Case number: OIC-135077-R2Z0H8
9 October 2023
This review arises from the decision of the HPRA to part-grant access to a certain record pursuant to an FOI request to which section 38 of the FOI Act applies. Section 38 applies where, at some stage in the decision-making process, the FOI body has formed the view that the records at issue qualify for exemption under one or more of the relevant exemptions in the FOI Act (i.e. sections 36, 36 and 37 – relating to information that is confidential, commercially sensitive, or third party personal information, respectively) but that the records should be released in the public interest. Where section 38 applies, the FOI body is required to notify an affected third party before making a final decision on whether or not the exemptions, otherwise found to apply, should be overridden in the public interest. The requester, or an affected third party, on receiving notice of the final decision of the FOI body, may apply directly to this Office for a review of the decision. This case concerns an application for review made by an affected third party (the applicant).
The background to this case involves an earlier FOI request made by the original requester. In that case, the requester sought records relating to particular inspections undertaken by the HPRA. In the current case, the requester sought “any replies sent to the HPRA from each company, in which they are asked to address any deficiencies set out in the inspection report”. He specified that the request related to non-conformities or breaches with regards the Medicinal Products (Control of Advertising) Regulations 2007 (the 2007 Regulations).
While processing the request, the HPRA formed the view that the release of the records could affect the interests of third parties, in particular the pharmaceutical companies that were the subject of the reports. The applicant in this case is one such company.
The HPRA notified the applicant of the request on 14 December 2022. It informed the applicant that it was considering granting partial access to a copy of its response to an inspection undertaken by the HPRA in 2017. It provided the applicant with a copy of the record and identified the sections of the record it was considering releasing and redacting. It outlined its preliminary view that, on balance, the public interest would be better served by part-granting the request than by refusing it. On 5 January 2023, the applicant provided submissions to the HPRA. In its submissions, it said that it identified further information which it said should be redacted under sections 35, 36 and 37 of the FOI Act. Such information comprised the majority of the remaining information in the record.
On 20 January 2023, the HPRA informed the applicant that it had made the decision to grant partial access to the record in question. It said that it had accepted some further redactions sought by the applicant. In respect of the remaining information, it said that while the information may comprise confidential and/or commercially sensitive information, it considered that the public interest lies in favour of release in accordance with sections 35(3) and 36(3) of the FOI Act.
On 3 February 2023, the applicant sought a review by this Office of the HPRA’s decision. The original requester was notified of the review and invited to make submissions. The HPRA and the applicant were also invited to make submissions. Submissions were received from the original requester and the HPRA only. Given the content of the HPRA’s submissions, this Office wrote to the applicant notifying it of certain material matters therein. The applicant was provided with a further opportunity to make submissions. To date, no such submissions have been received.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the correspondence between the applicant and the HPRA during the processing of the request. I have also had regard to the comments made by the applicant in its application for review, and to the submissions of the original requester and the HPRA. I have also had regard to the contents of the record at issue. I have decided to conclude this review by way of a formal, binding decision.
The record at issue comprises a one-page covering letter and a 12-page document (the response document) that the applicant sent to the HPRA containing its response to findings following a HPRA inspection in 2017. The HPRA decided to grant partial access to the record. A substantial amount of information was redacted from the response document on the ground that the information falls outside the scope of the request, while a small amount of information was redacted on the basis that it is exempt from release. It decided to release the remaining information on the ground that the public interest would, on balance, be better served by its release, that information being the majority of the covering letter dated 14 November 2017 and sections 2a and 6 of the response document
In its application for review, the applicant argued that section 2a and 6 of the response document are exempt under sections 35, 36, and 37 of the FOI Act. It made no reference to the covering letter, presumably because the HPRA had agreed to its proposals for the redaction of that letter during the processing of the request. Subsequently, during the course of the review, the HPRA said that due to an administrative error, it had failed to identify certain information in the record which it intended to withhold, namely the information contained at section 2a of the response document. It said that it does not now intend to release that information.
Accordingly, this review is concerned solely with whether the HPRA was justified in its decision to grant access to the information redacted from section 6 of the response document.
