2). It said that the public interest in ensuring information that is commercially sensitive is not subject to public disclosure is in part due to the chilling effect that disclosure would have on the dialogue generally required between regulators and regulated entities. It said that disclosure would, in some but not all cases, be to the detriment of functional and effective regulation, which itself is integral to the public interest. It referenced the eNet case and the passage quoted above. It acknowledged that there is a specific public interest in ensuring that regulated entities "act within the confines of the law". However, it said the HPRA findings identified in the record have already been made public in an anonymised form during a presentation given by the HPRA. The applicant also sought to draw a distinction between the current case and a previous decision of this Office relating to the regulation of fertility clinics. It argued that the subject matters of the current record "arguably have less of an immediate impact on individuals".

In later submissions, the applicant again referenced the eNet case and the Supreme Court's finding that an analysis of the contents of the record at issue is essential. It said that there is a public interest in records relating to the HPRA's regulatory activities being made public in appropriate circumstances. It said that this would enable the public to ensure that the HPRA is carrying out its regulatory functions. However, it said that such a public interest does not justify the disclosure of the specific records at issue as it is not sufficiently connected to the contents of the records in question and exists at a level of general policy and given the limited contribution of the records to the public interest, when weighed against the harms effected by disclosure, the balance lies in not releasing the records. The applicant's position is that the record itself discloses very little about how the HPRA conducts its investigations. It said that it primarily focuses on the applicant company and its operations. It said that the public interest should not justify the release of a record that consists, primarily, of information relating to a private enterprise.

The applicant said that if the public interest is in ensuring that the public can witness the HPRA enforcing its regulatory regime, this public interest does not justify the disclosure of an inspection report which specifically identifies the applicant and includes detailed information about it. It said that neither does it justify the release of detailed and prescriptive responses to the findings of the HPRA, which set out the future plans of a private entity. It said that the release of a completely anonymous report would achieve the public interest.

The applicant said that even if the Commissioner identifies public interests that justify the release of the records, it contends that the public interest in disclosure is insufficient to outweigh the public interest in ensuring that commercially sensitive information remains confidential. It again referenced a presentation given by the HPRA and the release of anonymised information. It said that the annual reports of the HPRA also disclose evidence and information in relation to its regulatory activities. It said that these public reports demonstrate that entities involved in the advertising of human medicinal products operation within the standard of the law and provide detail on how the HPRA conducts its inspections and regulatory functions. It said that the public are therefore aware of this and that it does not believe the release of the records at issue would significantly add to this public awareness. It said that release would have very little appreciable impact on the public interests identified.

The applicant said that the public interest must be balanced against the strong public interest in refusing disclosure. It said that there is a strong public interest in ensuring commercially sensitive information is protected and that private entities can protect their proprietary interest. It said that release of the record may impact public confidence in the company and reduce market share and sales. It said that the information in the records contains sensitive findings in relation to the company. It said that release would disclose valuable information to competitors and would necessarily impinge on the open and transparent relationship between regulated private entities and their regulator. It submitted that the limited value to the public interest in disclosure is outweighed by the strong public interest in ensuring that commercially sensitive information is protected.

As noted above, the HPRA's position is that while information relating to deficiencies in terms of advertising compliance is commercially sensitive, such information should be released in the public interest. In its submissions, it said that it is of the view that the public interest lies in findings of a deficiency being made available to the public. It said that it regulates certain activities relating to the advertisement of medicines and that the public have a strong interest in knowing that advertising activities are undertaken within the standards prescribed by law. It said that it is important to the public, for public health reasons generally and specifically for those who use the applicant's products, that the findings of deficiencies are something that can be accessed by the public, under FOI or otherwise.

The HPRA referenced a number of previous decisions of this Office. It referred to the Commissioner's decision-making in those cases and cited reasoning in respect of the public interest. It said that its decision-making was analogous to the previous reviews and that it believes that the release in the public interest of the fact of a deficiency in terms of compliance with legal requirements is the correct approach. It said that in previous decisions, this Office distinguished between releasing information on deficiencies on the one hand, in order for the public to know how a regulated entity's legislative obligations are enforced by the HPRA, and, on the other hand, refusing information specific to a company in terms of internal controls, marketing strategy etc. It said that this is in line with its approach in the current case. In respect of information on deficiencies, the HPRA referenced an interest in the public knowing how a regulated entity's legislative obligations are enforced by the HPRA.

The HPRA also made submissions in respect of an argument advanced by the applicant that the release of a completely anonymised report would achieve the public interest. It said that if the report was anonymised to remove references to the company, a large part of the otherwise redacted text would fall to be released. It said that this would not be the correct approach as the public have a strong interest in knowing specifically which marketing authorisation holders are, or are not, found to be deficient in terms of advertising compliance.

In light of the specific public interest arguments advanced by the public body, this Office notified the applicant of material matters outlined in the HPRA submissions. While the applicant made further submissions in response, these focused on discrete matters relating to the EMA/HMA guidance document above, the IPHA ToV process and its position in respect of additional redactions it outlined in earlier submissions. It did not make any new substantive arguments in respect of the public interest though it said that the HPRA was seeking to release more information than is required to achieve the public interest.

