Tag: fippa

Manitoba judge implores common sense approach to privacy protection

On November 11th of last year, the Manitoba Court of Kings Bench ordered the City of Winnipeg to release information sought by an FOI requester, rejecting a claim that the information constituted “personal information.”

The media requester sought access to records of breaches and penalties imposed on Winnipeg police officers for breach of police service regulations. The City recorded this information in quarterly reports without names or other direct identifiers, and routinely published the reports internally to approximately 2,000 civilian and police service members.

In answering the request, the City redacted information about penalties imposed for each violation (identified only by regulation number) under the “unjustified invasion of personal privacy” exemption. It claimed that to include penalty information would render the information personal information, the disclosure of which constituted an unjustified invasion of personal privacy. Here is the City’s re-identification risk argument:

[7] Some of the penalties in the Routine Orders are unique and significant and might be apparent to family and close friends of the member who received the penalty. If a member received a penalty of loss of days, family or close friends of the member could be aware of a change of routine because the member has reduced pay or less leave. Family or close friends who saw the penalty in combination with the timeframe on the Routine Order in which the penalty was registered might make the connection and realize that their friend or relative was investigated by their employer and what the particular charge was.

And more:

[9] Some of the charges in the Routine Orders are specific and could result in public identification of the member by that fact alone. For example, witnesses, and complainants could be aware of the circumstances that resulted in the Regulatory charge and if they saw the charge and the Routine Orders in combination with the timeframe on the Routine Order in which the penalty was registered, could then become aware of the penalty imposed.

The Court rejected this argument and found that the information was not personal information based on the well-established reasonable expectations test – a test that asks whether a proposed disclosure, in conjunction with other available information, could reasonably be expected to identify an individual. Notably, the court held that this standard imposes the same evidentiary burden articulated by the Supreme Court of Canada in Merck Frosst – a burden that requires proof of a non-speculative event considerably more likely than a mere possibility but not necessarily proof of an event that is likely.

Like most public sector access and privacy statutes, the Manitoba Freedom of Information and Protection of Privacy Act does not shield personal information from the right of public access entirely – it only protects against unjustified invasions. The judge noted this, noted the City’s broad internal publication of the penalty information at issue and urged those charged with facilitating access to records to approach their task “with a healthy dose of common sense.”

Annable (CBC) v. City of Winnipeg, 2022 MBKB 222 (CanLII).

IPC upholds university vaccination policy

On April 5th, the Information and Privacy Commissioner/Ontario affirmed a University of Guelph requirement that students in residence for the 2021/2022 academic year be fully vaccinated.

The IPC has jurisdiction to consider whether a public body’s collection of personal information is “necessary” to a lawfully authorized activity based on the Freedom of Information and Protection of Personal Privacy Act. The necessity test has been endorsed by the Court of Appeal for Ontario as strict. Where personal information would merely be helpful to the activity, it is not “necessary” within the meaning of FIPPA. Similarly, where the purpose can be accomplished another way, a public body is obliged to chose the other route.

The IPC’s affirmation of the University’s policy (and its collection of personal information) rested heavily on a letter the University had received from the Wellington-Dufferin-Guelph Health Unit in July 2021. It said:

I am writing to recommend in the strongest possible terms that the University of Guelph require a full (two-dose) course of COVID-19 vaccines for all students living in residence during the 2021-22 school year. Additionally, the University should continue to recommend strongly that all other students, faculty and staff receive both doses of the vaccine.

Students beginning or returning to their studies this fall are looking forward to a safe and relational post-secondary experience. Adding this significant layer of protection will help create a more normal fall on campus. Strong vaccination rates across the University are an important part of student physical and mental well-being, and should contribute peace of mind to all Gryphons.

The IPC affirmation is significant not only because it supports a vaccine mandate based on the strict FIPPA necessity standard, but also because of its adoption of this letter and its reasoning. While mandates must certainly be based on science that establishes that vaccination reduces the risk of exposure, the privacy commissioners, labour arbitrators and judges who will continue to be called upon to evaluate mandates must recognize that they are also based on a need for stability and mental well-being.

We thought we were though the pandemic, and are now in Wave Six. Will there be a Wave Seven? And although the province is trying to give us the stability we all crave by committing to laissez faire policy, why should our public bodies be precluded from adopting stable, medium-term policy that prioritizes safety?

