ORDER PO-2836

 

Appeal PA08-164

 

Wilfrid Laurier University

 

BACKGROUND:

 

Created by an act of Parliament in 1977, the Social Sciences and Humanities Research Council of Canada (SSHRC) is a federal agency that promotes and supports university-based research and training on social, cultural and economic issues. According to the SSHRC website, SSHRC’s grant and fellowship programs and policies enable “knowledge sharing and collaboration across research disciplines, universities and all sectors of society.”

 

This appeal is one of several related appeals with this office, in which similar requests were submitted to Ontario universities under the Freedom of Information and Protection of Privacy Act (the Act).

 

NATURE OF THE APPEAL:

 

The requester submitted the following request under the Act to Wilfrid Laurier University (the University):

 

E-mail communications between, on the one hand, a member of SSHRC Selection Committee No. 15 (2007/8 competition) from W Laurier University, [named individual and email address] and, on the other hand, SSHRC officials, other members of this committee and other interlocutors in which my name … is mentioned. The period covered, October 15, 2007 – April 18, 2008. …

 

The University advised the requester that although it had identified two responsive email records, it would not issue a decision respecting access to them on the basis that the University does not have custody or control of the records for the purpose of section 10(1) of the Act. The University explained that the emails were created by the named professor when that individual was acting as a volunteer member of a SSHRC committee external to the University. The University suggested that the requester submit his request to the SSHRC under the federal access to information legislation [Access to Information Act , R.S. 1985, c. A-1 ].

 

The requester (now the appellant) appealed the University’s decision to this office, which appointed a mediator to try to resolve the issues between the parties. Resolution of the appeal through mediation was not possible, and it was transferred to the adjudication stage of the appeal process, where it was assigned to me to conduct an inquiry.

 

I sent a Notice of Inquiry outlining the facts and the issues to the University, initially, in order to seek representations, which I received. I also received correspondence from the appellant. Next, I sent a modified Notice of Inquiry, along with a complete copy of the University’s representations to the appellant in order to seek his submissions on the issue of custody or control. In the appellant’s Notice, I advised him that although the University’s representations included submissions on the possible application of the personal privacy exemption, I did not require representations from him in response as the issue of custody or control is the sole issue under consideration in this appeal.

 

DISCUSSION:

 

CUSTODY OR CONTROL

 

Section 10(1) of the Act identifies that the issue of whether or not a record is in the custody or under the control of an institution (in this case, the University) is the threshold for determining whether that record is subject to the access provisions in the Act. Section 10(1) states, in part:

 

Every person has a right of access to a record or a part of a record in the custody or under the control of an institution unless . . .

 

Under section 10(1), therefore, the Act applies only to records that are in the custody or under the control of an institution.

 

A finding that a record is under the custody or control of an institution does not necessarily mean that a requester will be provided access to it. In this appeal, I advised the parties in the Notice of Inquiry that a record found to be in the custody or control of the University may or may not be subject to the Act pursuant to section 65 (see Orders PO-2693 and PO-2825). I noted that the question of whether records in the custody or under the control of the University are excluded from the application of Act pursuant to section 65 (including sections 65(8.1) – 65(10)) is a matter that could be dealt with at a later point, if necessary. Furthermore, a record under an institution’s custody or control and subject to the Act may be withheld if it falls within one of the exemptions under sections 12 to 22.

 

The courts and this office have applied a broad and liberal approach to the custody or control question [Ontario (Criminal Code Review Board) v. Ontario (Information and Privacy Commissioner), [1999] O.J. No. 4072 [“Ontario (Criminal Code Review Board)”]; Canada Post Corp. v. Canada (Minister of Public Works) (1995), 30 Admin. L.R. (2d) 242 (Fed. C.A.) [“Canada Post”], and Order MO-1251].