Before I address the substantive issues arising, I wish to note that under section 22(12)(a) of the Act, a decision to grant a request to which section 38 applies shall be presumed to have been justified unless the person to whom the information relates shows to the satisfaction of the Commissioner that the decision was not justified. This means that the onus is on the applicant of satisfying this Office that the HPRA's decision to grant access to section 6 of the response document was not justified.
I would also note that section 25(3) of the FOI Act requires me to take all reasonable precautions in the course of a review to prevent disclosure of information contained in an exempt record. This means that the extent to which I can describe the information at issue is limited.
The record at issue
In its submissions, the HPRA explained that it regulates the advertising of human medicinal products in Ireland and that its role is to ensure that advertisements for medical products are in compliance with the 2007 Regulations. It said that the 2007 Regulations set out the requirements for medicinal product advertising in Ireland and compliance ensures that advertisements are accurate, not misleading and in line with approved product information.
The HPRA said it ensures compliance with the 2007 Regulations in a number of ways. It said it performs pre-planned and random compliance reviews of advertisements and also carries out inspections at the offices of Marketing Authorisation Holder companies which advertise human medicinal products in Ireland. Information in respect of the HPRA’s approach to advertising compliance is available on its website.
In its submissions, the HPRA said that its inspection process may be summarised as follows:
As noted above, the record in this case comprises the applicant’s response to the HPRA following an inspection carried out. The relevant part of the record includes a restatement of the relevant findings of the HPRA. In its application to this Office, the applicant argued that sections 35, 36 and 37 of the FOI Act apply. I note that its arguments as to the applicability of section 37 relate to section 2a of the response document and that the HPRA does not now intend to release that information. Therefore, I do not need to give any further consideration to the applicability of section 37 to the information at issue.
Section 35 – information obtained in confidence
Section 35 of the FOI Act provides for the protection of confidential information. While the applicant argued that the information at issue is confidential, it made no further arguments as to why it considered section 35 to apply. During the review, the Investigator wrote to the applicant and noted that limited submissions had been made in the application for review in respect of the applicability of the section. While she invited the applicant to make further submissions on the matter, no such submissions have been received.
As noted above, in cases concerning section 38 of the FOI Act, the onus is on the applicant to satisfy this Office that the HPRA’s decision to grant access to the information at issue was not justified. Nevertheless, as the HPRA accepted section 35(1) to apply but found that the public interest would, on balance, be better served by release of the information, I deem it appropriate to consider the applicability of the section to the information.
Section 35(1)(a) of the FOI Act provides for the mandatory refusal of a request if the record concerned contains information given to an FOI body, in confidence and on the understanding that it would be treated by it as confidential (including such information as aforesaid that a person was required by law, or could have been required by the body pursuant to law, to give to the body) and, in the opinion of the head, its disclosure would be likely to prejudice the giving to the body of further similar information from the same person or other persons and it is of importance to the body that such further similar information as aforesaid should continue to be given to the body.
Subsection (3) provides that, subject to section 38, subsection (1)(a) shall not apply in relation to a case in which, in the opinion of the head concerned, the public interest would, on balance, be better served by granting than by refusing to grant the FOI request concerned.
For a record to be exempt under section 35(1)(a), four requirements must be satisfied, namely that;
The HPRA’s position is that “information that is commercially sensitive is prima facie confidential”. In its submissions, it said that it redacted information which it understood to comprise commercially sensitive information which was therefore given to the HPRA in confidence. It said that the findings of a deficiency, while considered commercially sensitive and also therefore confidential, were not redacted. It said that it considers such findings should be released in the public interest. In respect of the question of whether release would be likely to prejudice the giving to the FOI body of further similar information, the HPRA said that “given the powers of the HPRA in terms of obtaining information, it is arguable that this limb of the confidentiality test is difficult to demonstrate”. With reference to the specific subsection in question, it said that "the FOI Act clearly foresaw eventualities whereby confidential information included information that was required to be given to the FOI body under law”. It said that the exchange and collection of the relevant information is necessary for the HPRA to adequately and appropriately conduct inspections.