I have carefully considered the submissions received and the specific contents of record 2. Section 36(1) is an express recognition of the fact that there is a public interest in the protection of commercially sensitive information. As a general principle, and acknowledging the applicant's submissions in this regard, I do not believe that the FOI Act was designed as a means by which the operations of private enterprises were to be opened up to scrutiny. However, as noted above, information relating to particular products and internal procedures has been redacted by the HPRA, as well as information which it considers to be outside the scope of the request. The HPRA has also redacted certain information in the record which relates to budget percentages and the other costs of particular commercial activities.

As such, what is at issue here is information about the applicant company in the content of specific findings made by the HPRA and responses the applicant provided. It seems to me that by redacting certain information, the HPRA has sought to minimise the risks of releasing information that may give rise to the harms identified in section 36(1)(b). Furthermore, it seems to me that much of the information contained in the record relating to findings is relatively high-level. I have also considered the specific findings at issue, and while I cannot disclose any substantive detail in this regard, it seems to me that any anticipated negative impact on public perception would be very limited. Moreover, it seems to me that the inclusion in the record of the applicant's responses and proposed actions in respect of the HPRA findings serves to contextualise those findings, thereby significantly reducing the harm associated with the disclosure of those findings. Accordingly, having carefully examined the parts of the records that the HPRA has decided to release, my view is that the impact of disclosure on the interest underpinning the exemption is low.

I would also note that while the applicant is a private enterprise, it is one engaged in regulated activities. The disclosure of the information at issue would disclose information relating to the applicant's compliance with the 2007 Regulations and the inspection process in respect of same. It seems to me that Directive 2001/83/EC, to which the 2007 Regulations give effect, and the Regulations have at their heart the protection of public health. For example, Recital 2 of the Directive provides that "the essential aim of any rules governing the production, distribution and use of medicinal products must be to safeguard public health", while Recital 45 provides that "Advertising to the general public, even of non-prescription medicinal products, could affect public health, were it to be excessive and ill-considered. Advertising of medicinal products to the general public, where it is permitted, ought therefore to satisfy certain essential criteria which ought to be defined".

I do not accept the applicant's arguments that release of the record would have "little appreciable impact on the public interests identified". It seems to me that while high-level information about the HPRA's inspection activities may be publically available, the release of records relating to specific inspections and the steps taken by regulated entities on foot of them provides for a level of scrutiny not available in other contexts. Nor do I accept that the nature of the relevant inspection limits its importance when compared to other HPRA inspection processes. It seems to me that ensuring that pharmaceutical companies advertise medicinal products in compliance with relevant legislation and that they implement appropriate corrective and preventative actions when deficiencies are identified are important regulatory goals in the context of public health policy.

Overall, it seems to me that there is a significant public interest in:

● the public knowing that entities involved in the advertising of human medicinal products operate within the standards prescribed by law, in this case the 2007 Regulations which the HPRA is required to enforce; and

● the public knowing how public bodies carry out inspections in individual cases and that the regulatory functions assigned to them achieve the purpose of the relevant regulations.

Having considered the content of the record at issue, my view is that release of the specific information in the record will serve these public interests by demonstrating the extent of the applicant's compliance with legal standards, the extent of the enforcement activity carried out by the HPRA following the inspection of the applicant company, and the extent of corrective and preventative actions proposed and undertaken by the applicant on foot of the inspection.

While noting that the record at issue comprises a response to the HPRA, rather than the original inspection report (which as noted above was the subject of a related review OIC-145140-K0S8D5), I am satisfied that the public interests identified above extend to the full HPRA inspection process, as outlined at the outset. Engagement with regulated entities on foot of findings and a requirement that corrective and preventative action plans be provided would appear to be a crucial aspect of such regulation and forms part of the HPRA's stated inspection process.

In my view, the public interests identified are even stronger in circumstances where the matters involved concern public health. It seems to me that the HPRA has sought to strike a balance by deciding to release relevant information that would serve these public interests whilst simultaneously striving to protect sensitive information relating to the applicant the release of which might affect its commercial interests. As I have indicated above, a number of factors serve to mitigate any harms which could arise from disclosure of the remaining information in the relevant records. These include the historical nature of the information, the nature of the specific findings made by the HPRA and the fact that the record includes the applicant's responses and proposed actions.

In the circumstances, I am satisfied that the public interest would, on balance, be better served by granting access to the information at issue. I find, therefore, that section 36(3) serves to disapply section 36(1)(b) in this case.

Section 36(1)(c) - contractual or other negotiations

Section 36(1)(c) provides for the mandatory refusal of a request if the record concerned contains information whose disclosure could prejudice the conduct or outcome of contractual or other negotiations of the person to whom the information relates. The standard of proof required to meet this exemption is relatively low in the sense that the test is not whether prejudice or harm is certain to materialise but whether it might do so. Having said that, this Office expects that a person seeking to rely on this exemption would be able to show that contractual or other negotiations were in train or were reasonably foreseen which might be affected by the disclosure and would be able to explain how exactly the disclosure could prejudice the conduct or the outcome of such negotiations.