 

Factors relevant to determining “custody or control”

 

Based on the above approach, this office has developed a list of factors to consider in determining whether or not a record is in the custody or control of an institution, as follows [Orders 120, MO-1251, PO-2306 and PO-2683]. The list is not intended to be exhaustive. Some of the listed factors may not apply in a specific case, while other unlisted factors may apply.

 

• Was the record created by an officer or employee of the institution? [Order P-120]

 

• What use did the creator intend to make of the record? [Orders P-120 and P-239]

 

• Does the institution have a statutory power or duty to carry out the activity that resulted in the creation of the record?  [Order P-912, upheld in Ontario (Criminal Code Review Board) v. Ontario (Information and Privacy Commissioner), above]

 

• Is the activity in question a “core”, “central” or “basic” function of the institution? [Order P-912]

 

• Does the content of the record relate to the institution’s mandate and functions? [Orders P-120 and P-239]

 

• Does the institution have physical possession of the record, either because it has been voluntarily provided by the creator or pursuant to a mandatory statutory or employment requirement? [Orders P-120 and P-239]

 

• If the institution does not have possession of the record, is it being held by an officer or employee of the institution for the purposes of his or her duties as an officer or employee? [Orders P-120 and P-239]

 

• Does the institution have a right to possession of the record? [Orders P-120 and P-239]

 

• Does the institution have the authority to regulate the record’s use and disposal?  [Orders P-120 and P-239]

 

• Are there any limits on the use to which the institution may put the record, what are those limits, and why do they apply to the record?

 

• To what extent has the institution relied upon the record? [Orders P-120 and P-239]

 

• How closely is the record integrated with other records held by the institution? [Orders P-120 and P-239]

 

• What is the customary practice of the institution and institutions similar to the institution in relation to possession or control of records of this nature, in similar circumstances? [Order MO-1251]

 

Representations

 

In correspondence submitted during the intake stage of this appeal, the University summarized its concerns about the request in the following manner:

 

This request strikes at the foundation of the peer review process that guides research in Canada. Access to such confidential reviews would undermine the operation of the university-based research funded by the federal government. In particular, if the university were able to access directly the records of SSHRC reviewers, the independence of those reviewers from influence by the university would immediately become suspect.

 

University’s Representations

 

The University explains that the named professor is a full-time tenured faculty member who has use of a university email account as a University employee. The University notes that this professor is entitled to use his University email account for non-University business as long as that use complies with the guidelines established by the University’s policy on the use of information technology (9.1 Policy Governing the Use of Information Technology), a copy of which was attached to the University’s representations (the IT Use Policy). Regarding this policy, the University submits:

 

Users must use computing and communication facilities and services only for the purposes for which they were authorized, which includes instructional, research and administrative work. It is only where accounts will be used for private work for direct personal financial gain, or for a prohibited use, that the use of the University accounts may be restricted or the University will become involved in the management of the use of the e-mail account. In this case, the professor was a volunteer member of a research committee and the use of the University e-mail account fell within authorized use. Given the authorized use of the University’s e-mail server and technology system, there is an expectation of confidentiality by the professor and no right of possession by the University.

 

The University takes the position that the SSHRC emails are not related to business undertaken by the professor in the course of his University employment and are distinct and separate from his duties and responsibilities as a University faculty member and employee. Referring to the collective agreement in place at the University for its faculty, the University maintains that the named professor’s volunteer SSHRC committee work is not assigned by the University as a component of the professor’s “assigned workload.” The University provided an excerpt from the relevant collective agreement to this office.

 

According to the University, any correspondence received or forwarded to, or by, the named professor in his capacity as a member of the SSHRC Committee is “personal communication” and is not, therefore, a record that is in the custody or control of the University. Addressing the factors for determining custody or control outlined in the Notice of Inquiry, the University submits that:

 

At no time did the professor or the University see his work on the Committee or the creation of the e-mail records to be part of his employment. Nor would the confidential correspondence ever be provided to the University in the context of his employment with the University. The University was never an intended recipient of the confidential e-mail record.

