Cinneadh
Right to Know CLG and Data Protection Commission
Ó Oifig an Choimisinéara um Fhaisnéis Comhshaoil
Cásuimhir: OCE-108913-C6K9T2
Foilsithe
Teanga: Níl leagan Gaeilge den mhír seo ar fáil.
Ó Oifig an Choimisinéara um Fhaisnéis Comhshaoil
Cásuimhir: OCE-108913-C6K9T2
Foilsithe
Teanga: Níl leagan Gaeilge den mhír seo ar fáil.
1. On 7 April 2021, the appellant requested a range of information relating to the National Smart Metering Programme (NSMP) from the DPC. The request sought the following records:
Records of correspondence relating to the NSMP for electricity between DPC and ESBN, CRU, Relevant Government Departments between 1 January 2020 and 7 April 2021.
Records which contain the current position (whether or not a final position and whether or not it has been communicated to the CRU/ESBN etc.) of DPC on the following aspects of the processing of personal data under the NSMP for electricity:
(a) Legal bases for the increased frequency of collection of electricity readings.
(b) Identity of the data controller(s)
(c) Lawfulness of the retention of at least one but up to 48 daily reads for seven years by ESBN for all smart meter users
(d) Whether data subjects are adequately informed that the installation of a smart meter is optional
(e) whether data subjects are adequately informed about the nature and purpose of processing, the identity of the data controller and their rights generally.
(f) whether current legislation is adequate or whether new legislation is required given the scale of personal data processing.
(g) whether DPC has received any complaints about NSMP and if so the number of complaints and the general issues raised (please note we are not looking for any information that would identify a complainant).
2. The DPC did not respond to the request within the time-limit provided for in the AIE Regulations. The appellant sought an internal review based on an implied refusal on 11 May 2021. On 11 June 2021, the DPC refused the request on the grounds that the information sought was not environmental information, and if it was, the information was exempt from release under article 8(a)(iv) of the AIE Regulations. The appellant appealed to my Office on 14 June 2021.
3. The DPC provided my Office with a schedule of 21 records identified as relevant to the request, together with copies of the relevant records.
4. I have now completed my review under article 12(5) of the Regulations. In carrying out my review, I have had regard to the submissions made by the appellant and the DPC and third parties if there are any. I have also examined the contents of the records at issue. In addition, I have had regard to:
a. the Guidance document provided by the Minister for the Environment, Community and Local Government on the implementation of the AIE Regulations (the Minister’s Guidance);
b. Directive 2003/4/EC (the AIE Directive), upon which the AIE Regulations are based;
c. the 1998 United Nations Economic Commission for Europe Convention on Access to Information, Public Participation in Decision-Making and Access to Justice in Environmental Matters (the Aarhus Convention); and
d. The Aarhus Convention—An Implementation Guide (Second edition, June 2014) (‘the Aarhus Guide’).
5. What follows does not comment or make findings on each and every argument advanced but all relevant points have been considered.
6. As set out above, the DPC refused the request on the grounds that the information sought was not environmental information, and that even if it was environmental information, that the information sought was exempt from disclosure under article 8(a)(iv) of the AIE Regulations, as its release would adversely affect the consultation process between the DPC and relevant parties regarding the NSMP. The DPC also argued in submissions to my Office that all relevant documents were exempt from release under article 9(2)(c), as the consultation process was ongoing, and 9(2)(d) of the AIE Regulations, as the documents were internal communications.
7. In the course of my review, and having regard to the content of the records sought, my investigator determined that the potential disclosure of the information sought could impact the Department of Environment, Climate and Communications, the Commission for Regulations of Utilities and ESB Networks DAC. My office notified these bodies of the appeal, and provided each with an opportunity to make third party submissions.
8. The Department of Environment, Climate and Communications chose not to make a submission. The CRU consented to the release of the four records that concerned the CRU. ESBNDAC consented to the release of three documents, and made submissions arguing that four of the documents were exempt from release under article 9(2)(c) of the AIE Regulations.
9. Accordingly, my review in this case is concerned firstly with whether the information sought is environmental information, and if it is, whether the information is exempt from release under article 8(a)(iv), 9(2)(c) and 9(2)(d) of the AIE Regulations.
Whether the information sought was environmental information
10. Article 3(1) of the AIE Regulations sets out that:
“environmental information” means any information in written, visual, aural, electronic or any other material form on—….
(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements”
11. The parties and I are in agreement that the National Smart Metering Programme is a “measure” for the purposes of Article 3(1)(c) of the AIE Regulations. The question for determination is therefore whether the information sought is “on” that measure or activity within the meaning of the definition provided for in the AIE Regulations.
