Information Commissioner’s Office (ICO) releases Hearing Decision 53 involving Health Regulatory Services

In August 2015 an applicant requested access to the qualifications (degrees and diplomas) of the medical staff of the Health City Cayman Islands hospital.

The records were held by the Department of Health Regulatory Services (HRS), but access was denied under section 23(1).

HRS argued that the records constituted personal information which would not be reasonable to disclose.

The matter was appealed to the (ICO).  After an attempt was made to find an amicable resolution to the dispute, the matter was referred to the Acting Information Commissioner for a formal decision.

In this Hearing the Acting Information Commissioner upheld the decision of HRS to exempt the records, finding that the exemption in section 23(1) was engaged, and that it would not be reasonable to disclose the records. A balancing of the public interest factors for and against disclosure confirmed that the records are to be withheld.

The public is encouraged to read the full text of Decision 53 which can be found on the ICO website at www.infocomm.ky/appeals<http://www.infocomm.ky/appeals>.

For our readers’ convenience the full text is published below:

ICO Hearing 53-01715
Decision

Department of Health Regulatory Services

Jan Liebaers
Acting Information Commissioner for the Cayman Islands

9 June 2016

Summary:

In August 2015 an applicant requested access to the qualifications (degrees and diplomas) of the medical staff of the Health City Cayman Islands hospital. The records were held by the Department of Health Regulatory Services (HRS), but access was denied under section 23(1). HRS argued that the records constituted personal information which would not be reasonable to disclose.

The matter was appealed to the Information Commissioner’s Office (ICO). After an attempt was made to find an amicable resolution to the dispute, the matter was referred to the Acting Information Commissioner for a formal decision.

In this Hearing the Acting Information Commissioner upheld the decision of HRS to exempt the records, finding that the exemption in section 23(1) was engaged, and that it would not be reasonable to disclose the records. A balancing of the public interest factors for and against disclosure confirmed that the records are to be withheld.

No further action is required on the part of HRS.

Statutes1 Considered:

Freedom of Information Law (2015 Revision) Freedom of Information (General) Regulations 2008

1 In this decision all references to sections are to sections under the Freedom of Information Law (2015 Revision) and all references to regulations are to the Freedom of Information (General) Regulations 2008, unless otherwise specified. Where several laws are being discussed in the same passages, all relevant legislation has been indicated.

Contents:

A. INTRODUCTION

B. BACKGROUND

C. PROCEDURAL ISSUES

D. ISSUES UNDER REVIEW IN THIS HEARING

E. CONSIDERATION OF ISSUES UNDER REVIEW

F. FINDINGS AND DECISION

A. INTRODUCTION

[1] On 17 August 2015 the Applicant made a request to the Department of Health Regulatory
Services (HRS) for a copy of:

the qualifications (including copy of their Tittles/Degree, etc.) of All the Doctors at the Cayman Islands Health City Tertiary Hospital.

[2] On 26 August 2015, HRS communicated to the Applicant that it was withholding the records under the exemption relating to personal information in section 23. In the initial decision the IM also provided the Applicant with a link to a listing with registration information of medical practitioners working for the Health City Hospital (HCCI) on the HRS website. The Applicant requested an internal review.

[3] On 22 September 2015 the Chief Officer (CO), in her internal review decision, upheld the initial decision to withhold the responsive records by reason of section 23(1).

[4] On 28 September 2015 the Applicant made an appeal to the Information Commissioner’s
Office (ICO), which was accepted on 8 October 2015.

[5] The ICO suggested the HRS seek input from the individuals whose educational documents were involved in order to see if they would consent to their release. The Information Manager (IM) contacted HCCI and a joint response was provided by the HCCI Project Director, who indicated that HCCI did not agree with the disclosure, stating that HCCI is a “private company that is fully compliant with the law and hence [HCCI is] not in agreement with providing info on the FOI request.”

[6] The ICO also explored whether the Applicant would agree to inspect the records in a site visit at HRS. However, the Applicant stated that he required copies of the requested records, and would not be satisfied with simply viewing them.

[7] As the appeal could not be resolved amicably and after some delays, the Applicant requested that the matter proceed to a formal hearing.

B. BACKGROUND

[8] HRS was formed in 2008 following the merger between the Health Insurance Commission (HIC) and the Health Practice Commission (HPC). It consists of the Health Insurance Commission Board, the Health Practice Commission Board, the Medical & Dental Council, the Nursing & Midwifery Council, the Pharmacy Council, and the Council for Professions Allied with Medicine.