 

Bare possession of the information does not amount to custody for the purpose of the Act [Order P-239]. There must be some right to deal with the records and some responsibility for their care and protection. The University acknowledges that the emails were sent on the University server; however, the University has no right to deal with the e-mails as they relate to business unrelated to the University or the professor’s employment obligations. The University has no responsibility for their care and protection. The records were not created pursuant to any statutory requirement of the University, nor for any employment obligation of the professor.

 

The University argues that the creation of the records, occurring as it did in the context of the SSHRC committee’s review and evaluation of research proposals, is unrelated to the University’s mandate and functions. The University maintains that because the records were not prepared at its request but rather “for a use outside of the University’s custody or control,” it has no authority to regulate their use. Moreover, the University argues that unless the e-mails contravene the IT Use Policy, there is no authority to dispose of the records as they are personal records, both created and retained by the professor.

 

Respecting the degree of integration of the records with other records held by the University, the University submits that “save and except for the bare possession of the e-mails because they were generated on the University’s system, the e-mails form no part of the University’s records.”

 

The appellant maintains that each university whose representative sat on the SSHRC adjudication committee in question has custody and control over records of the type requested. The appellant states that in response to the access request he submitted to SSHRC under the federal  Access to Information Act , SSHRC responded that it has no custody or control over communications of members of SSHRC adjudication committees that are stored on the backup servers of the universities they represent. The appellant provided a copy of this response by SSHRC to his request under the federal  Access to Information Act .

 

The appellant submits that individuals do not join SSHRC committees of their own initiative, and are instead invited to do so by the responsible program officer. According to the appellant, individual members of SSHRC adjudication committees do not represent themselves, but rather their institutions as part of the SSHRC policy to ensure balanced representation by institution and province. The appellant maintains that since the official SSHRC committee lists includes each member’s institutional affiliation, the argument that “activities of SSHRC adjudicators shall be completely dissociated from their status [as] university employees is not tenable.” Further, the appellant submits that:

 

… SSHRC regularly sends thank you letters to the universities to acknowledge the service provided by the committee’s members. These letters are usually addressed to the deans of faculties and schools represented by the adjudicators; they are taken into consideration when evaluating the faculty member’s performance. Last, but not least, if the activities under consideration were not an integral part of academic life, then the use of institution e-mail accounts for the purpose of communicating with other committee members and SSHRC officers would violate the [IT Use Policy]. For instance, … [the University’s IT Use Policy] states “when outside professional activities of users would involve the use of the University’s computing and communication facilities, approval shall be obtained from the Office of the Directory of Informational Technology Services and charges shall be at the prevailing rate. … No evidence was provided… that members of the SSHRC Adjudication Committee No. 15 applied for such permission and, hence considered their services as an “outside professional activity.”

 

With respect to the factors relevant to determining custody or control, the appellant notes that the records were created by an employee of the University and represent the method of communication between that individual – a SSHRC committee member – and the responsible SSHRC officer, which in turn forms an “integral part” of the peer-review process. As to whether or not the University has a “statutory power or duty to carry out the activity that resulted in the creation of the record,” or if the record’s content relates to the University’s mandate and functions, the appellant submits that:

 

Peer review is a necessary precondition of “the pursuit of learning through scholarship, teaching and research.” … Furthermore, academic service is an integral part of duties of faculty members.

 

The appellant submits that the University has physical possession of, and the right to possess, records or “messages stored (and in some cases – deleted from) [its] back-up server.” In support of this argument, the appellant relies on “successful searches” identifying records at two post-secondary institutions in other provinces to which he submitted access requests.

 

The remainder of the appellant’s representations relate to his concerns about his SSHRC grant application and address matters beyond the scope of the present appeal.

