Tag: administrative law

Sask CA says how to interpret access rights, and addresses various standards for proof of harm

On January 28, 2025, the Court of Appeal for Saskatchewan held that Saskatchewan Government Insurance could rightly withhold a report that questioned an individual’s fitness to drive based on a Health Information Protection Act discretionary exemption that permits a trustee to refuse access if “disclosure of the information could interfere with a lawful investigation or be injurious to the enforcement of an Act or regulation.”

The Court firstly held that the lower court erred in reading the exemption to apply only if the disclosure could interfere with “an existing or identifiable prospective investigation.” In doing so, the Court made an important point about purposive analysis and access-granting statutes, finding that one ought not give weight to the purpose of an access-granting statute without also giving weight to the purpose of the applicable exception to the granted right of access. It said:

[45] …in a case pitting a right of access against an exception to it, a court must not let the broad purpose of legislation granting rights of access overtake the exercise of properly interpreting provisions that provide exemptions. As always, the modern approach demands that the court must begin the interpretative exercise with attention to the words of the statute, as used in the context of the statute. It also requires that the interpreter consider statutory purpose in a somewhat broader sense than did the judge in this case. This idea is explained in Sullivan, as follows:

§9.02[1]           Introduction. In its broadest sense, legislative purpose refers not only to the material goals the legislature hoped to achieve but also to the reasons underlying each feature of the implementing scheme. It asks the question why: why this legislation? why this arrangement of powers? why this direction or rule? why this turn of phrase? In purposive analysis every feature of legislation from the overall conception to the smallest linguistic detail is presumed to be there for a reason. It is presumed to address a concern, anticipate a difficulty, or in some way promote the legislature’s goals.

[43]           In short, in a case like this, the interpreter must have regard not only to the purpose of the legislation as a means to extend rights of access to information but also must be mindful of the objectives that stand behind the exceptions themselves. This is because exemptions, such as found in s. 38(1)(f), are the mechanism chosen by the Legislature to achieve the balance between, on the one hand, rights of access and, on the other hand, society’s interest in maintaining the confidentiality of some types of information. In this case, the judge’s singular focus on the purpose that lies behind the right of access found in s. 32 of HIPA was therefore too narrow.

The court also interpreted the word “could” in the applicable exemption to impose an “objective possibility” proof of harm standard, a lower standard than the standard that arises from the words “could reasonably expected to” (which the Supreme Court of Canada said in Merck requires proof of harm that is “more than a mere possibility”).

The question for privacy lawyers, then, is whether a “real risk” (as in “real risk of significant harm”) requires proof of an “objective possibility” of harm or proof of harm that is “more than a mere possibility.” The text might go either way in my view, and as in this case, one ought not let the purpose of breach notification eclipse the purpose the standard itself, which is to set a threshold and protect against notification fatigue and other harms associated with over notification.

Saskatchewan Government Insurance v Giesbrecht, 2025 SKCA 10 (CanLII).

Mandate letters decision applied to give full force to academic freedom exclusion in Alberta

The Supreme Court of Canada issued its “Mandate Letters” decision in February of this year. It was an obscure case for day-to-day freedom of information practice, addressing whether written mandates by a premier to their ministers are accessible to the public under freedom of information legislation. Mandate Letters was nonetheless signficant for its re-framing of statutory purposes: access legislation does not just support transparency, but is meant to “strike a balance.” In the very first line of her judgement Justice Karatkanis said:

Freedom of information (FOI) legislation strikes a balance between the public’s need to know and the confidentiality the executive requires to govern effectively. Both are crucial to the proper functioning of our democracy.

She then held that the IPC/Ontario erred by failing to engage meaningfully with the legal and factual context underlying the cabinet confidences exemption in Ontario FIPPA.

On September 30, 2024, the Court of King’s Bench of Alberta applied Mandate Letters in finding that the Alberta OIPC erred in failing to adequately engage with the teaching and research records exclusion in Alberta FIPPA.

The request was for information pertaining to a complaint made by two University of Calgary law professors to the Canadian Judicial Council regarding Justice Robin Camp, who resigned from the bench in 2017 after the CJC recommended his removal for comments made in hearing a sexual assault case.

The OPIC construed the teaching and research records exclusion narrowly, and expressly stated, “There is no indication in the Act that these categories are determined via balancing interests in disclosure versus academic freedom.” One can plainly see the conflict between this statement and Mandate Letters.

