Case number: OIC-100727-H3D4N2
[Removed]… [O]n 24 September 2020, the applicant sought access to copies of correspondence between the HSA and the school, including its Board of Management and representatives from January 2018, as well as any reports, assessments or documents related to his complaint and any related complaints.
In a decision dated 16 October 2020, the HSA part granted his request. It identified 10 relevant records, eight of which it released to the applicant. It relied on sections 30(1), 32(1)(a), 35(1)(a) and 37(1) of the FOI Act in respect of its refusal to release the remaining records (records 5 and 6). The applicant requested an internal review of its decision. On 5 November 2020, the HSA affirmed its original decision to refuse access to records 5 and 6 on the same grounds.
On 3 December 2020, the applicant applied to this Office for a review of the HSA’s decision.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the correspondence between the applicant and the HSA as set out above and between the applicant and the HSA and this Office. I have also had regard to the contents of the records concerned. I have decided to conclude this review by way of a formal, binding decision.
It is important to note that section 22(12)(b) of the FOI Act provides that a decision to refuse to grant a request under section 12 shall be presumed not to have been justified unless the head of the relevant FOI body shows to the Commissioner's satisfaction that its decision was justified. This means that the onus is on the HSA to satisfy this Office that its decision to refuse access to the records sought, either in whole or in part, was justified.
Section 13(4) of the Act provides that, subject to the Act, in deciding whether to grant or refuse an FOI request, any reason that the requester gives for the request and any belief or opinion of the FOI body as to the reasons for the request shall be disregarded. Thus, while certain provisions of the Act implicitly render the motive of the requester relevant, as a general rule, the actual or perceived reasons for a request must be disregarded in deciding whether to grant or refuse an access request under the FOI Act.
Section 2 of the Act defines “record” as including “a copy or part” of any thing falling within the definition of a record. Section 18(1) provides, that "if it is practicable to do so", access to an otherwise exempt record shall be granted by preparing a copy, in such form as the head of the FOI body concerned considers appropriate, of the record with the exempt information removed. Section 18(1) does not apply, however, if the copy provided for thereby would be misleading (section 18(2) refers). The Commissioner takes the view that neither the definition of a record under section 2 of the Act nor the provisions of section 18 envisage or require the extracting of particular sentences or occasional paragraphs from records for the purpose of granting access to those particular sentences or paragraphs. Generally speaking, he is not in favour of the cutting or "dissecting" of records to such an extent. He takes the view that, being "practicable" necessarily means taking a reasonable and proportionate approach in determining whether to grant access to parts of records.
I note that the applicant stated that the school’s solicitors had indicated that the school had heard nothing from the HSA in relation to his complaint/an investigation. He was of the view that it was overwhelmingly in the public interest (and in the interest of safety at the school) that the school's correspondence be made available so that that the school's claim could be “fully refuted” and “a healthy safety culture” be fostered in the school. It is important to note, as a preliminary matter, that this Office has no remit to investigate complaints, to adjudicate on how FOI bodies perform their functions generally, or to act as an alternative dispute resolution mechanism with respect to actions taken by FOI bodies.
Clarification re blank letter on record 5 and page 4 of record 6
During the course of the review, the HSA indicated that one of the documents provided to this Office contained in record 5 (a letter addressed to the school’s Board of Management with three blank bullet points) was an automatically generated template letter, which was not issued. It stated that the blank letter was included in the records retrieved as part of the FOI search as it was part of the electronic file, but that it was never issued. I am satisfied that this letter contains no relevant information, was not issued to the parties, is not listed on the record schedule provided and that it should not form part of this review.
This review is solely concerned with whether the HSA was justified in refusing to grant access to records 5 (excluding the template letter) and 6 on the basis of sections 30, 32, 35 and 37 of the FOI Act.
Section 30(1)(a) provides that a request may be refused if granting it could, in the opinion of the head of the FOI body, reasonably be expected to prejudice the effectiveness of tests, examinations, investigations, inquiries or audits conducted by or on behalf of an FOI body or the procedures or methods employed for the conduct thereof. The provision envisages two potential types of prejudice or harm: (i) to the "effectiveness" of the tests, etc. (i.e. the ability of the test, etc. to lead to a result of some kind) or (ii) to the procedures or methods employed for the conduct of such tests, etc. To establish the reasonableness of the decision, it is necessary for the FOI body to explain how and why it believes release of the particular records at issue will give rise to the harm envisaged. Section 30(1) is subject to a public interest test under section 30(2).