[9] HRS regulates health insurance and health care services in the Cayman Islands, and assists the general public in resolving disputes pertaining to health insurance and health care services under the provisions of the Health Insurance Law, Health Insurance Commission Law, the Health Practice Law, and the Pharmacy Law and associated Regulations.

[10] The functions of HRS are:

– To investigate and resolve complaints and respond to inquiries;
– To educate the public on health insurance and functions of the HIC;
– To enforce the Health Insurance Law, the Health Practice Law and Regulations;
– To collect Segregated Insurance Fund payments;
– To register healthcare practitioners and facilities;
– To inspect and certify healthcare facilities; and,
– To provide administrative services to the Board.

C. PROCEDURAL ISSUES

Conducting a public interest test:

[11] In the initial decision of 26 August 2015 the IM mentioned that “The decision was made after… application of the public interest test.” No further details were provided on this point.

[12] As well, in the internal review decision of 22 September 2015 the CO confirmed the application of the exemption in section 23(1) without mentioning the public interest at all.

[13] I will further expand on the definition of public interest provided in the Regulations, and consider how the public interest arguments apply to the present case, below. However, I want to clarify here that under section 26(1) public authorities and chief officers are required to apply a public interest test to certain exemptions, including the exemption that is being claimed in this case. In carrying out the public interest test, the IM or CO should state which public interest factors for and against disclosure apply to the request, and explain why, in their opinion, one side outweighs the other.2 As well, section 6(5) instructs that,

(5) Where the factors in favour of disclosure and those favouring nondisclosure are equal, the doubt shall be resolved in favour of disclosure but subject to the public interest test prescribed under section 26.

2 For an example, see: ICO Hearing Decision 41-00000 Governor’s Office 10 July 2014 paras 126-
128

[14] It is clear that the public interest test must be meaningfully addressed, and cannot simply be casually mentioned or ignored, as the IM and CO respectively did in the initial and internal review decisions. Neither the IM’s nor the CO’s approach is acceptable, and both have failed to meet the obligation under section 26(1) to conduct a public interest test when section 23(1) is engaged, as they claim to be the case, and have therefore failed to meet their obligations under sections 7(5), 34(3)(a) and 27.

Third party notification:

[15] In the informal resolution stage of the appeal, the ICO encouraged HRS to contact the individuals whose qualifications were requested by the Applicant, in order to find out whether they would object to the disclosure. HRS wrote to the Human Resources Director at HCCI on 21 October 2015, and received a response from the HCCI Project Director the next day. The Director responded that HCCI was “not in agreement with providing info on the FOI request”, as already fully quoted above.

[16] I am concerned by this approach, for the following reason. The request was for personal information relating to individuals working for the HCCI, as further discussed below. Although there is no legal requirement under the Regulations for a public authority to consult with third party individuals when it is not their intention to disclose the personal information relating to those individuals, as was the case here, it is acceptable (and perhaps even advisable) to consider the opinion of the individuals in the course of an appeal, since the ultimate outcome may be that their personal information is ordered disclosed. Therefore, I approve of the approach taken by HRS towards involving HCCI, as encouraged by the ICO’s Appeals and Compliance Analyst.

[17] However, the intention was to get advice from the individuals concerned, not from their employer, HCCI. Since the response from the HCCI Project Director was given within 24 hours, I doubt very much that all 23 medical staff, whose information this request relates to, were consulted. There is no objection to a collective response from the individuals, but I do not consider it appropriate for their employer to assume this responsibility for them, without, apparently, consulting the individuals concerned.

[18] For these reasons I do not consider the response from HCCI as reasonably representative of the opinion of the individuals involved, and I will therefore disregard the opinion expressed by the HCCI Project Director since I do not know whether it represents the views of the individuals, who are the only relevant third parties.

D. ISSUES UNDER REVIEW IN THIS HEARING

[19] The issue under review in this hearing is:

 Whether the responsive records are exempt from disclosure under section 23(1) of the FOI Law, and, if so, whether access shall nonetheless be granted in the public interest.

[20] The responsive records are the qualifications of all the medical doctors employed at
HCCI, i.e. their physical degrees and diplomas.

[21] I have seen only seven of the qualifications, but I am satisfied that this sample is representative of the entire series of responsive records, and suffices to reach valid conclusions in this Hearing. This position is supported by the fact that the ICO’s Appeals and Compliance Analyst visited the offices of the HRS in an earlier phase of the appeal and inspected the 30-some qualifications relating to all the doctors, and verified that they all contain the same types of information.