The HPRA also drew my attention to a European guidance document produced by the European Medicines Agency (EMA) and the Heads of Medicines Agency (HMA) (available here). The guidance document relates to the release of information after the granting of a marketing authorisation. Section 3.3 of the document concerns information on inspections and states that “information on the outcome of inspections (e.g. compliance/non-compliance/outstanding issues to be addressed) is not regarded as confidential, however specific details e.g information regarding facilities and equipment are considered commercially confidential”. The HPRA said that it expects that marketing authorisation holders are aware of this pan-EEA approach in terms of findings of non-compliance or deficiencies. It noted that its approach is slightly more nuanced in that it accepts that the information may be commercially sensitive but should be released in the public interest. Having considered the above, the Investigator notified the applicant of the potential relevance of the above guidance document and provided it with an opportunity to respond. No submissions have been received to date.
The original requester also made submissions to this Office. He referenced the four requirements under section 35(1)(a) and said that he “cannot see how the four requirements are met in this case”. He said that where the information in the record consists of opinions and observations formed by members of staff of an FOI body, the opinions and observations are not imparted by anyone, meaning the first two requirements cannot be fulfilled. He also referenced the question of the future supply of information and said that the HPRA is acting within its statutory powers by carrying out its compliance inspections, which are underpinned by a regulatory framework. He said that the information supply is clearly not voluntary but part of a regulatory process and the company in question has a duty to cooperate with HPRA inspectors and provide candid responses. He said that the suggestion that releasing unredacted reports or related records would imperil future inspections is not credible.
As noted above, the relevant part of the record in question comprises (a) a restatement of a finding of the HPRA as a result of the inspection process carried out and (b) the applicant’s response to that finding.
The question at issue is whether such information meets the requirements of section 35(1)(a). This Office has previously drawn a distinction between information given or imparted to an FOI body and information which comprises the opinion or observation of the FOI body or its staff. The Commissioner takes the view that in so far as information consists of opinions and observations formed by members of staff of an FOI body, the opinions and observations concerned are not 'imparted' to them by anyone. However, I accept that the disclosure of findings may, in certain cases, also involve the disclosure of information provided by a relevant party. It can occasionally be difficult to separate observations formed by staff members from information provided. The former may be predicated on the latter. That said, even if information provided by a third party is contained within an opinion or observation, such information would still need to meet the four requirements of the subsection in order to be considered exempt.
The first two requirements for section 35(1)(a) to apply are that (i) the record sought contains information given to an FOI body in confidence, and (ii) the information was given on the understanding that it would be treated as confidential. It is the circumstances in which the information was imparted and received that is important in determining whether these first two requirements of section 35(1)(a) are met. Even if I was to accept that the finding restated in the relevant part of the record contains information given to the HPRA, I am not satisfied that the information was given in confidence or on the understanding that it would be treated as confidential, nor do I consider the applicant’s response to have been given to the HPRA on such an understanding. No evidence was offered to suggest that any assurance of confidentiality was sought or given. The applicant in this case is engaged in regulated activities; the HPRA is the relevant regulatory body. Having considered the relevance of the EMA/HMA guidance referenced above and the nature of the relationship between the two parties, I do not accept that a mutual understanding of confidence could have existed between the parties in respect of findings and the responses to such findings following a regulatory inspection.
Moreover, I am not satisfied that the release of the restated finding or the applicant’s response and proposed action in respect of same would prejudice the giving to the HPRA of further similar information from the same person or other persons. Compliance with the 2007 Regulations is required and the Irish Medicines Board Act 1995 provides that contravention is an offence. In such circumstances, it seems to me that it is very much in the interest of relevant entities to provide information to the HPRA during the course of an inspection and to provide responses and action plans in respect of regulatory findings. Accordingly, I am not satisfied that disclosure would prejudice the giving of similar information.
I find, therefore, that the applicant has not satisfactorily shown that the information at issue in the record is exempt from release under section 35(1)(a) of the Act.
Section 36 – commercially sensitive information
In its application to this Office, the applicant argued that section 36 applies to the information in section 6 of the response document because of the commercial sensitivity of its contents. While it did not specify the subsection of section 36 it considers to apply, it argued that the release of the record would damage its business and reputation. It said the information would be of interest to its competitors and that disclosure of the record may cause harm to its ability to successfully compete for public sector contracts due to misinterpretation of the disclosure. Accordingly, I have considered whether sections 36(1)(b) and/or 36(1)(c) apply in this case.