University of Guelph (Re), 2022 CanLII 25559 (ON IPC).

Understanding the Employment-Related Records Exclusion

Here is a copy of the presentation I delivered yesterday at the at the PISCC’s 2020 Ontario Connections Conference. As I told the audience, I’m a confessed FOI nerd. The exclusion is such a unique, important and misunderstood part of our Ontario FOI law that it was good to dive deep on it while in good company.

ALSO, BLG is launching a new webinar series for the provincial public sector called “nuts and bolts.” The first webinar will run in late November, please sign up here, or if you can’t attend in November and want me to put you on our mailing list please DM me.

Privacy violation arises out of failure to notify of FOI request

On September 21st, the Information and Privacy Commissioner/Ontario held that a municipality breached the Municipal Freedom of Information and Protection of Privacy Act by failing to notify an affected person of an FOI request.

The complainant discovered that the municipality had released e-mails he had sent to councilors about a planning matter in responding to FOI requests and without providing notice. MFIPPA requires notification of a request for records containing personal information if the head has “reason to believe” their release “might constitute an unjustified invasion of personal privacy.”

The IPC held that the municipality had not met this requirement. It reasoned:

As indicated above, the County disclosed the complainant’s name, address and views and opinions about Hastings Drive without notifying him pursuant to section 21(1)(b). Given the nature of the complainant’s personal information at issue, in my view, the disclosure of at least some of this information might have constituted an unjustified invasion of his personal privacy.

In my view, the complainant should have been notified and given an opportunity to make representations as to why the Emails should not have been disclosed. As noted in Investigation Report MC-000019-1, except in the clearest of cases, fairness requires that the person with the greatest interest in the information, that is, the complainant, be given a chance to be heard. In this matter, he was not given that opportunity.

The complainant had sent his e-mails to politicians about a matter of apparent public interest. The standard for notification is low, but the notice requirement here was at least debatable.

Unfortunately, the IPC does not address the balancing of interests contemplated by the unjustified invasion exemption. For notice to be required there must be “a reason to believe” – a reason based on a provisional application of the unjustified invasion exemption. “Clearest of cases” is not the legal test, and it is wrong to notify simply because “at least some” information responsive to a request is bound to trigger the notification requirement.

This is a mild warning to institutions. There is a statutory immunity that offers some protection from civil claims for failure to notify, but the IPC has shown itself to be strict.

PRIVACY COMPLAINT MC17-35, 2020 CanLII 72822 (ON IPC).

FOI reconsideration order highlights important timing issue for Ontario institutions

On May 14th, the IPC/Ontario dismissed a request for reconsideration based on an asserted change of circumstances, a somewhat common happening given the lengthy period of time it now takes to process an FOI appeal.

The IPC had earlier affirmed a decision to deny access to certain information about the OPP’s use of cell site simulators on the basis that the information could reasonably be expected to “reveal investigative techniques and procedures currently in use in law enforcement.” After the IPC made this appeal decision, the requester learned that the OPP had switched to a new model of simulator, apparently after she made her request and before the IPC made its decision. The requester asked for reconsideration so she did not have to start again (by filing a new request and potentially re-arguing an appeal). The requester argued the Ministry’s exemption claim could not stand in light of the “new evidence.”

Assistant-Commissioner Liang declined the reconsideration request, but only on the basis that the newly proffered evidence would not have led her to make a different decision in any event. Assistant-Commissioner Liang noted that the Ministry had not deliberately withheld key evidence, which the IPC has treated as a basis for reconsideration. She did not comment on whether the Ministry ought to have brought forward the change in circumstances or whether its failure to do so might warrant reconsideration.

Appeal hearings are about the propriety of an access decision that is made at a point in time, though can invite respondent institutions to make representations about prospective harms. It goes without saying that institutions should not misrepresent the state of affairs in existence at the time they file their materials with the IPC. And if they have made accurate representations and the circumstances later change, there should be no duty to bring those circumstances to the attention of the IPC and no consequence for failing to do so. This would be a very heavy and impractical burden to bear, and would do harm to the finality owed to respondents. Requesters can and should be made to file new requests that can be the subject of fresh consideration and new access decisions.

Ontario (Solicitor General) (Re), 2020 CanLII 34928 (ON IPC).