12. In submissions to my office, the DPC have argued that this is not the case, as the information sought relates solely to data protection matters and is accordingly too remote from the measure in question to come within the remit of the Regulations. The DPC says that policy decisions on the NSMP, which may impact environmental factors, are not determined by the data protection considerations. The DPC says that the relevant records do not form an integral part of the NSMP.
13. The appellant states the processing of personal data is an integral part of the NSMP, and therefore the information requested is information on the NSMP itself, which is a measure aimed at contributing to a radical reduction in greenhouse gas emissions and a transition to clean energy in the EU. The NSMP is part of the national Climate Action Plan. The appellant noted that there has been considerable debate over the personal data processing implications of the NSMP. The appellant says that as per Department for Business, Energy and Industrial Strategy v Information Commission and Alex Henney [2017] EWCA Civ 844, it would be artificial to distinguish between the data processing aspects of the NSMP and the NSMP itself.
14. In ESB v Commissioner for Environmental Information [2020] IEHC 190, the High Court endorsed the test established by the UK Court of Appeal in Henney. The Court of Appeal held that information that is integral to the relevant measure or activity is information “on” the measure, while information that is too remote from the relevant measure or activity does not qualify as environmental information. At paragraph 43, the Court stated that “The information itself need not be intrinsically environmental and the task is to find the line between information which qualifies, and that which does not qualify by reason of being too remote.”
15. Information that does not advance the purposes of the Aarhus Convention and AIE Directive may not be “on” the relevant measure or activity (Redmond v Commissioner for Environmental Information [2020] IECA 83 at paragraph 99). As any information “on” a measure affecting or likely to affect the environment is prima facie environmental information, the information at issue does not, in itself, have to affect or be likely to affect the environment (Redmond at paragraphs 57 and 59). However, consideration of whether information is “on” the measure does require examination of the content of the information (ESB, at paragraph 50).
16. The DPC argued that the findings in Henney could be distinguished from this appeal as request in that case was to the relevant government Department, and not to a regulatory body such as the DPC. I do not agree that Henney can be distinguished on those grounds, as this issue concerns the nature of the information itself, and the type of public authority that holds the information is irrelevant to the question of whether the information is environmental information.
17. I have carefully reviewed the relevant records. They contain detailed analysis and discussion of the NSMP and of the legislation implementing the programme. I find that the data processing aspects of the NSMP are sufficiently related to the substance of the policy, in particular in circumstances where the NSMP will require the collection of large amounts of data by the data controller, and where the issues of data protection are of a level of complexity to have required significant work from the stakeholders involved. It is clear from the relevant records that the data protection concerns discussed in the records will affect the day to day workings of the NSMP. I find that this information will benefit the public in allowing individuals to be better informed as to the use of data from a smart meter and the protections that are in place. Consequently, I find that the relevant information is “on” the NSMP. On this basis, the information sought is environmental information within the meaning of the AIE Regulations.
18. The DPC argues that if the information sought is found to be environmental information, it is justified in refusing access to all identified records under article 8(a)(iv) of the AIE Regulations. It argues that the consultation between the DPC and relevant parties regarding the NSMP qualifies as “proceedings” for the purposes of article 8(a)(iv) and would be adversely affected by the disclosure of the information sought.
19. There are a number of elements which must be satisfied before the question of refusal under article 8(a)(iv) arises:
a. The case must involve “proceedings” of the public authority;
b. Those proceedings must have an element of confidentiality
c. That confidentiality must be adversely affected by the disclosure of the information requested
d. That confidentiality must be protected by law.
20. The DPC argues that the exercise of its functions under article 36(4) of the General Data Protection Regulation should be considered to be proceedings for the purposes of Article 8(a)(iv). This article provides that “member states shall consult the supervisory authority [the DPC] during the preparation of a proposal for a legislative measure to be adopted by a national parliament, or of a regulatory measure based on such a legislative measure, which relates to processing”.
21. Neither the Aarhus Convention or the AIE Regulations provide a definitive definition of proceedings. The CJEU has provided some guidance on the meaning of “proceedings”. In its judgment on Case C-204/09 Flachglas Torgau GmbH v Bundesrepublik Deutschland, the Court of Justice of the European Union stated that the concept of ‘proceedings’ of public authorities “refers to the final stages of the decision-making process of public authorities”.