The records at issue comprise what appears to be standard template correspondence with the school on foot of a complaint and the school’s response (record 5) and emails and a record of a phone call concerning the same matters (record 6).
The HSA stated that the release of the requested records could reasonably be expected to prejudice the effectiveness of its investigations and inquiries conducted on behalf of the State, or the procedures or methods employed for the conduct thereof. The HSA’s position is that the co-operation of parties to complaints or incidents is vital for its procedures to continue to work effectively. Essentially, its view is that the release of the records concerned would negatively impact the level of voluntary co-operation with its Workplace Contact Unit (the WCU) which handles such complaints.
It seems to me that the HSA’s argument is that the release of any information provided to the WCU in relation to a complaint could cause such harm, regardless of the nature of the records at issue. It appears to be seeking to protect all such documents as a class. In this regard, I note that this Office’s Investigator drew the HSA’s attention to a recent OIC decision (Case OIC-53239-D4Z0H4 - Mr X and the Health and Safety Authority, available on our website). This Office’s Investigator noted that the records in this case comprised correspondence between the HSA and an employer, rather than the standard safety statements at issue in case OIC-53239-D4Z0H4, but said that it seemed to her that the contents of the records in this case were not particularly sensitive or controversial. She invited the HSA to address these points in its submission.
In response, the HSA stated that the circumstances of how the records in both cases were created or obtained were “entirely different”. It said that an investigation was conducted by an Inspector into a workplace accident in case OIC-53239-D4Z0H4, which required the duty holders involved to produce legally required documentation to demonstrate compliance with health and safety legislation. The HSA stated that its Inspectors have significant powers under Section 64 of the Safety, Health and Welfare at Work Act, 2005 (as amended) to enter workplaces and obtain records. It said that in this case, the records were obtained or created by the WCU, which it described as an administrative unit, which had no statutory powers to compel duty holders to provide information or records. The HSA also said that the WCU manages all complaints reported to the HSA, as well as providing information and advice to members of the public, employees and employers. It said that the WCU typically receives between 3,000 to 4,000 complaints annually, with only a proportion of these complaints being referred on to inspectors for further investigation. It stated that complaints are referred to the inspectorate by the WCU manager depending on the severity of the complaint allegation and also where a duty holder fails to engage with a member of WCU. In those circumstances, it said that the statutory powers of an inspector may be needed to investigate the complaint. It stated that the WCU operated on the basis of duty-holder co-operation and goodwill. Its position is that information is typically provided to the WCU voluntarily, on the understanding that it will be treated as confidential, and that the WCU cannot compel anyone to provide relevant information or documents.
The HSA stated that it treats the investigation of complaints as confidential and that this is documented in inspector and WCU procedures. It said that this was done both to protect vulnerable workers who might have concerns regarding dismissal, and to uphold the right to due process for those who have allegations made against them. The HSA is of the view that assurances of confidentiality to complainants and those complained about allowed the WCU to investigate complaints by engaging with employers or individuals that have allegations made against them. It said that such investigations were conducted by telephone or email and written correspondence, without the need to exercise statutory powers. It also said that this process allows for an efficient and effective means of investigating complaints within an organisation, which has a limited number of authorised inspectors.
The HSA contended that anything that would impair the voluntary disclosure of such information or the level of co-operation and engagement by duty holders responding to complaint allegations would greatly impair the effectiveness of its investigations. It said that this would be likely to increase the length of time required to complete an investigation and “significantly harm the effectiveness of [its] complaints process” as currently organised. The HSA argued that if the records at issue are released under FOI, other organisations will be less forthcoming in future on the basis that their responses could be released to the world at large. It further stated that if it had to resort to legal means to obtain access to relevant documents, this might lead to increased legal costs for the HSA and the State.