E. CONSIDERATION OF ISSUES UNDER REVIEW

 Whether the responsive records are exempt from disclosure under section 23(1) of the FOI Law, and, if so, whether access shall nonetheless be granted in the public interest.

[22] Section 23(1) provides an exemption from the general right to access in section 6(1), as follows:

23. (1) Subject to the provisions of this section, a public authority shall not grant access to a record if it would involve the unreasonable disclosure of personal information of any person, whether living or dead.

[23] Regulation 2 defines “personal information” as follows:

“personal information” means information or an opinion (including information forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion, including but not limited to-

(a) the individual’s name, home address or home telephone number;

(b) the individual’s race, national or ethnic origin, colour or religious or political beliefs or associations;

(c) the individual’s age, sex, marital status, family status or sexual orientation;

(d) an identifying number, symbol or other particular assigned to the individual;

(e) the individual’s fingerprints, other biometric information, blood type, genetic information or inheritable characteristics;

(f) information about the individual’s health and health care history, including information about a physical or mental disability;

(g) information about the individual’s educational, financial, employment or criminal history, including criminal records where a pardon has been given;

(h) anyone else’s opinions about the individual; or

(i) the individual’s personal views or opinions, except if they are about someone else;

but does not include-

(i) where the individual occupies or has occupied a position in a public authority, the name of the individual or information relating to the position or its functions or the terms upon and subject to which the individual occupies or occupied that position or anything written or recorded in any form by the individual in the course of and for the purpose of the performance of those functions;

(ii) where the individual is or was providing a service for a public authority under a contract for services, the name of the individual or information relating to the service or the terms of the contract or anything written or recorded in any form by the individual in the course of and for the purposes of the provision of the service; or

(iii) the views or opinions of the individual in relation to a public authority, the staff of a public authority or the business or the performance of the functions of a public authority;

[24] Section 26(1) provides the following:

26. (1) Notwithstanding that a matter falls within sections 18, 19 (1) (a), 20 (b), (c) and (d), 21, 22, 23 and 24, access shall be granted if such access would nevertheless be in the public interest.

(2) Public interest shall be defined in regulations made under this Law.

[25] Regulation 2 defines the public interest as follows:

“public interest” means but is not limited to things that may or tend to-

(a) promote greater public understanding of the processes or decisions of public authorities;

(b) provide reasons for decisions taken by Government; (c) promote the accountability of and within Government;
(d) promote accountability for public expenditure or the more effective use of public funds;
(e) facilitate public participation in decision making by the Government; (f) improve the quality of services provided by Government and the responsiveness of Government to the needs of the public or of any
section of the public;

(g) deter or reveal wrongdoing or maladministration;

(h) reveal information relating to the health and safety of the public, or the quality of the environment or heritage sites, or measures to protect any of those matters; or

(i) reveal untrue, incomplete or misleading information or acts of a public authority.

The position of the Department:

[26] HRS states that the responsive records “[contain] each practitioner’s personal information and other exempt matter.” Furthermore,

Disclosure would entail releasing the of [sic] personal information, educational record and other documents and granting of access to a record that would involve the unreasonable disclosure of such personal information of all persons involved.

[27] HRS points to the third party notification and consultation, also discussed above, saying “this feedback was noted and taken into consideration when the final decision was being made [not] to release these records.”

[28] HRS states, but does not provide any supporting evidence or argumentation, that “granting access to these records would involve the unreasonable disclosure of practitioners [sic] personal information.”

[29] HRS is equally sparse with its views on the public interest, simply asserting that “the disclosure of these records would have not have been in the best interest of the public”, and that “The decision of the public authority was made after compliance with FOI Law & Regulation, careful consideration of and [sic] third party response, balanced with public interest test”.

[30] HRS also claims that the responsive records were “entrusted” to the Medical and Dental Council (MDC) and HRS itself, and that disclosure would amount to “a breach of confidentiality related to [the] MDC code of conduct, and to [the Health Practitioners Law (2013 Revision)]”.

[31] HRS states that the responsive records were provided “for their regulatory purposes, with the knowledge that they would be held in confidence and for that purpose. The Public authority has a right to maintain all records confidentiality”.

[32] Finally, HRS also asserts the following:

The HCCI was in the process of putting the Doctors certificates on the walls at the facility and an offered [sic] was extended to the applicant for an opportunity to attend and inspect them there.

The position of the Applicant:

[33] The Applicant has not provided a submission or reply submission.