As the outset, it is important to note that the HPRA did not claim that any of the information in the records was exempt by virtue of section 36(1)(c). That said, it did make limited submissions to the effect that the release of information in respect of regulatory compliance may impact contractual negotiations. It did not substantiate this position.

During the course of the initial review (OIC-134642), the applicant made limited submissions in respect of the application of subsection (c). It said that disclosure of the detail contained in the record would not just benefit its competitors but would reduce its ability to secure value in negotiations with HCPs and other parties. It drew particular attention to the disclosure of its relationship with a named vendor and said that release could affect the confidence of that vendor in the applicant's capability to meet its contractual obligations putting continued patient support at risk. It said that this information would not be the subject of disclosure under the annual ToV process which it said only covers HCPs and HCOs. It said that disclosing details around patient support groups and support provided to them could also affect the confidence of patient association representatives in liaising/engaging with the applicant in the future.

In submissions made during the course of the current, remitted review, the applicant did not reference or make any arguments in respect of section 36(1)(c), though the relevant Investigator drew its attention to sample questions which relate to the provision in a request for focused submissions. However, the applicant did refer to the earlier submissions made and said that it was reiterating all the arguments made therein. As such, I will consider the application of the subsection.

In respect of the named vendor referenced in the applicant's original submissions, I note that the HPRA has redacted the name of the vendor throughout the record. I do not accept that the remaining high-level information relating to the vendor could result in the harms described by the applicant. Given the specific nature of the information, I do not accept that release could reasonably be expected to negatively affect the confidence of the vendor in the applicant. It seems to me that all vendors and parties engaged with the applicant will or should be aware that they are working with a regulated entity.

The applicant also argued that disclosing details of patient support groups and support provided to them could affect their confidence in engaging with the applicant. It provided limited submissions in this regard and has not identified specific contractual or other negotiations. Having considered the contents of the records, I note that only high-level references are made to patient support groups. As such, I am not satisfied that disclosure of this information could prejudice the conduct or outcome of contractual or other negotiations. It seems to be that the applicant has overstated any possible impact of release of the information on patient support groups.

In addition to the specific submissions referenced above, the applicant also made a broad statement that release of the record would reduce its ability to secure value in negotiations. No further substantive submissions were made. Having considered the nature of the information proposed for release, I do not accept that disclosure could reasonably be expected to undermine the applicant's negotiations in this way. As noted above, the applicant is a regulated entity and is subject to various legislative requirements. I do not accept that the release of a record relating to such regulation, noting the specific contents and findings therein, could reasonably be expected to result in any such harms. Nor have substantive arguments to that effect been advanced.

Accordingly, I find that the applicant has not satisfied this Office that section 36(1)(c) applies to any of the information in the record.

Other provisions cited

In its submissions to this Office during the course of the original review, the applicant referenced a number of other provisions of the FOI Act. As it stated that it was reiterating arguments previously made, I propose dealing with same briefly.

With reference to the applicability of section 15(1)(d), the applicant said that "relevant sections of the findings from the regulatory inspection are already in the public domain". Section 15 provides for the refusal to grant FOI requests on specified administrative grounds. Section 15(1)(d) provides for the discretionary refusal of a request where the information is already in the public domain. The HPRA said that the record in question and the specific findings of deficiencies are not in the public domain. In any event, it seems to me that it would not be appropriate for me to direct the HPRA to redact occasional sentences or pieces of text from the record on the ground that the applicant can identify such information as being in the public domain. It seems to me that it would not be readily apparent to the reader of the record that such information is publicly available. Moreover, I note that section 15(1)(d) is not mandatory and provides that an FOI body "may" refuse to grant the request in certain circumstances.

The applicant also argued that the release of a redacted copy of the record is not appropriate where the redactions would "render the released material of negligible value". It referenced section 18 of the FOI Act in this regard. It also said that the entirety of the record, "other than salutations", should be redacted. I have considered the applicant's arguments in respect of confidentiality and commercial sensitivity above. Section 18(1) provides, that "if it is practicable to do so", access to an otherwise exempt record shall be granted by preparing a copy, in such form as the head of the FOI body concerned considers appropriate, of the record with the exempt information removed. Section 18(1) does not apply, however, if the copy provided for thereby would be misleading (section 18(2) refers). I am satisfied that the copy of the record for release that is in line with my findings in this case would not be misleading.

Decision

Having carried out a review under section 22(2) of the FOI Act, I hereby affirm the HPRA's decision. I find that it was justified in its decision to grant access to specific information in the records which the applicant argued to be exempt under sections 35 and 36 of the FOI Act.

Right of Appeal

Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.

Stephen Rafferty

Senior Investigator

	[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
	Irish Information Commissioner's Decisions
You are here: BAILII >> Databases >> Irish Information Commissioner's Decisions >> Company A and Health Products Regulatory Authority [2024] IEIC 145145 (03 October 2024) URL: http://www.bailii.org/ie/cases/IEIC/2024/145145.html Cite as: [2024] IEIC 145145

Irish Information Commissioner's Decisions