Section 36(1)(b) of the FOI Act provides for the mandatory refusal of a request if the disclosure of the record sought could reasonably be expected to result in a material financial loss or gain to the person to whom the information relates, or could prejudice the competitive position of the person in the conduct of his or her profession or business or otherwise in his or her occupation. The essence of the test in section 36(1)(b) is not the nature of the information but the nature of the harm which might be occasioned by its release.
The harm test in the first part of section 36(1)(b) is that disclosure “could reasonably be expected to result in material loss or gain”. This Office takes the view that the test to be applied is not concerned with the question of probabilities or possibilities but with whether the decision maker’s expectation is reasonable. The harm test in the second part of section 36(1)(b) is that disclosure of the information "could prejudice the competitive position" of the person in the conduct of their business or profession. The standard of proof to be met here is considerably lower than the "could reasonably be expected" test in the first part of this exemption. However, this Office takes the view that, in invoking "prejudice", the damage that could occur must be specified with a reasonable degree of clarity.
The applicant argued that releasing limited information from the report “otherwise heavily redacted as non-relevant to the FOI request, presents a narrative that is misleading, out of context and damaging to [its] business and reputation which in turn impacts potentially the health and welfare of patients relying on [its] medicines”. It argued that part-granting the record suggests deficiencies in its advertising which it believes will, in the public eye, attach to all of its products, presenting an “unbalanced and unfair picture” of how it conducts its business. It argued that it is disproportionate to release the information given the damage it could cause to its commercial interests and to the interests of patients relying on its medicines.
The applicant further argued that disclosure of the record would be very likely to prejudice the commercial interests of the applicant and its affiliates worldwide. It argued that sharing partial sentences and disjointed paragraphs could lead to misinterpretation and result in ill-informed commentary that could damage patient confidence in its portfolio. It argued that the disclosure of findings risks “tainting” its entire product range without clarifying the context. It said that despite the lapse of time, the information in question remains commercially sensitive and would be of interest to competitors. The applicant also argued that disclosure of the record could affect patient adherence to prescribed medication, potentially impacting patient safety.
The HPRA said that in the case of deficiencies found, release of such information may cause a financial loss to the applicant in that it may impact public confidence and reduce market share and sales. It said that release may impact share price, financing arrangements and other commercial activity. It said that information about market share, strategy or activities are proprietary and release would make the company less competitive in the market as competitors could tailor their own strategies in response. It said that it considered such information to be commercially sensitive. It said that details in respect of Standard Operating Procedures and internal controls, staff numbers, specific product names and personal information relating to staff in regulated entities were redacted as the HPRA considered that such information was exempt from disclosure and that the public interest did not weigh in favour of release.
In his submissions, the original requester said that it is unclear as to what specific harm could reasonably be expected to occur were the records to be released. He also referenced the fact that the records are a number of years old.
As I have outlined above, the relevant part of the record at issue essentially comprises a restatement of a HPRA finding and the applicant’s response to that finding and proposed action. The essential thrust of the applicant’s argument is that the release of the information could cause reputational damage to the applicant. The information relates to a specific incident concerning a specific advertising activity of the applicant that occurred in 2016. Its disclosure would not involve the disclosure of any particular advertising practice or marketing strategy that the applicant’s competitors would be unaware of or that might benefit those competitors. In light of the specific nature of the incident and the level of detail included in the record, it seems to me that any harm that might flow from release of the information at issue would be quite limited. Moreover, the release of the information at issue would also involve the disclosure of the action the applicant proposed to take in order to avoid a repeat of the matter identified, which further reduces any potential harm associated with the disclosure of the finding. In my view, the applicant’s concerns are significantly overstated, given the nature of the specific finding and its age.
However, given the low standard of proof required for the harm in the second part of section 36(1)(b) to apply, and noting the HPRA’s position, I am prepared to accept that the release of details of the HPRA findings and the applicant’s response to same could prejudice the applicant’s competitive position. I find that section 36(1)(b) applies to the information relating to findings identified.
As I have found that section 36(1)(b) applies, I must also consider whether sections 36(2) or section 36(3) serve to disapply section 36(1). Section 36(2) provides for the release of information to which section 36(1) is found to apply in certain circumstances. I am satisfied that none of the circumstances identified at section 36(2) arises in this case.
