ORDER MO-1698

 

Appeal MA-030078-1

 

Toronto Police Services Board

NATURE OF THE APPEAL:

 

The appellant wrote to the Toronto Police Services Board (the Police) seeking access to his “own personal information that may be contained on any Canadian Police Information Centre [CPIC] records” under the Municipal Freedom of Information and Protection of Privacy Act (the Act).

 

The appellant later wrote to the Police stating that he was seeking information about himself that is available “through the Police Reference Check Program.”

 

The Police identified a two-page CPIC printout and advised the requester that they were denying access to it on the basis of the exemptions at section 38(a) in conjunction with section 8(1)(l), which applies to a record that could reasonably be expected to facilitate the commission of an unlawful act.

 

Regarding the police reference check information, the Police stated:

 

The Reference Check program, instituted pursuant to the passage of Bill C-6, is conducted under Memoranda of Understanding between the [Police] and specific agencies.  Eligible agencies, for the purposes of the memorandum are defined as “organizations including those funded or licensed by the Ministry of Community and Social Services who are providing services to children and vulnerable adults.”  Access cannot be provided to the Reference Check Program [information] by individuals pursuant the parameters of the Memoranda . . .

 

The appellant then appealed the decision of the Police to this office.

 

During the mediation stage of the appeal, the Police issued a supplementary decision to the appellant, stating:

 

Since you have not previously had a police reference check conducted on yourself by a registered agency, access cannot be provided to the record as such record does not exist.

 

The appellant advised the mediator that he takes issue with the position of the Police that there are no police reference check records relating to him.

 

Mediation was not successful in resolving all of the issues in the appeal, and the appeal was streamed to the adjudication stage of the process.

 

I sent a Notice of Inquiry setting out the issues in the appeal to the Police, who provided representations in response.  I then sent the non-confidential representations of the Police, together with the Notice of Inquiry, to the appellant, who in turn provided representations.

 

RECORD

 

The record at issue in this appeal is a two-page CPIC printout.

 

DISCUSSION:

 

TIMING OF REPRESENTATIONS

 

In my cover letter to the Police enclosing a Notice of Inquiry, I stated that the representations were due June 3, 2003.  In accordance with this office’s usual practice, I also stated:

 

Should your representations not be received by the date specified in this letter, the decision making process will proceed, and an order may be issued in the absence of these representations.

 

The Police’s representations are dated June 5, 2003, and I received them on June 9, 2003.

 

In his representations, the appellant states:

 

. . . I am not aware that any extensions were granted to the [Police] and I would appreciate an explanation.

 

In a subsequent letter to me, the appellant implies that I should not take into account the representations of the Police in my decision-making process.

 

The purpose of the paragraph set out above is to ensure that parties are aware of the importance of providing their representations on time, and that if they fail to do so, they risk the possibility of an order being issued in the absence of their representations.  I do not accept the appellant’s position that, because I received the representations six days late, I should not consider them.  Under the Act, an adjudicator has the discretion to consider late material, taking into account all of the circumstances, including any prejudice that may accrue to either party.  To act otherwise and take an overly technical approach, in my view, would be contrary to principles of fairness and natural justice.  This approach is consistent with this office’s Code of Procedure, which states at sections 2.03 and 2.04:

 

2.03 A failure to follow any procedure in this Code does not for that reason alone render an appeal, or any step in an appeal, invalid.

 

2.04 The IPC may in its discretion depart from any procedure in this Code where it is just and appropriate to do so.

 

Here, the appellant did not suffer any significant prejudice by the relatively short delay in the process.  On the other hand, should I not consider the Police’s representations, it may put me in a position of having to reject the exemption claim for lack of evidence, leading to an order to disclose the record, where I might reach a different result should I consider that material.  In my view, the potential prejudice to the Police clearly outweighs any prejudice to the appellant.  Accordingly, I do not accept the appellant’s request that I not consider the Police’s representations.

 

PERSONAL INFORMATION

 

The first issue for me to determine is whether the records contain personal information and, if so, to whom that information relates.

