Here’s a copy of a presentation I gave yesterday at the High Technology Crime Investigation Association virtual conference. It adresses the cyber security pressures on public bodies that arise out of access-to-information legislation, with a segment on how public sector incident response differs from incident response in the private sector
Here’s the second paper that relates to the panel I will be sitting on later this week. It is a collection of FOI case digests about the hacking threat with a covering thesis about the need for greater protection from disclosure. This one particularly caught my interest and includes some ideas I will come back to. Enjoy, and again, please send comments by PM.
On October 9th, Justice McHaffie of the Federal Court held that firearm serial numbers, on their own, are not personal information. His ratio is nicely stated in paragraphs 1 and 2, as follows:
Information that relates to an object rather than a person, such as the firearm serial numbers at issue in this case, is not by itself generally consideredpersonal information”since it is not information about an identifiable individual. However, such information may still be personal information exempt from disclosure under the Access to Information Act, RSC 1985, c A-1 [ATIA] if there is a serious possibility that the information could be used to identify an individual, either on its own or when combined with other available information.
The assessment of whether information could be used to identify an individual is necessarily fact-driven and context-specific. Theother available informationrelevant to the inquiry will depend on the nature of the information being considered for release. It will include information that is generally publicly available. Depending on the circumstances, it may also include information available to only a segment of the public. However, it will not typically include information that is only in the hands of government, given the purposes of both the ATIA and the personal information exemption.
This is not a bright line test, though Justice McHaffie did say that the threshold should be more privacy protective than if the “otherwise available information” requirement was limited to publicly available information or even information available to “an informed and knowledgeable member of the public.”
On May 16th the Court of Appeal for Saskatchewan held that the Office of the Information and Privacy Commissioner, Saskatchewan should not have required the University of Saskatchewan to produce communications that it claimed were subject to solicitor-client privilege.
The Commissioner began by inviting the University to provide evidence that supported its privilege claim. The University filed an affidavit from a non-lawyer stating that legal counsel had advised that “some” of the withheld documents are subject to solicitor-client privilege. It did not file an index of records.
This led the Commissioner to immediately request the records. Although the Commissioner had asked the University for a index of records, it did not ask again – an omission that the Court held to breach the principle that demands an adjudicator only review solicitor-client communications when absolutely necessary to assess a privilege claim.
This fact-specific decision illustrates how strictly the absolute necessity principle will be enforced. The Court also spoke about what privilege claimants ought to be required to present in support of their claims. In doing so, it suggested that an index that identifies records will ordinarily provide an adequate basis for assessing a privilege claim in the absence of any evidence suggesting a claim is “ill founded”.
University of Saskatchewan v Saskatchewan (Information privacy Commissioner), 2018 SKCA 34.
Yesterday the Ontario Superior Court of Justice held that the Ontario Freedom of Information and Protection of Privacy Act violates section 2(b) of the Charter because it goes too far to protect the privacy of parties, witnesses and others in matters heard by the Ontario Human Rights Tribunal, Ontario Labour Relations Boards and other statutory tribunals.
The Toronto Star brought the Charter application. It argued that the access regime created by FIPPA is too restrictive and too slow to meet its Charter-based right of access to “adjudicative records” – records of things filed before tribunals like pleadings and exhibits as well as tribunal decisions. A number of Ontario tribunals process requests for adjudicative records formally under FIPPA while others provide access more informally. The Star argued that the informal process must be the norm.
Justice Morgan allowed the application and declared that FIPPA violates the Charter by imposing a presumption of non-disclosure of “personal information” in adjudicative records. It is a puzzling decision for two reasons.
First, there is virtually no discussion about whether the open courts principle ought to apply to administrative tribunals. The Court’s application of the open courts principle appears to be derived from a provision requiring openness in the Statutory Powers Procedure Act:
All parties acknowledge that administrative hearings governed by the Statutory Powers Procedure Act (“SPPA”) are required to be open to the public. In principle, therefore, it is uncontroversial that “[t]he ‘open court’ principle” – at least in some version – “is a cornerstone of accountability for decision-making tribunals and courts.”
One might argue that the Court elevates a statutory presumption (which ought to be read in harmony with FIPPA) into a constitutional right. One might also argue that there are policy imperatives for administrative justice that weigh against recognition, in respect of tribunals, of the same level of openness that applies to courts – expediency and ease of access, for example. These two imperatives in particular are likely to suffer if administrative tribunal records are treated similarly to court records.
Second, the Court’s decision rests on what it says is a flawed “presumption of non-disclosure” – one that makes personal information in adjudicative records presumptively inaccessible. According to the Court this presumption arises out of the framing of FIPPA’s section 21 “unjustified invasion of privacy exemption,” which states that personal information shall be withheld unless its disclosure would not constitute an “unjustified invasion of privacy.”
It is too strong to call this a presumption, particularly in light of section 53 of FIPPA, which states, “Where a head refuses access to a record or a part of a record, the burden of proof that the record or the part falls within one of the specified exemptions in this Act lies upon the head.” To the contrary, all records in an institution’s custody or control are presumptively accessible under FIPPA, with limitations on the right of access dictated to be “limited and specific” as stipulated FIPPA’s purpose provision.