22. In case C-60/15 Saint-Gobain Glass Deutschland GmbH v European Commission, the Court noted at paragraph 81 that: “…Article 4(4)(a) of the Aarhus Convention provides that a request for environmental information may be refused where disclosure of that information would adversely affect the confidentiality of the proceedings of public authorities, where such confidentiality is provided for under national law, and not the entire administrative procedure at the end of which those authorities hold their proceedings.” The Advocate General’s opinion in that case suggested at paragraph 51 that the term “proceedings” should be understood a “covering only the deliberation stage of decision-making procedures, as is suggested by the terms used in the French version of the Aarhus Convention and in the German, French and Italian versions of Directive 2003/4.”
23. The Advocate General’s opinion also stated at paragraph 83 that “In the spirit of restrictive interpretation applicable to the Directive as a whole, and to Article 4(1) and (2) in particular, it seems to me that the concept of ‘proceedings of public authorities’ should be confined, at the broadest, to expressions of view and discussions of policy options in the context of decision-taking procedures within each such authority. The concept should, of course, not be dependent on the form of the proceedings (written or oral), and it should be remembered that Article 4(4) of the Directive requires, wherever possible, information not covered by a ground for refusal to be separated out from information which is covered. Finally, in my view, communications between public authorities, whatever their nature, cannot be regarded as proceedings of such authorities.”
24. The DPC argues that the entire purpose of the consultation process under article 36(4) GDPR is for the Commission to deliberate on and make a decision as to whether the data processing operation proposed by the consulting government department are in accordance with data protection laws. It states that while the written advice issued by the Commission is not described as a “decision” this does not mean that it is not a decision making process. Due to this, the DPC says that the consultation process is a “decision making procedure” as described in the CJEU cases above. In considering the comment in Saint Gobain, that “communications between public authorities, whatever their nature, cannot be regarded as proceedings”, the DPC states that the consultation process cannot be considered to be merely communication between public authorities as the interaction between the DPC and the relevant parties is due to a mandatory statutory consultation process.
25. Having viewed the relevant records and having regard to their contents, I am not persuaded with the characterisation of the consultation process as a decision-making procedure such that it comes within the definition of proceedings under article 8(a)(iv) of the AIE Regulations.
26. The documents provided to my Office do not contain anything that I consider to be a definitive “decision” on whether the proposals for the NSMP are in compliance with data protection law. The documents also do not contain any record or information on any deliberative process within the DPC that led to particular advice being offered or issues being raised. I consider that the purpose of the consultation is not for the DPC to make a decision as to whether the NSMP is in compliance with data protection law, but to provide an early opportunity for the DPC to provide input and feedback on proposals for the operation of the NSMP. It appears that this engagement has been ongoing since 2012 which in my view would support the position that this is not a decision-making process within the meaning of article 8(a)(iv). Any advice provided is not binding on the receiving parties. Should it be the case that the advice provided by the DPC was disregarded, the DPC has other powers under the GDPR and Data Protection Act 2018, but I find that the use of these powers would be a separate process to the consultation process that is relevant to this appeal.
27. Given the above, I am not satisfied that the consultation process between the DPC and the relevant parties is a decision making process such that it constitutes “proceedings” within the meaning of article 8(a)(iv), as the process lacks the decision-making or deliberative aspect that is required by the relevant case law. Accordingly, I find that the DPC’s refusal of the appellant’s request based on article 8(a)(iv) is not justified.
28. I have recently referred a question to the High Court on the interplay between article 8(a)(iv) of the Regulations and the provisions of the Freedom of Information Acts. If I were satisfied that the conditions set out in article 8(a)(iv) (as identified in paragraph 16 above) had been satisfied, it would perhaps have been necessary for me to put my decision in this case on hold pending the outcome of those proceedings. However, in circumstances where none of the conditions are fulfilled, I do not believe it is necessary for me to await the outcome of the High Court proceedings in order to reach a decision in this case.
29. In submissions to my Office, the DPC argued that all relevant documents were exempt from release under article 9(2)(c) of the AIE Regulations, as the statutory consultation in respect of the introduction of smart meters has not been finalised. This was not raised in the internal review decision. ESBN also argued that documents 16 to 19 were exempt from release under this provision.
30. Neither the AIE Regulations, Directive or Aarhus Convention define the phrase “in the course of completion”, however I consider this to refer to the process of preparation of a document itself, and not to any decision-making process related to the document. Due to this, I do not consider it to be of relevance that the consultation process between the DPC and other parties relating to the NSMP is ongoing, as article 9(2)(c) requires an examination of the documents themselves, not of any related decision-making process.