The HSA stated that all complaints received by WCU are treated as allegations. It said that the standard procedure is that WCU writes to the relevant employer or person seeking a response. It stated that this is only done with the explicit consent of the complainant and the language used in the correspondence is such that the exact nature of the complaint is not disclosed but rather a response is sought in relation to certain matters. It said that complainants are given a Case Reference ID number and are informed in writing that communications between them and the HSA are confidential, as is the communication between the HSA and the duty-holder. It said that this is done to protect the confidential nature of the complaint process for both the complainant and the duty-holder. It said that the reference numbers issued to complainants and duty-holders are different, in order to maintain the confidentially of the process and it referred to its complaint process as outlined on its website at https://www.hsa.ie/eng/customer_service/make_a_complaint/your_complaint_and_how_it_is_handled.html. I note that this section of the HSA’s website, where complaints can be submitted, states that any dealings the HSA has with duty holders and employers must remain confidential and that the HSA cannot provide complainants with details of the specific actions taken or the outcome. It also states that “by law”, there is very limited feedback that the HSA can provide to a complainant.
In this regard, I note that the HSA does not refer to any specific statute concerning confidentiality on its website, or in submissions to this Office. However, I also note that section 73(1) of the Safety, Health and Welfare at Work Act 2005 (as amended) states that “[s]ave as otherwise provided by law and subject to subsection (2)” a person “shall not, unless duly authorised by the Authority, disclose confidential information obtained” while performing or as a result of performing any function for or on behalf of the HSA. I further note that section 41 of the FOI Act provides for the mandatory refusal of an FOI request if the disclosure of the record concerned is prohibited by law of the European Union or any enactment, other than a provision of various enactments set out in Part 1 or 2 of Schedule 3 of the FOI Act. Schedule 3 to the FOI Act then sets out a list of statutes to which section 41 does not apply. The list includes section 73 of the Safety, Health and Welfare at Work Act 2005. I am satisfied that on that basis, section 73 of the Safety, Health and Welfare at Work Act 2005 does not preclude the release of records held by the HSA based on the provisions of the FOI Act.
The HSA stated that records 5 and 6 contain or reference communications between the school and the WCU in relation to a complaint. It stated that all such complaints are treated as allegations, which can be refuted by duty-holders. It also stated that if an inspection of the workplace is conducted and a report of inspection or an enforcement notice is issued to the employer, these records would be released under FOI once they had been complied with and the file closed. It said that when an inspector conducts an investigation on site, they can fully assess the validity of a complaint and take enforcement action where needed. It said that an onsite visit allows physical evidence and relevant circumstances to be investigated to such a standard that observations recorded in a report of inspection or breaches recorded in an enforcement notice can be released under FOI because due process has been provided for. The HSA said that this explanation demonstrated that it had considered all records pertaining to this FOI request and had not sought to apply a class exemption to complaint records.
The HSA also stated that since the OIC decision in the earlier case mentioned above, it had adapted its approach to FOI requests concerning standard legally required documentation such as safety statements to ensure that these documents are released to the greatest extent possible unless they contain detailed commercially sensitive information or where release would prejudice an ongoing criminal investigation.
I note and welcome the change to the HSA’s procedures following the decision of this Office. However, while I am willing to accept that the HSA has identified a potential harm to its investigations and inquiries and/or the procedures or methods it uses to carry out these investigations, section 30 is a harm based exemption where the harm must be tied to the content of the particular records concerned. Having regard to the specific content of records 5 and 6, I am not satisfied that the harm identified would be likely to arise from their release. The particular records concerned contain what appears to be quite routine enquiries and responses.
Furthermore, while the HSA is strongly of the view that such correspondence was sent and received in confidence, nothing in the particular letters or emails at issue point to this.
I do not consider it likely that the release of what appears to me to be uncontroversial information would dissuade people from cooperating with the HSA and its investigations in the future. In the circumstances, I am not satisfied that the HSA has demonstrated how the release of these particular records would give rise to the harm identified. Accordingly, I find that the HSA has not justified its refusal to grant access to records 5 and 6 under section 30 of the FOI Act.
The HSA also refused to grant access to the records concerned on the basis of sections 32(1)(a)(i), (ii) and (iii) of the FOI Act. Section 32(1)(a) provides that a head may refuse to grant an FOI request if access to the record concerned could reasonably be expected to prejudice or impair (i) the prevention, detection or investigation of offences, the apprehension or prosecution of offenders or the effectiveness of lawful methods, systems, plans or procedures employed for the purposes of the matters aforesaid, (ii) the enforcement of, compliance with or administration of any law, or (iii) lawful methods, systems, plans or procedures for ensuring the safety of the public and the safety or security of persons and property.