OCA says Children’s Lawyer records not under MAG’s custody or control

On June 18th the Court of Appeal for Ontario held that the Ministry of the Attorney General is not in custody or control of records in a Children’s Lawyer litigation file even though the Children’s Lawyer, for administrative purposes, is part of MAG. The finding turns on the Children’s Lawyer’s independence and the privacy interests of the children it represents. These kind of contextual factors are important to the custody or control analysis. As stated by the Court, “an organization’s administrative structure is not determinative of custody or control for purposes of FIPPA.”

This decision is consistent with other law that suggests records within an institution are not always in custody or control of an institution – e.g., certain faculty records and personal e-mails. Custody or control is therefore no simple concept to administer and is prone to dispute. At least for now IPC decisions will be subject to judicial review on the correctness standard, another (surprising) finding the Court of Appeal made in rendering its decision.

Ontario (Children’s Lawyer) v. Ontario (Information and Privacy Commissioner), 2018 ONCA 559 (CanLII).

 

IPC comments on use and disclosure of OSR in litigation

On June 15th, the Information and Privacy/Commissioner Ontario dismissed a privacy complaint that alleged a school board breached the Education Act and MFIPPA by producing a student’s OSR in response to his human rights application.

The Board produced the OSR and filed it in a brief of documents to be used at a pending Human Rights Tribunal of Ontario hearing, all pursuant to the Tribunal’s rules. The complainant objected, and in a preliminary hearing, the HRTO directed the complainant to consent or face dismissal of his application. The complainant did not consent, his application was dismissed and he subsequently filed a privacy complaint with the IPC.

The IPC held that MFIPPA prevails over the statutory privilege provision in the Education Act and that the IPC is therefore “not bound to consider section 266 of the Education Act in its deliberations.” It also held that the OSR was information “otherwise available” to the Board and therefore open to its use under the provision of MFIPPA that stipulates that MFIPPA “does not impose any limitation on the information otherwise available by law to a party to litigation.”

The IPC did recommend that, going forward, the Board refrain from unilaterally handling the OSR when its potential use and disclosure is in dispute: “… the Board should make efforts to seek direction from an administrative tribunal or court prior to disclosing the information contained within an Ontario School Record during the course of litigation.”

 York Region District School Board (Re), 2016 CanLII 37587 (ON IPC).

 

Reasonable necessity not enough to justify collection under Ontario’s public sector statutes

Section 38(2) is an important provision of Ontario’s provincial public sector privacy statue. It requires institutions to satisfy a necessity standard in collecting personal information. Ontario’s municipal public sector privacy statute contains the same provision.

On May 4th, the Divisional Court dismissed an Liquor Control Board of Ontario argument that the Information and Privacy Commissioner/Ontario had erred by applying a higher standard than “reasonable necessity” in resolving a section 38(2) issue. The Divisional Court held that the Court of Appeal for Ontario’s Cash Converters case establishes just such a standard:

The LCBO relies upon Cash Converters to support its submission that the IPC erred in not interpreting “necessary” as meaning “reasonably necessary.” However, Cash Converters does not interpret “necessary” in this way. In fact, it suggests the opposite. Arguably, something that is “helpful” to an activity could be “reasonably necessary” to that activity. Yet, the Court of Appeal makes it clear that “helpful” is not sufficient.

It’s hard to fathom a legislative intent to prohibit a practice that is, by definition “reasonable.” If the LCBO seeks and is granted leave to appeal this could lead to an important clarification from the Court of Appeal on a strict interpretation of section 38(2) that has stood for some time. The LCBO practice at issue – which involves collecting the non-sensitive information of wine club members to control against the illegal stockpiling and reselling of alcohol – is a good one for testing the line.

Liquor Control Board of Ontario v Vin De Garde Wine Club, 2025 ONSC 2537.

Review of IPC exclusion decisions now (officially) subject to reasonableness review

A friend just brought a notable FIPPA judicial review from February 24th to my attention. In it, the Divisional Court affirmed an IPC order to disclose the full names of FRO employees in response to a request for personal information.