Discussion:

[34] As explained in ICO Guidance, determining whether the exemption in section 23(1) is engaged involves three tests. In deciding whether to disclose what appears to be personal information, the IM must consider all three of these questions:

1. Whether the information …is personal information (taking into account the full definition in the Regulations);

2. If so, whether it would be unreasonable to disclose the information; and,

3. Whether the public interest nonetheless requires disclosure.3

1. Is the information in the responsive records personal information?

[35] Keeping in mind the definition of personal information in the Regulations, it is evident that each responsive record carries an individual’s name and consists of “information… recorded in a material form… about an individual whose identity is apparent”. More specifically, the information contained in each of the responsive records consists of “(g) information about the individual’s educational… history”.

[36] Therefore, the responsive records consist of personal information.

2. If so, would it be unreasonable to disclose the information?

[37] In Hearing 9-016104 – which (as it happens) also dealt with records of the HRC – the former Information Commissioner laid out the questions that should be considered when deciding whether disclosure would be unreasonable under section 23. These questions are also explained in detail in guidance available on the ICO website.5 My consideration of these questions is as follows:

(i) Is the information sensitive?

While it is common practice to put degrees and qualifications on public display, and the subject individual of the qualifications can reasonably be assumed to be proud to inform the world that they possess a degree or diploma, there may be information on a degree or diploma which could be used malevolently in the context of identity theft. For example, a diploma or degree typically contains a person’s full name (i.e. including their middle name), where they went to school, the year they graduated and sometimes even the grades they achieved if the diploma includes the words, “with

3 See part 10 of the ICO Guidance on Personal Information:
http://www.infocomm.ky/images/IM%20Seminars%20Series%20II%20Personal%20Information%2
0Handout%20-%20June%202013.pdf
4 Information Commissioner Hearing 8-01610 Decision Health Regulatory Services (HRS) 4 March
2011, pp.10-11.
5 See the ICO’s guidance document for Information Managers on the exemption relating to personal information: http://www.infocomm.ky/images/IM%20Seminars%20Series%20II%20Personal%20Information%2
0Handout%20-%20June%202013.pdf

Distinction”, “with Merit” or “with Honours”. A copy of such a record could be very useful to someone with nefarious intent.

In raising this point, I am not suggesting that the Applicant would use the information maliciously in any way. However, this request is a general request and not a request for the personal information of the Applicant himself. If I were to find that the responsive records are not exempted, they would be disclosed to the world at large. In that context I find the information somewhat sensitive.

(ii) Would disclosure prejudice the privacy of an individual?

Given that the individuals to whom the responsive records pertain are not public servants, and that the responsive records are held by HRS only through its regulatory responsibility under the applicable legislation and the agreement between the Cayman Islands Government and HCCI, I consider the information in the responsive records private in nature.

Although I do not believe disclosure would greatly invade the privacy of the individuals, I nonetheless recognize that it is unlikely that the subject individuals would reasonably expect copies of their degrees and diplomas to be published to the world at large. Therefore, I believe disclosure of the responsive records would prejudice the privacy of the individuals named in those documents.

(iii) Would disclosure prejudice the public authority’s information gathering capacity (e.g. as a regulator)?

Since the regulatory role of the HRS appears to be adequately defined in the applicable legislation and the agreement between the Cayman Islands Government and HCCI, I do not believe disclosure would in any way impede or prejudice the information gathering capacity of the HRS or any other public authority.

(iv) Has the information “expired”

The information is current, and has not lost any sensitivity due to being expired.

(v) Is the information required for the fair determination of someone’s rights?

No link has been argued or demonstrated between any individual’s rights and the disclosure of the responsive records.

(vi) Would the social context render disclosure reasonable?

While medical doctors often hang a copy of their degrees and diplomas on their office walls, I doubt that many would allow anyone taking a copy of those documents. The information in the responsive records pertains to private individuals not paid for by the public purse, and I am not aware of any applicable social context which would render disclosure reasonable, and none has been argued.

(vii). Is there any suggestion of procedural irregularities or wrongdoing?

No procedural irregularities or wrongdoing have been argued before me. Neither have I encountered any irregularities or suggestion of wrongdoing in reviewing the responsive records made available to me.

[38] Therefore, in considering the above question, I conclude that it would be unreasonable to disclose the responsive records.

[39] In regard to the requirement in section 12(1) to withhold and redact only information that is actually exempted from a responsive record, I have considered whether the responsive records could be redacted, but I find that this would not result in the disclosure of reasonably intelligible and meaningful records.

[40] Consequently, the disclosure of redacted records is not possible in this case.

