Whether the HSE was justified in refusing access to records containing details of Purchase Orders (POs) over €20,000 made by the HSE in the third and final quarters of 2020 under section 15(1)(a) on the basis that the records as sought did not exist

23 December 2021

Background

In a request dated 3 March 2021, the applicant sought access to a list, database or spreadsheet of all POs over €20,000 made by the HSE in the third and final quarters of 2020, to include the relevant date, year and quarter, the name of the supplier and a description of the goods or services concerned. In a decision dated 15 March 2021, the HSE refused the request on the basis of section 15(1)(a) of the FOI Act, as it considered the request to relate to a record which did not exist or could not be extracted in the form sought. The applicant sought an internal review on 22 March 2021, and the HSE again refused his request on the basis of section 15(1)(a).

On 16 April 2021, the applicant applied to this Office for a review of the HSE’s decision.

I have now completed my review in accordance with section 22(2) of the FOI Act.  In carrying out my review, I have had regard to the applicant’s comments in his application for review and to the submissions made by the FOI body in support of its decision. I have decided to conclude this review by way of a formal, binding decision.

Scope of Review

The scope of this review solely concerns whether the HSE was justified in refusing the applicant’s request on the basis of the FOI Act.

Analysis and Findings

Section 15(1)(a) – whether records exist

Section 17(4) – extraction of information held electronically

It is important to note at the outset that, while the purpose of the FOI Act is to enable members of the public to obtain access to information held by public bodies, the mechanism for doing so is by accessing records held by those bodies. In other words, a person wishing to obtain information from a public body must make a request for records that contain the information sought. Requests for information, as opposed to requests for records, are not valid requests under the Act, except to the extent that a request for information can reasonably be inferred to be a request for records containing the information sought.

Furthermore, the Act does not require public bodies to create records if none exist, apart from a specific requirement, under section 17(4), to extract records or existing information held on electronic devices. Under section 17(4), where a request relates to data contained in more than one record held on an electronic device by the body concerned, the body must take reasonable steps to search for and extract the records to which the request relates. The reasonable steps are those that involve the use of any facility for electronic search or extraction that existed on the date of the request and was ordinarily used by the FOI body. Where these reasonable steps result in the creation of a new record, that record is, for the purposes of considering whether or not such a new record should be disclosed in response to the request, deemed to have been created on the date of receipt of the request. However, if the body does not hold a record containing the information sought and cannot search for and extract the electronically held records by taking reasonable steps, then that is the end of the matter.

The HSE’s submissions

In its initial decision, the HSE acknowledged that the information sought is subject to statutory reporting requirements, as set out in the Code of Practice for the Governance of State Bodies, the Code of Practice for the Governance of State Bodies, the Code of Practice for Freedom of information for Public Bodies and the FOI Model Publication Scheme published by the Department of Public Expenditure and Reform, as well as the National Public Procurement Policy Framework published by the Office of Government Procurement. It stated that it was preparing an analysis of invoices in 2020 over €25,000 for publication, but that a publication date was not available due to “Covid-19 work pressure”. The HSE’s position was that the request related to a report or extract of data from multiple records held electronically which did not exist in the form sought at the time of the request.

In its internal review decision, the HSE stated that its finance and procurement systems were “seriously fragmented and the subject of a major programme of transformation”. The decision-maker also said that the information sought could not “be presented with the requisite degree of confidence”.

In its submissions to this Office, the HSE maintained its position that it operated multiple legacy finance and procurement systems. It said that many of these systems were aged and no longer supported. It also said that the fragmented nature of these systems made it difficult to extract, consolidate and validate information. It stated that a major reform programme, intended to standardise coding and processes across the HSE, would take several years to complete.

The HSE also stated that financial records are handled differently in the various areas of the organisation. It said that, in approximate figures, two million invoices were paid annually to 15,000 suppliers through 12,500 cost centres across the HSE’s 2,500 sites. The HSE further stated that a large percentage of POs were created in verbal or hardcopy format and that these were not entered onto its electronic financial systems until invoice stage. It said that a large number of system-generated POs are never issued to suppliers, as they were either created in anticipation of a need which didn’t materialise or were generated as what it termed “blanket POs” to facilitate drawdown and payment at the HSE’s discretion.

The HSE stated that any system-generated report of POs would be “seriously misleading” and would include POs never intended for suppliers/expenditure. It also stated that the relevant PO details had not been published since the request was made for the reasons outlined above. It said that there was “no immediate intention to publish” pending the transition to the new system, which will include “data cleansing, and standardisation of master data and … processes”. When asked if a report could be generated from its existing systems which breaks down POs by the relevant headings requested by the applicant, the HSE said that no “sufficiently reliable/safe” report could currently be generated.