Teaching records. The disputed teaching records included e-mail discussions among professors about what might be taught in a particular course. The Court held the OPIC erred in treating these records as within the Act because they do not themselves impart knowledge, skill or instruction. It said that the exclusion extends to all “materials arising from activities reasonably necessary to facilitate and/or related to the act of teaching.”

Research records. The Court also held that the OPIC erred in constraining research to “systematic investigation,” explaining:

Whatever the field, research is rarely a siloed activity. Breakthroughs and progress often occur in the crucible of conversation, contention and controversy. Accordingly, to encourage research and innovation, it may be necessary to protect discussions among academic colleagues. 

It further commented that the question is not about the quality or social utility of the research in question, nor does a link to “ideological precepts” diminish a claim to academic freedom – judgement on such matters being within the exclusive domain of the academy. The exclusion, however, does not extend to (pure) social activism

Academics who personally involve themselves in social actions/causes do so with the advantage of time, resources, and status afforded to them by virtue of their affiliation with, and funding by, public institutions. It is appropriate, and in line with the fundamental purposes of freedom of information legislation, that their activities in this realm be subject to scrutiny and oversight.

These findings are at odds with the more constrained view of Ontario’s teaching and research records exclusion taken by the Ontario/IPC, though are principled and threfore applicable outside of Alberta.

Note that this decision is about the substantive scope of the exclusion, and not a University’s entitlement to access teaching and research records. These are distinct issues per City of Ottawa. The Court noted, “The University of Calgary identified and categorized the records at issue as either teaching materials or research materials.”

Governors of the University of Calgary v Alberta Information and Privacy Commissioner, 2024 ABKB 522 (CanLII).

BCCA sends notice issue back to BC OIPC

On September 25th, the Court of Appeal for British Columbia partially upheld Airbnb’s successful judicial review of a British Columbia OIPC decision that required the City of Vancouver to disclose short term rental addresses along with related information, but vacated the application judge’s order to notify over 20,000 affected individuals.

Background

The City licenses short term rentals. It publicly discloses license information, presumably to enable renter inquires. However, the City stopped publishing host names and rental addresses with license information in 2018 based on credible reports of safety risks. Evidence of the safety risks was on the record before the OIPC – general evidence about “concerned vigilante activity” and harassment, evidence about a particular stalking episode in 2019 and evidence that raised a concern about enabling criminals to determine when renters likely to be out of the country.

The OIPC nonetheless ordered the City to disclose:

  • License numbers of individuals;
  • Home addresses of all hosts (also principle residences given licensing requirements); and
  • License numbers associated with the home addresses.

It was common ground that the above information could be readily linked to hosts by using publicly available information, rendering the order upsetting to Airbnb’s means of protecting its hosts. Airbnb only discloses the general area of rentals on its platform, which allows hosts to screen renters before disclosing their address.

Supreme Court Decision

The application judge affirmed the OIPC dismissal of the City’s safety concern as a reasonable application of the Merck test, but held that the OIPC erred on two other grounds.

First, the Court held that the OIPC unreasonably held that home address information was contact information rather than personal information. It failed to consider the context in making a simplistic finding that home address information was “contact information” because the home address was used as a place of business. The disclosure of the home address information, in the context, had a significant privacy impact that the OIPC ought to have considered.

Second, the Court held that the OIPC erred in not giving notice to the affected hosts – who numbered at least 20,000 – and for not providing reasons for its failure. The Court said this was a breach of procedural fairness, a breach punctuated by the evidence of a stalking and harassment risk that the OIPC acknowledged but held did not meet the Merck threshold.

Appeal Court Decision

The Court of Appeal affirmed the lower court’s contact information finding. It also held that the matter of notice to third parties ought to have been raised before the OIPC at the first instance, and that the application judge ought not to have ordered notice to be given. It stressed the OIPC’s discretion, and said:

Relevant facts that may inform the analysis include the nature of the records in issue, the number of potentially affected third parties, the practical logistics of providing notice, whether there are alternative means of doing so, and potential institutional resource issues.

Analysis

Giving notice and an opportunity to make submissions to 20,000 affected individuals is no small matter. In this case, valid electronic contact information was likely available. However, even a 2% response rate would generated 400 submissions, each of which deserving of due consideration.