Section 32(1)(a) is also a harm based exemption. It applies where access to the record concerned could reasonably be expected to prejudice or impair the matters specified above. Where an FOI body relies on section 32(1)(a), it should identify the potential harm to the matters specified in the relevant sub-paragraph that might arise from disclosure, and having identified that harm, consider the reasonableness of any expectation that the harm will occur. In doing this, the FOI body should show how or why releasing the particular record could reasonably be expected to cause the harm which it has identified. This is an important issue for the FOI body to address and its submission to the Commissioner should explain this.
In its submissions to this Office, the HSA made similar arguments to those set out in support of its reliance on section 30(1)(a) above. Essentially, it stated that information provided by third parties was vital in order to prevent, detect and investigate possible workplace breaches or other offences under health and safety legislation. It said that such information was critical to the HSA’s investigation and prosecution processes, and the enforcement of the law. The HSA also stated that details about workplaces and work activities provided during the investigation of a complaint facilitate it in ensuring that the lawful methods, systems, plans and procedures required for ensuring workplace health and safety are in place, or are put in place.
The HSA was of the view that third parties were likely to withhold information due to concerns about the information being revealed. It considered that this could reasonably be expected to prejudice or impair the HSA’s ability to fulfil its relevant functions and could, as a result, prejudice or impair the lawful methods employed to ensure the safety of workers and the public. The HSA stated that its overall function was to enforce and promote health, safety and welfare in the workplace and that this was underpinned by a robust complaint system. It again set out that its complaints process relies on an understanding of confidence which is documented in its written procedures and on its website.
I accept that the failure of employers and other third parties with whom the WCU engages to provide necessary information voluntarily could reasonably be expected to prejudice the effectiveness of the processes the HSA employs for investigating complaints. However, the question I must consider is whether the release of the records at issue in this case could reasonably be expected to prejudice such voluntary supply of information.
While I understand that the WCU does not have the same enforcement powers as other parts of the HSA, I do not accept that third parties would refuse to co-operate or to provide any information in future on the basis there was a possibility that the information so provided could be released under FOI. Additionally, I accept that there may conceivably be circumstances where the information at issue is so damaging or so sensitive to the interests of relevant parties that its release to the world at large could affect their interests, and as a result have a dampening effect on the provision of information. However, based on the content of the records, I do not consider that to be the case here. Furthermore, it seems to me that if the information contained in a record held by the HSA was that sensitive, other exemptions might apply.
Having regard to the specific content of the records concerned, I do not consider that their release would be reasonably likely to stop or reduce the flow of information to the HSA and prejudice its procedures and investigations. Accordingly, I find that the HSA was not justified in refusing to grant access to the records sought on the basis of section 32(1)(a)(i), (ii) or (iii) of the FOI Act.
The HSA also refused to grant access to the records concerned on the basis of section 35(1)(a). Section 35(1)(a) is a mandatory exemption which applies to a record containing information given to an FOI body in confidence. In order for section 35(1)(a) to apply, it is necessary to show the following:
that the information was given to an FOI body in confidence and,
that the information was given on the understanding that it would be treated by the FOI body as confidential and,
that disclosure of the information would be likely to prejudice the giving to the body of further similar information from the same person or other persons and,
that it is of importance to the body that such further similar information should continue to be given to the body.
All four of these requirements must be satisfied in order for a record to be considered exempt from release under section 35(1)(a) of the Act. Section 35(1)(a) is subject to the public interest test at section 35(3). Therefore, where section 35(1)(a) is being relied on for the refusal to grant access to a record, the public interest test provided for in subsection (3) must be considered in relation to the record concerned.
Section 35(1) does not generally apply where a record is prepared by a member of staff of an FOI body or a service provider, unless disclosure would constitute a breach of a duty of confidence which is owed to a person other than an FOI body, a member of staff of an FOI body or service provider (section 35(2) of the FOI Act refers).
As noted above, the records concerned mainly comprise correspondence between the HSA and the school. Therefore, a number of the records concerned were created by the HSA, which is an FOI body. My understanding is that the HSA’s position is that a duty of confidence is owed to the third party – i.e. the school.
In its submissions, the HSA stated that the information provided in the letter from the school, as well as the email exchange and notes of a telephone call meets the conditions set out in section 35(1)(a).