The Public Interest
Section 36(3) provides that section 36(1) does not apply where the public interest would, on balance, be better served by granting than refusing to grant the request. In its application for review, the applicant said that it does not agree that the public interest weighs in favour of disclosure. It argued that the disclosure of the record could jeopardise its entire product portfolio, including medicines for very serious illnesses. It said there is a “real and present concern regarding irreparable damage to trust and confidence in [the applicant] and its products within the medical … and patient communities”. It also said that when taken out of context, the release of the information could affect patient adherence to medication, unnecessarily impacting patient safety.
The HPRA’s position is that the findings of a deficiency, while considered commercially sensitive and also confidential, were not redacted and that such findings should be released in the public interest. In its submissions, it said that details of particular Standard Operating Procedures and internal controls, staff members working in particular areas and specific product names were redacted as it regarded such information as commercially sensitive and considered that private interests overrode any public interest in release. It said that there is a public interest in the maintenance of commercial sensitivity in respect of the availability of medicines on the Irish market.
The HPRA referenced previous decisions of this Office, specifically OIC-108970, OIC-109419, OIC-127873, OIC-127630, OIC-020533 and OIC-67447. It referred to this Office’s decision-making in those cases and cited reasoning in respect of the public interest. The HPRA said that its decision-making in this case is analogous to the previous reviews and that it believes that release in the public interest of the fact of a deficiency in terms of compliance with legal requirements in terms of advertising or medicinal products is the correct approach. The HPRA said that in previous decisions this Office distinguished between releasing information on deficiencies, in order for the public to know how a regulated entity’s legislative obligations are enforced by the HPRA, and refusing information specific to a company which is not in the public interest to release.
In respect of information on deficiencies, the HPRA referenced an interest in the public knowing “how a regulated entity’s legislative obligations are enforced by the HPRA”. It said that it is of the view that “the public interest lies in findings of a deficiency being made available to the public”. It said that “the HPRA regulates certain activities relating to the advertisement of medicines and the public have a strong interest in knowing that advertising activities are undertaken within the standards prescribed by law and it is important to the public, for public health reasons generally and specifically, for those who use the products of the MAH in question, that the findings of deficiencies are something that can be accessed by the public, under the provisions of the FOI Act or otherwise”. It said “the primary driver of the advertising regulations is, at its heart, the protection of public health in the public interest”.
The HPRA also referenced the applicant’s arguments that releasing information about findings in respect of discrete products may “taint” its entire product range in the public perception. It said that while it accepted the position that commercial harm may arise from the release of a finding of a deficiency, the applicant has the ability to “mitigate any harm by contextualising the factual scenarios evident from the partially released records”. It said that it does not regard the argument as sufficient to override the public interest in release of the findings of deficiencies. It said that no issue has been raised as to the factual accuracy of the finding.
Following receipt of the HPRA’s submissions and considering the content of same, the Investigator notified the applicant in respect of the detailed submissions received and provided it with an opportunity to respond. No submissions in this regard have been received to date.
In carrying out any review, this Office has regard to the general principles of openness and transparency set out in section 11(3) of the FOI Act. That section recognises the need to enhance public scrutiny and accountability of government and public affairs, particularly the activities and decision making of FOI bodies. However, when considering where the balance of the public interest lies, I have had regard to the judgment of the Supreme Court in The Minister for Communications, Energy and Natural Resources and the Information Commissioner & Ors  IESC 57 (the Enet Case). In its judgment, the Supreme Court held that general principles of openness and transparency do not provide a sufficient basis for directing the release of otherwise exempt information in the public interest. Rather, a “sufficiently specific, cogent and fact-based reason” is required “to tip the balance in favour of disclosure”.
Section 36(1) is an express recognition of the fact that there is a public interest in the protection of commercially sensitive information. As a general principle, I do not believe that the FOI Act was designed as a means by which the operations of private enterprises were to be opened up to scrutiny. However, as noted above, information relating to the particular products and internal procedures has been redacted by the HPRA, as well as information which it considers outside the scope of the request. What is at issue here is information relating to a specific finding made by the HPRA and the response provided by the applicant. The HPRA has not sought to release the entirety of the record. In fact, quite significant redactions have been made to the record in question. It seems to me that by making those redactions the HPRA has sought to mitigate the risks of releasing information that might give rise to the harms identified in section 36(1)(b).