 

In its reply representations, the University acknowledges that faculty members are obligated by the terms of the Collective Agreement to engage in “scholarly activities, including research, as well as to engage in academic, professional and University community service.” According to the University, although engaging in research and scholarly activities may be a “core function” of the University and work of faculty members, “peer review for an external agency is not part of the core or central mandate of the University” nor do faculty represent the University when they choose to participate in these committees. The University argues that a faculty member’s decision to serve on a SSHRC committee in order to fulfil the obligations of the Collective Agreement would be solely at their discretion, as the University has no power to compel such participation and, therefore, no corresponding custody or control over records is created as a consequence of such participation.

 

Analysis and Findings

 

In the circumstances of this appeal, and for the reasons that follow, I find that records responsive to the appellant’s request are in the custody or control of the University within the meaning of section 10(1) of the Act.

 

With respect to the concerns expressed by the University regarding the potential for this request to compromise the independence of peer review activities, I would emphasize that my finding in this appeal does not have any bearing on the determination of access to the responsive records. The sole issue before me is whether the University has custody or control over the type of record requested by the appellant: emails created incidentally by a University faculty member’s participation on a SSHRC committee.

 

In beginning my analysis of the issue before me, I would express my agreement with former Commissioner Sidney Linden that a broad and liberal interpretation to the issue of custody and control is important to give proper effect to the purposes and principles of the Act [Order 120].

 

Past orders have specifically addressed the issue of custody or control over records located on an institution’s computer system. In Order PO-1725, former Assistant Commissioner Tom Mitchinson reviewed a decision by Cabinet Office regarding the electronic copy of the agenda of an employee in the Premier’s Office that contained both personal and professional appointments. While the institution admitted that it had “the general authority to dispose of the database containing the records,” it argued that the information in the records relating to the named employee’s “personal,” as opposed to his employment, activities, was not in its custody or under its control. The former Assistant Commissioner rejected this argument and found that all information in the electronic agenda was in the custody of the Premier’s Office since its entries – personal and professional – were created and stored on a computer system that was owned and maintained by the government and used for government business.

 

In my view, the following line of reasoning in Order PO-1725 provides a useful context for my findings in the present appeal:

 

My discussion will focus on whether or not the Premier’s Office has custody of these records. If I determine that the Premier’s Office has lawful custody of the records, that finding is sufficient to bring the records within the scope of section 10(1)(a) and under the jurisdiction of the Act.

 

Two broad principles emerge from the Commissioner’s orders dealing with the issue of custody. The first is that bare possession does not amount to custody, absent some right to deal with the records and some responsibility for their care and protection (Order P-239). The second principle is that “... physical possession of a record is the best evidence of custody, and only in rare cases could it successfully be argued that an institution did not have custody of a record in its actual possession” (Order 41).

 

In my view, there are a number of facts and circumstances surrounding the creation, possession and maintenance of the records at issue in these appeals which support the conclusion that they are in the custody of the Premier’s Office.  All entries, whether they contain personal or professional information, were created and stored in the same database. This database is owned and maintained by the government on behalf of the Premier’s Office. This factor alone gives the institution both a right to deal with the records and a responsibility for their care and protection, in order to ensure the integrity of the database as a whole and of the information entered into it.

 

In addition, it is clear that the purpose for which the database exists is for use by employees attending to the business of the Premier’s Office. The capabilities of the database in permitting employees to make entries relating to personal matters… are normal features of most electronic calendar management databases and are not inconsistent with the institution’s lawful custody of the database and its contents, or with its responsibilities in relation to its records management functions. If an employee of a government institution voluntarily chooses to place information, whether personal or professional in nature, into a government maintained database, it is difficult to conceive how the record containing that information would fall outside the institution’s lawful custody, absent the most exceptional circumstances, which I do not find present here.