Many institutions, thinking practically, would simply deny access as a means of avoiding this burden and respecting affected party rights, bearing in mind that the Supreme Court of Canada cautioned in Merck that notice should be given prior to disclosure in all but “clear cases.” When an institution denies access to avoid a massive notification burden, that burden transfers to the relevant commissioner/adjudicator, and even recognizing “practical logistics” and “institutional resource issues,” is see no reason why the “clear cases” rule from Merck should not be the governing test.

The Office of the Information and Privacy Commissioner for British Columbia v. Airbnb Ireland UC, 2024 BCCA 333.

US court finds that visitors to health care provider web pages don’t leave a trail of their protected health information behind

On June 20, the U.S. District Court for the Northern District of Texas held that the US Department of Health and Human Services exceeded its authority by issuing a guidance bulletin that warned HIPAA regulated entries that tracking visitors to web pages with content about health conditions or health care providers is governed by the HIPAA privacy rule.

The HHS concern is focused on the disclosure of “protected health information” or “PHI” to tracking vendors given such disclosures are subject to particular legal requirements. Similar to the law in Ontario, PHI is only information about an identifiable individual that “relates to” the provision of health care.

The HSS bulletin distinguishes the following two scenarios to explain when the HIPAA privacy rule does and does not apply:

  • For example, if a student were writing a term paper on the changes in the availability of oncology services before and after the COVID-19 public health emergency, the collection and transmission of information showing that the student visited a hospital’s webpage listing the oncology services provided by the hospital would not constitute a disclosure of PHI, even if the information could be used to identify the student.
  • However, if an individual were looking at a hospital’s webpage listing its oncology services to seek a second opinion on treatment options for their brain tumor, the collection and transmission of the individual’s IP address, geographic location, or other identifying information showing their visit to that webpage is a disclosure of PHI to the extent that the information is both identifiable and related to the individual’s health or future health care.

The Court held that the required connection between the information and the provision of health care can not be based on the subjective intent of visitors if the website does not collect any information about subject intent. Without such a collection, the Court held, there is only a “speculative inference” about the visitor’s health and interest in or need for health care, too weak of a connection to meet the “relates to” criterion.

American Hospital Association v Becerra, 2024 WL 3075865.

BCSC addresses university possession and control of research records

On November 6th, the Supreme Court of British Columbia affirmed a British Columbia OIPC finding that a university was in possession and control of e-mails sent and received by a faculty member that the University claimed related to research. The Court nonetheless quashed the OIPC’s order to issue a decision in respect of the e-mails on the basis that they were not excluded from the public right of access.

The request was for e-mail correspondence between a faculty member and his research collaborator in Japan over a lengthy time period. The University denied the request based on the statutory exclusion for “research information” in British Columbia FIPPA – an exclusion meant to safeguard academic freedom.

On appeal to the OIPC, the University relied on an affidavit from the targeted professor that stated all of the requested communications were related to ongoing research. The affidavit also described the general nature of the communciations, but did not include an index.

The requester responded that the faculty member and his colleague from Japan “have collaborated on numerous formal complaints to TRU about Dr. Pyne’s professional work and behavior” and indicated that they were seeking correspondence that established an improper leak of related information by the faculty member to the colleague – an act of “professional activism.” The OPIC held that the records were under the University’s possession and control and that the University failed to meet its onus of establishing that they were excluded. It ordered it to make a decision as to their release under FIPPA.

The Court affirmed the OIPC’s possession and control finding, dismissing the University’s argument that academic freedom rendered the e-mails beyond its possession and control. The Court said:

[49]      Much of TRU’s argument on both arms of the custody and control issue is an attempt to characterize the academic university setting as one in which ordinary analysis does not apply.  The argument is that academic faculty members are special: they have academic freedom, which is to say, a protected sphere of individual autonomy, within which they are free from oversight and direction by the university, and their email correspondence within that sphere should be no more subject to disclosure under FIPPA than would be purely personal correspondence.

[50]      Counsel for OIPC submits that both arms of TRU’s argument are analytically misplaced because, while FIPPA recognizes the importance of academic freedom, it does so under the aegis of the research information (or research materials) exception in s. 3(1)(e) (now s. 3(3)(i)).  I agree with this submission.  The research information exception makes room for TRU’s argument.  It is unhelpful to have to deal with it separately as an argument about custody or control. 