 

Under section 2(1) of the Act, “personal information” is defined, in part, to mean recorded information about an identifiable individual.

 

The Police submit:

 

The personal information contained in the record comprises the appellant’s name, date of birth, and unique identifiers.

 

The appellant makes no specific submissions on this point.

 

I agree with the Police that the record contains the appellant’s personal information, since it contains information that is clearly “about” him, including his name, date of birth and unique identifiers.

 

RIGHT OF ACCESS TO ONE’S OWN PERSONAL INFORMATION/LAW ENFORCEMENT

 

Section 36(1) of the Act gives individuals a general right of access to their own personal information held by an institution.  Section 38 provides a number of exemptions from this right.

 

Under section 38(a), an institution has the discretion to deny an individual access to their own personal information where the exemptions in sections 6, 7, 8, 8.1, 9, 10, 11, 12, 13 or 15 would apply to the disclosure of that personal information.

 

In this case, the Police rely on section 38(a) in conjunction with section 8(1)(l).  The latter section reads:

 

A head may refuse to disclose a record where the disclosure could reasonably be expected to,

 

facilitate the commission of an unlawful act or hamper the control of crime.

 

To establish the application of section 8(1)(l), the Police must provide “detailed and convincing” evidence to establish a “reasonable expectation of harm”.  Evidence amounting to speculation of possible harm is not sufficient [Order PO-2037, upheld on judicial review in Ontario (Attorney General) v. Goodis (May 21, 2003), Toronto Doc. 570/02 (Ont. Div. Ct.), Ontario (Workers’ Compensation Board) v. Ontario (Assistant Information and Privacy Commissioner) (1998), 41 O.R. (3d) 464 (C.A.)].

 

The Police submit:

 

Protecting computerized databases from unlawful penetration is an ever present and growing concern.  The query formats of the printouts would instruct an unauthorized person as to how information is retrieved and stored on the C.P.I.C. system.  Unauthorized use of this data base constitutes a criminal offence, and for this reason, providing query formats to any individual not authorized to use this system, would assist the commission of an unlawful act, should the C.P.I.C. system be penetrated.

 

In Order MO-1293, Adjudicator Laurel Cropley writes:

 

Several previous orders of this office have upheld the application of the exemption in section 8(1)(l) (and its provincial equivalent in section 14(1)(l)) for transmission access codes for the CPIC system (Orders M-933, M-1004 and P-1214) . . .

 

Accordingly, I am satisfied that the disclosure of the data base information in pages 80, 81 and 82 could reasonably be expected to facilitate the commission of an unlawful act, that being the unauthorized use of the information contained in the CPIC system.  I find, therefore, that these portions of the records qualify for exemption under section 8(1)(l) and are exempt under section 38(a) of the Act.

In Order [MO-1335], Senior Adjudicator David Goodis concurs with, and quotes, the findings of Inquiry Officer Mumtaz Jiwan in Order M-933:

 

[In Order M-933, Inquiry Officer Mumtaz Jiwan stated:]

 

The Police claim the application of section 8(1)(l) of the Act to the undisclosed codes contained in the CPIC printout (Record 2).  These codes consist of transmission access codes for the CPIC system which allow the Police to gain access to certain criminal records information . . .

 

The Police submit that the disclosure of this type of information could compromise the security of the CPIC security system and would make unauthorized and illegal access to the CPIC system easier, contrary to various provisions of the Criminal Code  relating to the unauthorized use of data contained in computer records.   I accept the submissions of the Police.  I find that disclosure of the access codes for the CPIC system could reasonably be expected to facilitate the commission of an unlawful act, the unauthorized use of the information contained in the CPIC system.  Accordingly, I find that the codes qualify for exemption from disclosure under section 8(1)(l) of the Act.