It’s quite arguable that FIPPA grants a right of access subject to a balancing of interests that has been carefully calibrated by the legislature and ultimately governed by an expert tribunal – the Information Privacy Commissioner/Ontario. Justice Morgan did not hide his views about the IPC, stating “In terms of the expertise of the institution heads and, in particular, the IPC, it is fair to say that the jury is still out. ”
It is inappropriate to closely parse solicitor-client communications in assessing the scope of privilege; the entire “continuum of communications” must be protected. This is the principle articulated in a June 8th decision of the Court of Appeal for British Columbia.
The Court allowed the appeal of a chambers judge order to produce parts of a series of e-mails between a government lawyer and staff at an administrative tribunal. The content ordered to be produced included:
- two paragraphs and two sentences of a ten paragraph advisory e-mail in which the chambers judge suggested the lawyer stepped beyond his role as legal advisor and impinged upon the tribunal’s decision-making authority;
- a follow-up e-mail that the chambers judge held was not privileged for similar reasons; and
- follow-up correspondence between (internal) clients discussing the lawyer’s advice.
The Court held that all this communication was part of the “continuum of communications” that supported the solicitor-client relationship and was therefore privileged. It held there was no basis for a finding that the lawyer usurped the tribunal’s decision making authority, also stating:
In my view, it is in the nature of legal advice that it may influence the decision-making of the client. The purpose of legal advice is normally to advise the client on the best course of action to comply with the relevant law. Advice provided to a statutory decision-maker as to what should be done in order to be legally defensible is still legal advice.
The dispute arose after the above communications were inadvertently disclosed in response to a freedom of information request made by a law firm. The receiving lawyer obtained the communications as part of a disclosure package in which government made a number of exemption claims. She believed government to have waived privileged and used the communications in a proceeding, which led government to assert its privilege claim and claim its disclosure was inadvertent. The Court held there was no waiver. It wasn’t highly critical of the receiving lawyer given these facts, but reminded lawyers of their duty to give notice when they receive communications that are apparently privileged.
Whether information is “personal information” – information about an identifiable individual – depends on the context. The Court of Appeal of Alberta issued an illustrative judgement on April 14th. It held that a request for information about a person’s property was, in the context, a request for personal information. The Court explained:
In general terms, there is some universality to the conclusion in Leon’s Furniture that personal information has to be essentially “about a person”, and not “about an object”, even though most objects or properties have some relationship with persons. As the adjudicator recognized, this concept underlies the definitions in both the FOIPP Act and the Personal Information Protection Act. It was, however, reasonable for the adjudicator to observe that the line between the two is imprecise. Where the information related to property, but also had a “personal dimension”, it might sometimes properly be characterized as “personal information”. In this case, the essence of the request was for complaints and opinions expressed about Ms. McCloskey. The adjudicator’s conclusion (at paras. 49-51) that this type of request was “personal”, relating directly as it did to the conduct of the citizen, was one that was available on the facts and the law.
The requester wanted information about her property because she was looking for complaints related to her actions. The request was therefore for the requester’s personal information. Note the Court’s use of the word “sometimes”: context matters.
Those interested in access to government information and open data might like these presentations, given today at the CanLII conference in Ottawa.
I watched two sessions, one by federal information commissioner Suzanne Legault about legislative reform and another by Glen McGregor of the Ottawa Citizen about “data journalism.”
Ms. Legault’s clear focus of concern is on electronic communications, which contain data that is unstructured and extremely difficult to deal with. She calls instant messages “black holes into which information hides or disappears.” Ms. Legault ties this to the duty to record, a topic I’ve touched upon here.
Mr. McGregor relies heavily on access legislation in his (fascinating) work and gives a good reporter’s perspective on database requests – i.e., requests for structured data. He tells a good story about a database request that started with a $100,000 plus fee and ended with a $40 fee.
Ms. Legault is very negative. Mr. McGregor is very optimistic. The juxtaposition is notable.
On September 4th, the Federal Court of Appeal quashed an access decision made under the federal Privacy Act because an institution’s access decision, considered in light of the record put before the Court on judicial review, was inadequate.
The record before the Court consisted of:
- a decision letter that claimed two exemptions to the right of access without reasoning and that did not identify the decision-maker;
- a “relatively thin affidavit”; and
- copies of produced and withheld documents.
Although the adequacy of reasons jurisprudence now gives statutory decision-makers significant latitude in describing why they reach a decision, the Court nonetheless held that the record of the access decision before it was so devoid of substance that it rendered a meaningful review of the decision impossible. It then gave federal institutions general advice on how to ensure an adequate record of an access decision, ending with the following summary:
To reiterate, all that is needed is sufficient information for a reviewing court to discharge its role. In cases like this, this can be achieved by ensuring that there is information in the decision letter or the record that sets out the following: (1) who decided the matter; (2) their authority to decide the matter; (3) whether that person decided both the issue of the applicability of exemptions and the issue whether the information should, as a matter of discretion, nevertheless be released; (4) the criteria that were taken into account; and (5) whether those criteria were or were not met and why.
The Court also warned that institutions can only supplement their decision letters to a limited degree by filing affidavits in the judicial review procedure. It held that such affidavits may only “point out factual and contextual matters that are not evident elsewhere in the record that were obviously known to the decision-maker” and “provide the reviewing court with general orienting information.”