31. Having examined the documents identified as relevant to this request, I consider that article 9(2)(c) could be applied to document 14, which is a set of draft regulations relating to the NSMP and to documents 16 to 19, which consist of data protection impact assessments and a privacy overview relating to the NSMP. It is evident from the remainder of the documents that they are not unfinished or in the course of completion.
32. Document 14 is a draft version of the European Union (Internal Market in Electricity) Regulations 2020. I accept that article 9(2)(c) applies to this document as it is unfinished. The final version of these regulations, the European Union (Internal Market in Electricity) (No. 2) Regulations 2022 was signed by the Minister on 25 January 2022 and is available on the Irish Statute Book website. As article 9(2)(c) applies, I am obliged to weigh the public interest served by disclosure against the interest served by refusal under Article 10(3) of the AIE Regulations. I will do so in conjunction with documents 16 to 19 below, as similar issues arise in respect of all of these documents.
33. Documents 16 to 19 were prepared by ESBN and provided to the DPC in the course of the consultation process. These documents are marked “draft” documents. The completed version of each one of those documents is now available on the ESBN website. I accept that the versions of these documents relevant to the request are unfinished documents within the meaning of article 9(2)(c). This being the case, in order to determine whether the documents should be released or withheld, article 10(3) requires that the public interest served by disclosure is weighed against the interest served by refusal.
34. In favour of disclosure, I consider that there is a benefit in providing the public with detailed information regarding the NSMP. Disclosure of these draft documents even when the finalised versions are now available publically will allow the public to track any changes in the DPIA as they may have occurred between these drafts and publication. Information on the data protection processing aspects of this significant programme will allow the public to be better informed as to the workings and implications of the NSMP. Further, there is a strong public interest in ensuring transparency in how public authorities such as DPC and also ESBN carry out their functions and prepare for important changes that will affect the public in a manner that the NSMP will.
35. In favour of refusal, I recognise the benefit of allowing the parties to have the “private thinking space” to work on significant documents. Sharing of draft documents between public authorities allows for engagement on the contents of the documents, and allows for officials to express doubts, objections, concerns and generally debate a variety of different views in the knowledge that such debate will be shielded from public view.
36. Neither the DPC nor ESBN have pointed me to any particular parts of these draft documents that they consider to now be inaccurate or particularly sensitive. As the documents have now been finalised and published online, I find that the public interest in disclosure of the draft documents outweighs the interest served by refusal. Accordingly, I find that refusal under article 9(2)(c) of these documents is not justified.
37. I would also note that when relying on article 9(2)(c) to refuse release of a document, a public authority is obliged under article 10(6) to inform the applicant of the name of the authority preparing the material and the estimated time needed for completion. This requirement was not observed when the DPC responded to the appellant in this case, and I would ask the DPC to take note of this for future AIE requests.
38. The DPC also made brief reference to article 9(2)(d) in its submissions to my Office. Article 9(2)(d) of the AIE Regulations provides that a public authority may refuse to make environmental information available where the request contains internal communications of public authorities, taking into account the public interest served by the disclosure.
39. Internal communications are not defined in the AIE Regulations, the AIE Directive, or the Aarhus Convention. The decision of the Court of Justice of the European Union in C-619/19 Land Baden-Wurttemberg v DR commented that the term “communications” should be given a separate meaning to the terms “material” or “document” and that it can be interpreted as relating to “information addressed by an author to someone…such as “members” of an administration or the “executive board” of a legal person- or a specific person belonging to that entity such as a member of staff or an official”. This judgment also commented that “internal communications” must be interpreted as meaning “information which circulates within a public authority and which, on the date of the request for access, has not left that authority’s internal sphere – as the case may be, after being received by that authority, provided that it was not or should not have been made available to the public before it was so received”.
40. Having reviewed the documents relevant to this request, I am satisfied that they do not qualify as “internal communications” within the meaning of article 9(2)(d), as they consist of correspondence between the DPC, CRU, ESBN and other parties and documents shared between these parties. There are no documents identified on the schedule that are internal to the DPC.
41. On that basis, I find that refusal of the request based on article 9(2)(d) is not justified.
42. Having carried out a review under article 12(5) of the AIE Regulations, I find that the information sought was environmental information. I find that the refusal of the information sought is not justified under articles 8(a)(iv), 9(2)(c), or 9(2)(d) of the AIE Regulations. On that basis, I annul the decision of the DPC and direct release of the information sought to the appellant.
43. A party to the appeal or any other person affected by this decision may appeal to the High Court on a point of law from the decision. Such an appeal must be initiated not later than two months after notice of the decision was given to the person bringing the appeal.
Ger Deering, Commissioner for Environmental Information