 

It is not enough for an institution to assert simply that the named employee has sole authority over access to the records, that there is no protocol in place governing their disposition during the employee’s tenure, or that the retention schedule does not specifically deal with these types of records. As the Divisional Court noted in Ontario (Criminal Code Review Board) v. Ontario (Information and Privacy Commissioner) (March 7, 1997), Toronto Doc. 283/95 (Ont. Div. Ct.), [aff’d 47 O.R. (3d) 201 (C.A.)], for example, the absence of evidence that an institution has actually exercised control over particular records will not necessarily advance the institution’s argument that it, in fact, has no control.  If it were otherwise, government institutions would be in a position to abdicate their information management responsibilities under the Act by the simple device of failing to implement appropriate information management practices in respect of records in their lawful custody. So long as records are in an institution’s custody, that body must deal with them in accordance with all applicable laws, including the provisions of the Act.

 

The reasoning in Order PO-1725 is applicable in the circumstances of the present appeal and I adopt it for the purposes of this order.

 

I accept the evidence of the University that the named professor was not sitting on the SSHRC committee at the direction of the University, or as part of his “assigned workload” under the Collective Agreement. However, it does not follow, in my view, that any email records created incidentally through the faculty member’s voluntary participation on the SSHRC committee are outside of the University’s lawful custody and, therefore, removed from the reach of the Act. Moreover, while it is true that “bare possession of the information” does not amount to custody or control for the purpose of the Act, there is, in my view, ample evidence in this appeal to support a finding that the University has “some right to deal with the records and some responsibility for their care and protection” [Order P-239].

 

According to the University’s enabling statute, The Wilfrid Laurier University Act, 1973 [as amended by Wilfrid Laurier University Amendment Act, 2001 S.O. 2001, c. 12], the objects of the University are “the pursuit of learning through scholarship, teaching and research within a spirit of free enquiry and expression.” In my view, this purpose statement may be viewed as representing the University’s “mandate.” Moreover, on the face of it, faculty involvement in SSHRC activities would appear to fit within that mandate. The University acknowledges that engaging in research and scholarly activities is a “core function”’ of the University and the work of its faculty members and also admits that faculty members are obligated under the Collective Agreement to engage in “scholarly activities, including research, as well as to engage in academic, professional and University community service.” However, the University then argues that research and scholarly activities involving “peer review for an external agency” are somehow removed from the realm of scholarly activities that fall within the core function or mandate of the University. In my view, this distinction between internal and external peer review activities is without merit. Rather, I find that the named professor’s SSHRC committee participation represents an activity going to the core or central function of the University notwithstanding the fact that it may be with an agency external to the University. I am similarly satisfied that the content of any records created incidentally through faculty participation on a SSHRC adjudication committee is related to the University’s scholarship and research mandate.

 

The University also sought to establish that the named professor’s SSHRC email communications constitute “personal communication” and are not, therefore, in the University’s custody or control. In my view, if it was strictly necessary for me to distinguish between personal and professional (or employment) information, it seems more likely that the SSHRC-related email correspondence would be construed as being “professional communication.” In addition, I would refer back to the following finding in Order PO-1725, where former Assistant Commissioner Mitchinson stated:

 

All entries, whether they contain personal or professional information, were created and stored in the same database. This database is owned and maintained by the government on behalf of the Premier’s Office. This factor alone gives the institution both a right to deal with the records and a responsibility for their care and protection, in order to ensure the integrity of the database as a whole and of the information entered into it.

 

Moreover, as the former Assistant Commissioner also stated in Order P-267:

 

… it is not possible for an institution to remove records in its physical possession from the purview of the Act by simply maintaining that they relate to political party [personal] activity. To do so would be inconsistent with the obligation of institutions to properly manage their record holdings in accordance with the intent of the Act.

 

I agree. In this appeal, the University cannot carve out an exception from the Act for records otherwise in its lawful custody simply by asserting that they were created in the author’s personal capacity. Moreover, the purported absence of an entitlement on the University’s part to view, receive or exercise authority over the named professor’s SSHRC-related email correspondence for confidentiality reasons has no bearing on the issue of custody or control within the meaning of section 10(1) of the Act. The use to which such correspondence could potentially be put by the University or others is, as previously suggested, not relevant in the context of this inquiry.