The suggestion in the last sentence above is that the existence of the statutory exclusion lends support to institutional possession and control – i.e., that academic freedom is protected by the exclusion but does not restrict a University’s ability to handle faculty records in processing requests.

The Court nonetheless quashed the OIPC’s order. It held that the University’s evidence established that at least some of the responsive e-mails were excluded, and that the resulting order to issue a decision in respect of all responsive records was over-broad. In making this finding, it held that the OPIC had a reasonable basis for doubting the faculty member’s “blanket assertion” given the competing evidence about “professional activism.”

IMHO the University’s affidavit ought to have carried the day. It may make sense to require better, more particular evidence to support an exclusion claim when the claimant’s evidence is rebutted, but I don’t believe it was rebutted in this case. The only assertion by the requester is that the set of responsive e-mails likely contained information about a research misconduct matter, and research misconduct is typically treated as within the scope of academic freedom and subject to academic self governance and freedom.

Thompson Rivers University v British Columbia (Information and Privacy Commissioner), 2023 BCSC 1933 (CanLII).

Federal Court of Appeal modifies test for application of open courts principle to administrative tribunals

On July 27th, the Federal Court of Appeal held that the Parole Board of Canada erred in denying the media access to recordings of its hearings.

The matter was about an application for copies of recordings of parole hearings involving notorious convicted criminals Paul Bernardo, William Shrubsall and Craig Monro. The Corrections and Conditional Release Act provides for parole hearings that the Supreme Court of Canada has said are inquisitorial in that the Board is bound to consider all evidence put before it in conducting a form of risk assessment. The Act also gives the public a presumptive right to attend hearings. The media can therefore (presumptively) attend and report on hearings, though the Act deems personal information in the recordings (and other documents on the record) not to be publicly available for for the purpose of the Access to Information Act and the Privacy Act.

The CBC relied on the open courts principle, though the Court ultimately determined the matter on administrative law grounds. It held the Board unreasonably reckoned with the odd scenario – that the media had already heard and reported on everything recorded even though it was deemed not to be publicly available – and erroneously refused to disclose the recordings “outright” based on an unreasonable amplification of the privacy risk. It suggested that there may be some privacy risks in providing access, but that they could be satisficed by imposing conditions on storage and republication.

As for the open courts principle, the Court accepted the following Board argument against application:

The Board says that it is not because its proceedings are inquisitorial – not adversarial – in that the Board is engaged in a risk assessment process in the course of which it receives information from Corrections Canada and submissions from the offender and victims. The offender is not opposed by a representative of the state, as is the case, for example, in a sentencing hearing. Similarly, the offender’s counsel, if they have one, has a limited role in Board hearings.

It also, however, modified and expanded the test for application, noting that the test should focus on the degree to which a tribunal presides over an adversarial proceeding rather than the procedural trappings of the proceeding. It explained:

It appears that, whatever other distinctions may exist between different kinds of administrative tribunals, the fact that a tribunal presides over adversarial proceedings as an adjudicative body is a reliable indicator that the tribunal is subject to the open court principle. It is the fact of adjudicating competing interests that imposes the duty of fairness and impartiality which gave rise to the description of some tribunals as quasi-judicial. In Toronto Star Newspapers Ltd. v. Ontario (Attorney General), 2018 ONSC 2586, 142 O.R. (3d) 266, such tribunals were described as adjudicative tribunals. The characteristic that gives rise to the application of the open court principle to an administrative tribunal is the presence of an adversarial process, as opposed to the formalities by which that adversarial process is conducted. In short, the open court principle applies to adjudicative tribunals.

The Court ordered the matter to be returned to the Board for reconsideration.

Canadian Broadcasting Corporation v. Canada (Parole Board), 2023 FCA 166 (CanLII).

BCSC quashes FOI decision about risk of harm to Airbnb hosts

On July 4th, the Supreme Court of British Columbia quashed a British Columbia OIPC order to provide an FOI requester with access to information about Airbnbs operating in the City of Vancouver.

The City licenses short term rentals. It publicly discloses license information, presumably to enable renter inquires. However, the City stopped publishing host names and rental addresses with license information in 2018 based on credible reports of safety risks. Evidence of the safety risks was on the record before the OIPC – general evidence about “concerned vigilante activity” and harassment, evidence about a particular stalking episode in 2019 and evidence that raised a concern about enabling criminals to determine when renters likely to be out of the country.