 

However, as is noted in the prologue to MO-1335, “The appellant wrote to the Toronto Police Services Board (the Police) asking “why there is [a Firearms Interest Person (FIP) notation] on my CPIC record . . .”  It is apparent from this that the requester already had a printout from CPIC to which he/she was referring – it is never made clear when, or from whom, the requester had received that document.

 

[Order MO-1335] later states that the “two records at issue in this appeal consist of a one-page CPIC report (Record 1) and a three-page occurrence report (Record 2)” and goes on to state that the information withheld from Record 1 was “format codes for accessing the CPIC database.”  In the current appeal, the only information on page 1 is that which comprises the format necessary to access the CPIC database.

 

The appellant submits:

 

I requested access to my personal information through the [Police] Freedom of Information (FOI) Unit since there may be damaging, incorrect personal information contained in the resources used in the Police Reference Check Program.  This information may have interfered with me taking advantage of certain opportunities in the future.  In my opinion, access to my personal information contained in the resources used in the Police Reference Check Program should be as readily available as access to my personal information contained in a credit agency’s files.

.  .  .  .  .

With all due respect to the [Police], I am concerned that unlawful penetration of its computerized databases could be accomplished through a query format.  I hope that the security features in its data bases are more secure than this.  In addition, I am concerned that the [Police believe] that anyone seeking to correct damaging incorrect personal information on himself is construed to be a potential criminal.

 

I agree with the Police that previous orders of this office (for example, Order M-933 and my Order MO-1335) have established that disclosure of CPIC system code information, including transmission access codes, contained on a CPIC printout, could reasonably be expected to facilitate the commission an unlawful act, i.e., unauthorized use of the information contained in the CPIC system, under section 14(1)(l).  I adopt the findings in these orders for the purpose of this appeal, and I find that the code information in the record is exempt.

 

However, I do not accept the submission of the Police that these orders stand for the proposition that the “substantive content” information on CPIC printouts is also exempt under section 14(1)(l).  In fact, previous cases suggest that this kind of information is not exempt under the Act where the person seeks his or her own CPIC information.  For example, in Order MO-1288, former Adjudicator Holly Big Canoe rejected the argument of the Police that CPIC information had been provided in confidence for the purposes of the section 9 “relations with other governments” exemption:

 

The CPIC computer system provides a central repository into which the various police jurisdictions within Canada enter electronic representations of information they collect and maintain.  Not all information in the CPIC data banks is personal information.  That which is, however, deserves to be protected from abuse.  Hence, a reasonable expectation of confidentiality exists between authorized users of CPIC that the personal information therein will be collected, maintained and distributed in compliance with the spirit of fair information handling practices.  However, the expectation that this information will be treated confidentially on this basis by a recipient is not reasonably held where a requester is seeking access to his own personal information.

.  .  .  .  .

Accordingly, I find that there is no reasonable expectation of confidentiality in the circumstances of this appeal, where the appellant is the requester and the information at issue relates to the suspension of the appellant’s drivers licence and a history of his previous charges and convictions, the fact of which he must be aware.

 

In my view, the Police have not established that there is a reasonable expectation that disclosure of the substantive information (as distinct from the system code information), such as the appellant’s name, date of birth, age, and any criminal charges, criminal convictions, warrants, probations and drivers licence suspensions, as well as basic date information and the name of the contributing agency could facilitate the commission of an unlawful act or hamper the control of crime.  While there may be unusual situations where this type of information should be withheld from a requester (such as where disclosure could reasonably be expected to cause harm to an individual), the Police have not identified any particular concerns of this nature here.

 

Therefore, I conclude that the non-CPIC system code information is not exempt under section 38(a), in conjunction with section 8(1)(l) of the Act.

 

ORDER:

 

1.         I order the Police to disclose the record at issue to the appellant in accordance with the highlighted copy of the record I have enclosed with the Police’s copy of this order, no later than November 7, 2003.

 

2.         In order to verify compliance with provision 1, I reserve the right to require the Police to provide me a copy of the material disclosed to the appellant.

 

 

 

 

 

 

 

Original signed by:                                                                      October 21, 2003                 

David Goodis