It is also the HSE’s position that the information sought under the various different headings is not stored in such a way to facilitate the creation of all or part of the report sought, and that it does not routinely collate or report on this specific information as part of its function. It also said that it is not currently in a position to publish the procurement information specified in the Model Publication Scheme for the reasons outlined above but it plans to address this reporting requirement as part of the rollout of the new system.

When asked by this Office how it would generate the report sought if the CEO of the HSE requested it, the HSE stated that “the issues and solutions referred to above would be communicated, high level data communicated, and specific queries relating to specific suppliers answered on a case by case basis, with qualifications as appropriate”.

The applicant’s submission

In his request for internal review and in his application to this Office, a copy of which was provided to the HSE, the applicant stated that the publication of the information sought was a mandatory obligation on all public bodies, with no exclusions. He referred to comments made by the Secretary General of the Department of Public Expenditure and Reform at the Public Accounts Committee in this regard. 

The applicant stated that the HSE was an FOI body, subject to the FOI Act and the various obligations referenced above by the HSE. He also referred to a decision made by the Commissioner in his capacity as Appeal Commissioner on an appeal made under Regulation 10 of the European Communities (Re-Use of Public Sector Information) Regulations 2005 (as amended by the European Communities (Re-use of Public Sector Information) (Amendment) Regulations 2015. That decision referred to the obligation on public bodies to publish details of purchase orders greater than €20,000 since 2012 under the Public Service Reform Plan.

The applicant’s view was that such a report could be easily produced by any financial management system. His position was that these reports were generally created routinely by the majority of other public bodies and that this had continued despite the Covid-19 pandemic, which had been ongoing for over a year at the time of his internal review request.

The applicant was also of the view that section 15(1)(a) could not apply in circumstances where the relevant records could be created within the provisions of section 17(4) of the FOI Act. In support of his view that the record could be created by the HSE without undue difficulty, he referred to a media report concerning the release of a substantial amount of financial information by the HSE: https://www.thestory.ie/2020/12/08/a-datadump-of-expenditure-by-the-hse-covering-the-period-from-2017-to-the-second-quarter-of-2020/. I note that the information in the record released is similar to that sought in this case.

Analysis

The HSE itself has acknowledged its statutory obligations under the various schemes set out above. The applicant’s argument is that the HSE is obliged to publish these reports, regardless of any internal issues concerning legacy, outdated or fragmented systems. The HSE’s position is that the nature of its systems and the various ways in which POs are created and entered on these systems across the organisation makes it difficult to create a reliable report containing the information sought.

I accept that legacy systems are in use which have not yet been streamlined, and make the process of collating a report more onerous. However, in his application for a review to this Office and in his internal review application to the HSE, the applicant referred to information collated and released by the HSE in relation to a previous FOI request. I note from the linked media report and the HSE’s own FOI Disclosures Log, that the records released in that instance comprised the relevant supplier’s name, reference number, item procured and the amount spent on POs from the second half of 2017 to June 2020.

The HSE did not address this in its internal review decision, nor in its submissions to this Office. Accordingly, there is no information before me as to how the record above was collated or came to be released.

While there is no obligation on an FOI body to create a record by collating information from hardcopy records, there is an obligation to do so where the information is held electronically. It appears to me that the HSE has created records such as that sought in this case in the past. It also seems to me that the HSE itself considered that it had the capacity to create such records at the time of the applicant’s request, as it stated in its original decision that it was preparing an analysis of invoices in 2020 over €25,000 for publication. I note that it stated that a publication date was not available due to “Covid-19 work pressure”, not due to outdated or fragmented financial systems.

It was open to the HSE to create a report in response to the applicant’s request, even if this just granted the request in part.  It was also open to the HSE to outline any issues or limitations involved when releasing that record. There is no information before me concerning the length of time or steps required to create the record referred to above, which the HSE released under FOI. However, it seems to me that based on the fact that it was able to collate and release a record in response to a similar request, the HSE has clearly not taken all reasonable steps to locate or create a record in this case.

Accordingly, I am not satisfied that the HSE was justified in refusing the applicant’s request on the basis that the record sought did not exist and could not be collated using any facility for electronic search or extraction that existed on the date of the request and was ordinarily used by the FOI body. Therefore, I find that the HSE was not justified in refusing the request under section 15(1)(a). In the circumstances, I consider the most appropriate course of action to take is to annul the decision, the effect of which is that the HSE must consider the applicant’s request afresh and make a new, first instance, decision in accordance with the provisions of the FOI Act. The applicant will have a right to an internal review and a review by this Office if he is not satisfied with the HSE’s decision.

Decision

Having carried out a review under section 22(2) of the FOI Act, I hereby annul the decision of the HSE to refuse the applicant’s request under section 15(1)(a) of the FOI Act. I direct the HSE to conduct a fresh decision-making process on the request.

Right of Appeal

Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.

Deirdre McGoldrick

Senior Investigator