The HSA stated that the information was provided as part of the investigation of a complaint, and on the understanding that it would be treated as confidential, except to the extent that disclosure may be required in the event of a prosecution. It also stated that such information is maintained as confidential by the HSA, as releasing the records would prejudice the voluntary provision of such information by others in the future. It said that when a third party provides information to the HSA during the course of an investigation, they have an expectation that the information provided will be treated as confidential. As noted previously, its position is that it is important that those who provide information to the HSA can continue to rely on the confidentiality of information voluntarily given to the HSA.
The HSA said that while its inspectors have the power to compel employers to provide information and records, the WCU is staffed by administrative staff who have no statutory powers. It said that the investigation of complaints frequently relies on verbal accounts from relevant witnesses, and that a frank and honest exchange of accounts was needed to fully investigate complaints. It stated that such an exchange will only be provided if the confidentiality of those disclosures is assured and that when a third party communicates by email or phone with the HSA during the course of an investigation, there is an expectation of confidentiality. It said that the assurance of confidentiality is of paramount importance to the delivery and sustainability of the HSA’s complaint process.
I note that during the course of this review, the School was invited to comment on whether it had considered its responses to have been submitted in confidence, on the basis that they would be held in confidence, and whether it considered that the release of the records would affect it (or others) from providing such information to the HSA in future. The school was also asked to indicate whether it had any objection to the release of the records concerned. The school made no submission in response.
In the circumstances, where the relevant third party has not demonstrated that any of the requirements of either section 35(1)(a) or 35(1)(b) are met, or attempted to support the HSA’s assertion that the records were provided in confidence, I must rely on the HSA’s assertions and the content of the records themselves. While I note the comments on the HSA’s website that all complaints or concerns raised are treated as confidential and that any dealings it has with duty holders and employers must remain confidential, as noted above, I am satisfied that this is subject to the provisions of the FOI Act and the relevant prevailing circumstances.
In any event, it seems to me that it is neither apparent from the content of these particular records, nor from the correspondence between the school and the HSA, that the school’s response or queries to the HSA were provided on the understanding, implied or explicit, that they would be treated as confidential. Having regard to the nature of the records, the manner in which they were provided, and the lack of supporting arguments from the school, I find that section 35 does not apply to the particular records at issue.
Section 37(1) of the FOI Act provides that, subject to the other provisions of the section, an FOI body shall refuse a request if access to the record concerned would involve the disclosure of personal information relating to an individual other than the requester.
Section 2 of the FOI Act defines personal information as information about an identifiable individual that, either (a) would, in the ordinary course of events, be known only to the individual or members of the family, or friends, of the individual, or (b) is held by an FOI body on the understanding that it would be treated by that body as confidential. Section 2 goes on to specify 14 categories of information which, without prejudice to the generality of (a) or (b), is personal information for the purposes of the Act, including (iii) information relating to the employment or employment history of the individual, and (xii) the name of the individual where it appears with other personal information relating to the individual or where the disclosure of the name would, or would be likely to, establish that any personal information held by the FOI body concerned relates to the individual.
The HSA relied on section 37 to refuse access to information contained in both records. When asked to clarify which specific information in the records which it considered to be exempt under section 37, the HSA stated that the records contain information such as employment details, an email address and a mobile phone number. Essentially, the HSA’s position is that as both records 5 and 6 relate to the investigation of a complaint, and that their release would mean associating an individual’s name with a complaint allegation in such a way that the records would comprise that individual’s personal information under the FOI Act.
Bearing in mind the circumstances of this case, which concern a complaint made about a school, which is addressed by an individual on behalf of the school, and the specific content of these records, I accept that some of the information relates to the personal information of individuals other than the applicant. I should state, however, that the following information relating to staff members of public bodies is excluded from the definition of personal information in section 2 of the FOI Act: the name of the individual and anything written or recorded in any form by the individual in the course of and for the purpose of the performance of his/her functions.
Accordingly, I find that section 37(1) applies to information relating to identifiable individuals in the records, other than that relating to members of staff of the HSA. However, that is not the end of the matter as section 37(1) is subject to the other provisions of the section.
Section 37(2) sets out certain circumstances in which the exemption at section 37(1) does not apply. I am satisfied that no such circumstances arise in this case and that section 37(2) does not apply.