[41] Having found that the responsive records consist of personal information which would be unreasonable to disclose, I find that the exemption in section 23(1), relating to personal information, is engaged.

3. Whether the public interest nonetheless requires disclosure?

[42] Having found that the exemption in section 23(1) is engaged, I must now consider whether disclosure is nonetheless required in the public interest, as required by section
26(1), taking into account the definition of “public interest” in Regulation 2.

[43] Above, I have already commented on the paucity (or total absence) of arguments relating to the public interest in the initial decision and internal review. It is disappointing to note that HRS’s hearing submission does not add anything tangible in regard to the public interest. HRS simply states that disclosure would not be in the “best interest of the public”, and that they have “balanced” their decision to withhold the responsive records “with public interest test [sic].” No further details are provided.

[44] For his part, as already stated above, the Applicant has not made a submission or reply submission, and has not presented me with any applicable public interest arguments, either.

Public interest factors in favour of disclosure:

[45] As the public authority tasked with regulating the medical professions HRS is accountable to the public for ensuring that all medical staff are properly certified to practice medicine in the Cayman Islands, in accordance with applicable legislation and the agreement between the Cayman Islands Government and HCCI. Proper certification of medical staff is a matter of public interest, since an uncertified doctor potentially represents a significant risk to public health and safety, and to the wellbeing of these Isles and its inhabitants.

[46] Therefore, there is a public interest argument in support of the disclosure of the qualifications, degrees and diplomas of medical staff, including medical staff operating in the private sector, in order to promote the accountability of HRS as a regulator.

[47] However, I consider this public interest argument weak, since the information in question is private in nature, and there is no suspicion or suggestion of wrongdoing on the part of the HRS or HCCI in regard to the qualifications of medical staff. The Applicant has not provided any further insight in this regard.

Public interest factors against disclosure:

[48] There is a strong public interest in protecting personal information. This is not a matter of private interest, but clearly a public interest. Private individuals who are by law required to provide their personal information to the government for regulatory purposes, have a reasonable expectation that their information will not be disclosed to the general public, barring any countervailing circumstances such as a suspicion of wrongdoing, or where the information has “expired”. Such countervailing circumstances have not been argued and appear not to be relevant in the present case. Disclosing such information may constitute a breach of their privacy.

[49] Having balanced the public interest factors for and against disclosure, I find that it would not be in the public interest to disclose the responsive records. Therefore, the responsive records remain exempted under section 23(1).

[50] In its submission HRS appears to argue for an additional exemption, relating to confidentiality, without naming it explicitly. HRS states that “it would be considered a breach of the confidentiality related to, MDC code of Conduct, and to HPL (2013
Revision)”, and that “This information was entrusted to the MDC in confidence… and the
HRS] has a right to maintain all records confidentiality”.

[51] This appears to refer to the exemption relating to breach of confidence in section 17(b)(i), which protects information from disclosure where “the disclosure would.. constitute an actionable breach of confidence.”

[52] I have commented elsewhere that public authorities must do better than propose exemptions haphazardly and late.6 Considering the tentative way HRS puts forward the confidentiality arguments, and especially since I have already found that the responsive records are exempted under another exemption, I do not intend to explore whether the responsive records may also be exempted under section 17(b)(i).

F. FINDINGS AND DECISION

Under section 43(1) of the Freedom of Information Law, 2007 for the reasons stated above I make the following findings and decision:

1. The responsive records held by the Department of Health Regulatory Services (HRS) constitute the personal information of the doctors whose qualifications they document.

2. It is unreasonable to disclose the responsive records.

3. It is not in the public interest to disclose the responsive records.

6 See: Information Commissioner Hearing 43-00814 Decision Portfolio of Legal Affairs 10 April
2015 paras 18-21; as well as: Information Commissioner Hearing 45-00000 Decision The
Governor’s Office 15 February 2016 para 157

Therefore, I uphold the decisions of HRS to withhold the responsive records, and no further action is required on the part of HRS.

As per section 47 of the Freedom of Information Law, 2007, the Applicant or the relevant public body may within 45 days of the date of this Decision, i.e. no later than 24 July 2016, appeal to the Grand Court by way of a judicial review of this Decision.

If judicial review is sought, I ask that a copy of the application for leave be sent to my
Office immediately upon submission to the Court.

Pursuant to section 48, upon expiry of the forty-five day period for judicial review referred to in section 47, the Commissioner may certify in writing to the court any failure to comply with this Decision and the court may consider such failure under the rules relating to contempt of court.

Jan Liebaers
Acting Information Commissioner

9 June 2016