The OIPC nonetheless ordered the City to disclose:

  • License numbers of individuals;
  • Home addresses of all hosts (also principle residences given licensing requirements); and
  • License numbers associated with the home adresses.

It was common ground that the above information could be readily linked to hosts by using publicly available information, rendering the order upsetting to Airbnb’s means of protecting its hosts. Airbnb only discloses the general area of rentals on its platform, which allows hosts to screen renters before disclosing their address.

The Court affirmed the OIPC dismissal of the City’s safety concern as a reasonable application of the Merck test, but held that the OIPC erred on two other grounds.

First, the Court held that the OIPC unreasonably held that home address information was contact information rather than personal information. It failed to consider the context in making a simplistic finding that home address information was “contact information” because the home address was used as a place of business. The disclosure of the home address information, in the context, had a significant privacy impact that the OIPC ought to have considered.

Second, the Court held that the OIPC erred in not giving notice to the affected hosts – who numbered at least 20,000 – and for not providing reasons for its failure. The Court said this was a breach of procedural fairness, a breach punctuated by the evidence of a stalking and harassment risk that the OIPC acknowledged but held did not meet the Merck threshold.

This is a wonderful case that illustrates how judicial review works. In my view, the evidence about the risk of harm drove the outcome despite the Court’s affirmation of the OIPC finding. The Court simply found an easier way to address the problem with the OIPC’s outcome – a procedural fairness finding. The notice obligation is no small obligation in cases like this, but cannot be rightly ignored.

Airbnb Ireland UC v Vancouver City, 2023 BCSC 1137.

Manitoba judge implores common sense approach to privacy protection

On November 11th of last year, the Manitoba Court of Kings Bench ordered the City of Winnipeg to release information sought by an FOI requester, rejecting a claim that the information constituted “personal information.”

The media requester sought access to records of breaches and penalties imposed on Winnipeg police officers for breach of police service regulations. The City recorded this information in quarterly reports without names or other direct identifiers, and routinely published the reports internally to approximately 2,000 civilian and police service members.

In answering the request, the City redacted information about penalties imposed for each violation (identified only by regulation number) under the “unjustified invasion of personal privacy” exemption. It claimed that to include penalty information would render the information personal information, the disclosure of which constituted an unjustified invasion of personal privacy. Here is the City’s re-identification risk argument:

[7] Some of the penalties in the Routine Orders are unique and significant and might be apparent to family and close friends of the member who received the penalty. If a member received a penalty of loss of days, family or close friends of the member could be aware of a change of routine because the member has reduced pay or less leave. Family or close friends who saw the penalty in combination with the timeframe on the Routine Order in which the penalty was registered might make the connection and realize that their friend or relative was investigated by their employer and what the particular charge was.

And more:

[9] Some of the charges in the Routine Orders are specific and could result in public identification of the member by that fact alone. For example, witnesses, and complainants could be aware of the circumstances that resulted in the Regulatory charge and if they saw the charge and the Routine Orders in combination with the timeframe on the Routine Order in which the penalty was registered, could then become aware of the penalty imposed.

The Court rejected this argument and found that the information was not personal information based on the well-established reasonable expectations test – a test that asks whether a proposed disclosure, in conjunction with other available information, could reasonably be expected to identify an individual. Notably, the court held that this standard imposes the same evidentiary burden articulated by the Supreme Court of Canada in Merck Frosst – a burden that requires proof of a non-speculative event considerably more likely than a mere possibility but not necessarily proof of an event that is likely.

Like most public sector access and privacy statutes, the Manitoba Freedom of Information and Protection of Privacy Act does not shield personal information from the right of public access entirely – it only protects against unjustified invasions. The judge noted this, noted the City’s broad internal publication of the penalty information at issue and urged those charged with facilitating access to records to approach their task “with a healthy dose of common sense.”

Annable (CBC) v. City of Winnipeg, 2022 MBKB 222 (CanLII).

A call to modernize public sector privacy statutes without inviting litigation

The wave of public sector reform is coming, so it’s time to start thinking and talking about they best way achieve strong privacy protection in the Ontario public sector. I had the honour of participating the University of Toronto’s Privacy Day celebration yesterday, including by sitting on a panel and giving the short prepared remark below. I’m all for privacy protection and modernization, but the implementation of administrative monetary penalties in the Ontario public sector (like now in Quebec) would fundamentally change the relationship between the Ontario public sector and its regulator and not serve the public or education sectors well.