Section 37(5) provides that a request that would fall to be refused under section 37(1) may still be granted where, on balance (a) the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or (b) the grant of the information would be to the benefit of the person to whom the information relates. I am satisfied that section 37(5)(b) does not apply in this case.
As to whether section 37(5)(a) applies, the question I must consider is whether the public interest in releasing the individual’s name, contact details and information about his employment outweighs, on balance, the public interest in protecting his/her privacy rights. In considering this matter, I have had regard to the comments of the Supreme Court in The Governors and Guardians of the Hospital for the Relief of Poor Lying-In Women v The Information Commissioner  1 I.R. 729,  IESC 26) (“the Rotunda case”). It is noted that a public interest (“a true public interest recognised by means of a well-known and established policy, adopted by the Oireachtas, or by law”) should be distinguished from a private interest.
On the matter of the type of public interest factors that might be considered in support of the release of the information at issue in this case, I have also had regard to the findings of the Supreme Court in The Minister for Communications, Energy and Natural Resources v The Information Commissioner & Ors  IESC 5. In her judgment, Baker J. indicated that the public interest in favour of disclosure cannot be the same public interest as that broadly stated in the Act. She said the public interest in disclosure must be something more than the general public interest in disclosure and the reason must be found from the scrutiny of the contents of the record. She said there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure.
While the comments of the Supreme Court in both judgments cited above were made in relation to provisions of the FOI Act other than section 37, I consider them to be relevant to the consideration of public interest tests generally.
Both the language of section 37 and the Long Title to the FOI Act recognise a very strong public interest in protecting the right to privacy (which has a Constitutional dimension, as one of the un-enumerated personal rights under the Constitution). Unlike other public interest tests provided for in the FOI Act, there is also a discretionary element to section 37(5)(a), which is a further indication of the very strong public interest in the right to privacy. Privacy rights will therefore be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy.
In his submission to this Office, the applicant stated that the records related to a complaint and subsequent investigation into safety at the school. He was of the view that it was “overwhelmingly in the public interest (and in the interest of safety at the school)” that the school's correspondence be made available. He considered that release of the records concerned was necessary so that the school's claim that there was no such correspondence could “be fully refuted” and that a healthy safety culture could be fostered in the school. His view was that the school should not be able to “avail of the public interest test to misinform the public on safety”.
In submissions to this Office, the HSA stated that it considered the strong public interest in upholding the right to privacy, in particular where allegations of wrongdoing against an individual are being investigated by a State Agency with statutory powers for the enforcement of criminal legislation. It stated that it also considered the public interest in individuals being able to exercise their rights under the FOI Act to the greatest extent possible, and the public interest in members of the public being informed as to how the HSA performs its functions and whether those functions are being properly discharged.
The HSA also stated that there was a difference between what might be interesting to the public and what might, properly speaking, be in the public interest. It also stated that it is well-established that a requester’s private reasons for seeking access to the information sought does not, of itself, show that the granting of access to the type of information requested is in the public interest.
As noted above, the school was invited to make a submission in this case but chose not to do so.
In the circumstances of this case, I am satisfied that the applicant has demonstrated a private rather than a public interest in the release of the records sought. I am unaware of a public interest in the release of the third party personal information contained in the records, which would outweigh the right to privacy of the third party concerned. I must also bear in mind that the release of records under FOI is viewed as release to the world at large. Accordingly, I find that the HSA was justified in refusing to grant access to the following information on the basis of section 37 of the FOI Act:
The letter to the HSA received on 21 January 2020 from the school - the first two sentences after the number 1, the name and mobile phone number listed at (c), the individual’s name and signature at the end of the letter and all details of the school from the top and bottom of the letter
The letter dated 15 January 2020 from the HSA - the individual’s name and title in the address, the name and address of the school and his/her name in the salutation part of the letter.
Page 1 - the individual’s name, job title, email address and mobile telephone number,
Page 2 – the individual’s job title and mobile telephone number
Having carried out a review under section 22(2) of the Freedom of Information Act 2014, I hereby vary the HSA’s decision. I affirm its decision to refuse to grant access to certain information contained in the records on the basis of section 37(1). I annul its decision to refuse access to the remaining information in the records concerned on the basis of sections 30, 32, 35 and 37 of the FOI Act and direct the release of the records in part, subject to the redactions set out above.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated by the applicant not later than eight weeks after notice of the decision was given, and by any other party not later than four weeks after notice of the decision was given.