The IPC held that the employment-related records exclusion in FIPPA did not apply to certain records containing employee names – records of services provided to the requester. The Court reviewed this on the reasonableness standard, finding that pre-Alberta Teachers‘ case law supporting a review on the correctness standard no longer applies. On the application of the exclusion, the Court rejected an argument that the records of service provided were employment-related in the context:

To qualify for the exclusion, the record must be about labour relations or employment-related matters. The dictionary definition of the word “about” requires that the record do more than have some connection to or some relationship with a labour relations matter. “About” means “on the subject of” or “concerning”: see Concise Oxford English Dictionary, 11th ed., 2004, s.v. “about”. This means that to qualify for the exclusion the subject matter of the record must be a labour relations or employment-related matter.

Adopting the Ministry’s broad interpretation of “about” would mean that a routine operational record or portion of a record connected with the core mandate of a government institution could be excluded from the scope of the Act because such a record could potentially be connected to an employment-related concern, is touched upon in a collective agreement, or could become the subject of a grievance. This interpretation would subvert the principle of openness and public accountability that the Act is designed to foster.

This should be read to be consistent with the Divisional Court’s earlier decision that there need only be “some connection” with excluded subject matter for the exclusion to apply: see Ministry of Attorney General and Toronto Star, 2010 ONSC 991 (CanLII). Records that have some connection (i.e. a partial connection) to excluded subject matter are arguably still excluded, but the connection must be real, not speculative and not driven by the context in which a request is made.

The Court also affirmed the IPC’s finding that full name information is not exempt under the “unjustified invasion of personal privacy” exemption.

Question. Why not argue that the information at issue – full names or identifying information – is not “personal information” to which the right of access to personal information applies? The right of access to personal information applies to information and not whole records. In the absence of a special context, the identity of employee/service provider names should not constitute the requester/service recipient’s personal information.

Ministry of Community and Social Services v Doe et al (2014), 120 O.R. (3d) 451.

IPC says full balancing applies in mixed personal information cases

On September 27, 2013 the Information and Privacy Commissioner/Ontario issued a significant decision on the exemption from the right of access to personal information in section 38(b) of MFIPPA (and 49(b) of FIPPA by implication) by finding that a disclosure that is presumed to constitute an unjustified invasion of privacy for the purpose of answering a general records access request is not so presumed for the purpose of answering a request for access to one’s own personal information.

Individuals have a right of access to their own personal information that is in the custody or control of Ontario institutions subject to a number of discretionary exemptions, including an exemption that applies if “the disclosure would constitute an unjustified invasion of another individual’s personal privacy.” This exemption often arises in cases in which individuals seek access to personal information about themselves that is contained in complaints and incident reports (which record information from witnesses, complainants and others about more than one person).

The “unjustified invasion” question is informed by the mandatory exemption for unjustified invasion of personal privacy that applies to “general records” access requests. The mandatory exemption includes a provision that deems certain disclosures to be a presumed unjustified invasion. Here is the MFIPPA provision:

14(3) A disclosure of personal information is presumed to constitute an unjustified invasion of personal privacy if the personal information,

(a) relates to a medical, psychiatric or psychological history, diagnosis, condition, treatment or evaluation;

(b) was compiled and is identifiable as part of an investigation into a possible violation of law, except to the extent that disclosure is necessary to prosecute the violation or to continue the investigation;

(c) relates to eligibility for social service or welfare benefits or to the determination of benefit levels;

(d) relates to employment or educational history;

(e) was obtained on a tax return or gathered for the purpose of collecting a tax;

(f) describes an individual’s finances, income, assets, liabilities, net worth, bank balances, financial history or activities, or creditworthiness;

(g) consists of personal recommendations or evaluations, character references or personnel evaluations; or

(h) indicates the individual’s racial or ethnic origin, sexual orientation or religious or political beliefs or associations.

In Seguin Township, Adjudicator Cropley held that the application of this deeming provision does not end the analysis in a personal information request as it does in a general records request. A head should go on to consider the other relevant factors (including those listed in the Act) to determine if, on the balance, the invasion of privacy to the person other than the requester is “unjustified” in the circumstances. Adjudicator Cropley said that her interpretation consistent “legislature’s intent in creating a separate, discretionary exemption claim that makes a distinction between an individual seeking another individual’s personal information and an individual seeking his own personal information.” It invites both greater access to personal information and greater uncertainty in dealing with access to personal information requests.

Seguin (Township) (Re), 2013 CanLII 64274 (ON IPC).