I would also note that while the applicant is a private enterprise, it is one engaged in regulated activities. The disclosure of the information at issue would disclose information relating to the applicant’s compliance with the 2007 Regulations and the inspection process in respect of same. It seems to me that Directive 2001/83/EC, to which the 2007 Regulations give effect, and the Regulations have at their heart the protection of public health. For example, Recital 2 of the Directive provides that “the essential aim of any rules governing the production, distribution and use of medicinal products must be to safeguard public health”, while Recital 45 provides that “Advertising to the general public, even of non-prescription medicinal products, could affect public health, were it to be excessive and ill-considered. Advertising of medicinal products to the general public, where it is permitted, ought therefore to satisfy certain essential criteria which ought to be defined”.
It seems to me that there is a significant public interest in;
In my view, these public interests are even stronger in circumstances where the matters involved concern public health. It seems to me that the HPRA has sought to strike a balance by deciding to release relevant information that would serve these public interests whilst simultaneously striving to protect sensitive information relating to the applicant the release of which might affect its commercial interests. As I have indicated above, the specific and limited nature of the incident described in the information at issue is such that its release would be very unlikely, in my view, to give rise to reputational damage to the applicant. Moreover, while I note the applicant’s argument that release of the relevant information could “taint” its entire product range, I also note that the record in question contains responses and actions which, in my opinion, serve to further mitigate any potential harms associated with disclosure of the HPRA finding.
In the circumstances, I am satisfied that the public interest would, on balance, be better served by granting access to the information at issue.
As noted above, the applicant argued that the disclosure of the record may harm its ability to successfully compete for public sector contracts due to the misinterpretation of the information therein. Section 36(1)(c) provides for the mandatory refusal of a request if the record concerned contains information the disclosure of which could prejudice the conduct or outcome of contractual or other negotiations of the person to whom the information relates.
The standard of proof required to meet this exemption is relatively low in the sense that the test is not whether prejudice or harm is certain to materialise but whether it might do so. Having said that, this Office expects that a person seeking to rely on this exemption would be able to show that contractual or other negotiations were in train or were reasonably foreseen which might be affected by the disclosure and would be able to explain how exactly the disclosure could prejudice the conduct or the outcome of such negotiations.
No further submissions have been received by the applicant in respect of the reference to public sector contracts above. It seems to me that the applicant’s argument amounts to little more than a general assertion that the exemption applies. I am not satisfied that the disclosure of the record could harm the applicant’s ability to successfully compete for public sector contracts due to the misinterpretation of the information therein. For such an argument to succeed, I would have to accept that public sector bodies might, in the future, misinterpret the specific record at issue when negotiating contracts, without the applicant having an opportunity to put the record in context. I do not accept such an argument. Having considered the specific content of the record, I find that the applicant has not satisfied this Office that section 36(1)(c) applies to the information at issue.
Section 18 – access to parts of records
Section 2 of the Act defines “record” as including “a copy or part” of anything falling within the definition of a record. Section 18(1) provides, that "if it is practicable to do so", access to an otherwise exempt record shall be granted by preparing a copy, in such form as the head of the FOI body concerned considers appropriate, of the record with the exempt information removed. Section 18(1) does not apply, however, if the copy provided for thereby would be misleading (section 18(2) refers).
I note the applicant’s position that the release of limited information from the report creates a narrative which is “misleading”. Having considered the record carefully, I am not satisfied that release of a redacted version would be misleading under section 18(2). While the copy will have considerable information redacted, this is on the basis that such information is outside the scope of the request, rather than on the basis of it being exempt under the FOI Act. I do not believe that the remaining information is misleading. I find that section 18(2) does not preclude the part-grating of the record.
In conclusion, therefore, I find that the applicant has not satisfied this Office that the HPRA’s decision to grant partial access to the record at issue was not justified.
Having carried out a review under section 22(2) of the FOI Act, I hereby affirm the HPRA’s decision. I find that it was justified in its decision to grant access to specific information in the response document which the applicant argued to be exempt from release under sections 35 and 36 of the FOI Act.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.