 

I also do not accept the argument that because the named professor’s use of University email for SSHRC communications constitutes “authorized use” under the IT Use Policy and is unrelated to his employment at the University, the records form no part of the University’s record-holdings and it has no right to possess them. On the contrary, I am satisfied that the University has lawful custody of such records through the normal course of overseeing the administration and management of its computer system, including its server and databases. I note, moreover, that there is no suggestion in the University’s submissions on the IT Use Policy to the effect that “authorized use” emails are not in its custody or control.

 

The University’s computer system is in place to facilitate learning and the pursuit of scholarly research activities. The University’s IT Use Policy specifically provides for the use of IT resources by faculty “in support of their teaching, research and administrative activities.” It also clearly contemplates disciplinary action for unauthorized or inappropriate use of those resources. In the present appeal, therefore, I am satisfied that the University’s ability to monitor its computer resources and network under the terms of its IT Use Policy accords it the corresponding right to regulate all records on its computer system, notwithstanding that it may choose not to do so in circumstances where the use is said to be “authorized,” as in this case. As the Divisional Court stated in Ontario (Criminal Code Review Board) (cited above), the mere fact that an institution has not exercised control over particular records in the past “will not necessarily advance the institution’s argument that it, in fact, has no control.” Therefore, regardless of the fact that the University chose not to exercise control through regulation of the named professor’s use of University IT resources for SSHRC email communications, it does not follow that the email records are outside the University’s custody or control.

 

Furthermore, the University has provided insufficient evidence to support the assertion that the email records at issue here are kept separate and apart from its usual record-holdings. For example, there is no evidence that the named professor took steps to establish a different system of storage and maintenance of those records [Order P-267]. As I understand it, the SSHRC-related email correspondence was maintained in the same computer system as other records which may have been related to the named professor’s “assigned workload” and other scholarly activities at the University. In the circumstances, I find that the records requested are sufficiently integrated into the University’s information management systems that there is no basis for distinguishing them from the University’s general record-holdings for the purpose of determining custody or control.

 

I would also note that in the case of emails that may have originated with outside parties such as the responsible SSHRC program officer, other SSHRC staff or other committee members, previous orders of this office have held that the Act will apply to information in the custody or under the control of an institution notwithstanding that it was created by a third party [Orders P-239, P-1001 and MO-1225.]

 

In the context of the circumstances under which the records at issue were created and maintained, I find that the University has both the right and responsibility to deal with the records, and that they are in the custody of the University for the purpose of section 10(1) of the Act. In view of my finding that the named professor’s SSHRC-related emails are in the University’s custody, the University is required to deal with them in accordance with all applicable laws, including the provisions of the Act [Order PO-1725].

 

In conclusion, I will reiterate that my finding that the responsive records are in the custody of the University will not compromise the confidentiality of a faculty member’s “scholarly activities” or the independence of the SSHRC peer review process. As the University acknowledged in its decision letter to the appellant, “were records of proposed research reviews deemed to be in the custody and control of the university, we would need to consider other exemptions and exceptions, such as those in section 49 and 65 of [the Act].” Accordingly, reliance on the exclusions and exemptions of the Act for such records is unaffected by my finding and remains available to the University in response to this order.

 

ORDER:

 

1.                  I order the University to issue a decision letter to the appellant regarding access to the records at issue in accordance with the provisions of the Act, treating the date of this Order as the date of the request.

 

2.                  I order the University to provide me with a copy of the decision letter referred to in Provision 1 when it is sent to the appellant. This should be forwarded to my attention, c/o Information and Privacy Commissioner/Ontario, 2 Bloor Street East, Suite 1400, Toronto, Ontario M4W 1A8.

 

 

 

 

 

 

Original signed by:________                                                      October 28, 2009               

Daphne Loukidelis

Adjudicator