Information and Privacy Commissioner, Ontario, Canada

Commissaire à l’information et à la protection de la vie privée, Ontario, Canada

FINAL ORDER PO-3103-F

Appeal PA11-57

University of Ottawa

August 3, 2012

Summary: The appellant requested records from the university under the Act concerning a complaint made against him by a fellow student. At issue in this order are responsive emails to and from university professors. The university denied access to these records or portions of records in accordance with the personal privacy exemptions in sections 21(1) and 49(b). This order partially upholds the university’s decision to withhold information under sections 21(1) and 49(b).

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, section 2(1) (definition of personal information), sections 21(1), 49(b).

Orders and Investigation Reports Considered: PO-3009-F, PO-3026-I.

OVERVIEW:

[1] The University of Ottawa (the university) received a request under the Freedom of Information and Protection of Privacy Act  (FIPPA  or the Act ) for records dated from October 1, 2009 to the time of the request. The part of the request at issue in this order concern records sent or received by two professors that are in the university’s custody or control about:¹

1. 1) Any personal file(s) maintained in the name of [the appellant], student [#];
2. 2) All documentation, notes, records and reports relating to allegations made by [a named student and her father] against [the appellant];
3. 3) All documentation, notes, records, reports and minutes relating to meetings where [the appellant] has been present, or in his absence where he was discussed;
4. 4) All documentation, notes, records and reports relating to information released about [the appellant] to any individual not in the employ of the University of Ottawa;
5. 5) All information relating to the student code of conduct and the teacher code of conduct for 2009-10 in the [named] department …Faculty of Arts.

[2] The university located the responsive records and issued a decision denying access to the records in part, relying on sections 49(a) with 19 (solicitor-client privilege) and sections 21(1) and 49(b) (personal privacy).

[3] I sent a Notice of Inquiry to the university and the appellant, setting out the facts and issues remaining at issue in this appeal, seeking their representations. I received representations from the university on the records at issue in this order. Portions of the university’s representations were withheld from the appellant due to confidentiality concerns.

[4] In response to the university’s representations, the appellant indicated that he was relying on his representations previously filed in response to the Notice of Inquiry sent to him concerning the records adjudicated upon in Interim Order PO-3026-I.² When referring to the appellant’s submissions, I will be referring to these previously submitted representations.

[5] In this order, I partially uphold the university’s decision to withhold information under sections 21(1) and 49(b). It was not necessary that I make a decision as to whether the information in Records 194 and 195 identified as containing solicitor-client privileged information are exempt under section 49(a) read in conjunction with section 19, as I found this information exempt under section 49(b).

RECORDS:

[6] The records consist of emails and are identified by the university in its index of records as Records 171 to 316. Remaining at issue are portions of Records 171, 172, 184, 185, 194, 195, 198, 201, 202, 255 and 277 and all of Records 173 to 179, 204, 205, 266, 268 and 288 to 291.

[7] The university has claimed the application of the discretionary personal privacy exemption in section 49(b) to all of the information at issue in these records, except for Records 171-172, 184-185, 198, 201-202, 255, and 277, where it has claimed the mandatory personal privacy exemption in section 21(1).

[8] The university has also claimed the application of the discretionary exemption in section 49(a) in conjunction with section 19 (solicitor-client privilege) to one identical portion of information in each of Records 194 and 195.

ISSUES:

1. A. Do the records contain personal information as defined in section 2(1) and, if so, to whom does it relate?
2. B. Does the mandatory personal privacy exemption at section 21(1) or the discretionary personal privacy exemption at section 49(b) apply to the information at issue?
3. C. Did the university exercise its discretion under section 49(b)? If so, should this office uphold the exercise of discretion?

DISCUSSION:

A. Do the records contain personal information as defined in section 2(1) and, if so, to whom does it relate?

[9] In order to determine which sections of the Act  may apply, it is necessary to decide whether the record contains personal information and, if so, to whom it relates. That term is defined in section 2(1) as follows:

personal information means recorded information about an identifiable individual, including,

(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

(c) any identifying number, symbol or other particular assigned to the individual,

(d) the address, telephone number, fingerprints or blood type of the individual,

(e) the personal opinions or views of the individual except if they relate to another individual,

(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

(g) the views or opinions of another individual about the individual, and

(h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

[10] The list of examples of personal information under section 2(1) is not exhaustive. Therefore, information that does not fall under paragraphs (a) to (h) may still qualify as personal information [Order 11].

[11] Sections 2(2), (3) and (4) also relate to the definition of personal information. These sections state:

(2) Personal information does not include information about an individual who has been dead for more than thirty years.

(3) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

(4) For greater certainty, subsection (3) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling.

[12] To qualify as personal information, the information must be about the individual in a personal capacity. As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be about the individual [Orders P-257, P-427, P-1412, P-1621, R-980015, MO-1550-F and PO-2225].

[13] Even if information relates to an individual in a professional, official or business capacity, it may still qualify as personal information if the information reveals something of a personal nature about the individual [Orders P-1409, R-980015, PO-2225 and MO-2344].

[14] The university provided both confidential and non-confidential representations as to whether the records contain personal information. In its non-confidential representations, it submits that:

Records 194 and 195 relate to the Protection Services Incident Report [#] (the report) and contain personal information belonging to the appellant and to identifiable individuals other than the appellant. More specifically, the withheld information relates to [the complainant’s] complaint about the appellant to Protection Services. The withheld portions of the report contain information relating to her complaint, education history, her opinions and views with respect to the appellant and her contact information. Furthermore, some of the information also relate to the [the complainant’s] parents’ …personal contact information.

Records 171 and 172 consist of the professor’s personal views and opinion with respect to the performance of the students in his class, the information does not relate to the [appellant].

Records 173-179 and 204-205 contain personal information and relate to personal conversation between one of the professors and [the complainant] where [she] is expressing her views on the situation with the appellant.

Records 184-185, 198, 201-202, 255 and 288-290 relate to the professors’ views regarding the [complainant]…

Records 266 and 268 consist of personal information relating to the [name] views and opinions towards the appellant’s email sent by the University Legal Counsel to [complainant].

Records 277, 291 and 291 relate [to the complainant] who did not consent to the release of her identity to the [appellant] and her views and opinion towards the appellant.

The above-noted records contain information about other individuals other than the appellant, which, if disclosed, will allow the appellant to identify these individuals as well as other relevant personal information related to them such as personal opinions and views.

[15] The appellant submits that the records contain personal information relating primarily to him. He states that:³

Any further information was provided in the context of a discussion about me and relates directly to me.

Analysis/Findings

[16] Based on my review of the information at issue in Records 171 and 172, I find that this information is not information of identifiable individuals but is general information about a number of non-identifiable individuals. To qualify as personal information, it must be reasonable to expect that an individual may be identified if the information is disclosed. As this information is not personal information, the personal privacy exemption in section 21(1) cannot apply. As no other exemptions have been claimed for this information and I am of the view that no mandatory exemptions could apply, I will order it disclosed.

[17] I find that the remaining information in the records constitutes the personal information of the appellant and other identifiable individuals in their personal capacity; namely, information relating to these individuals’ educational history [paragraph (b)], personal opinions and views [paragraphs (e) and (g)], and personal addresses and telephone numbers [paragraph (d) of the definition of personal information in section 2(1)].

[18] Based on my review of the information remaining at issue in Records 184-185, 198, 201-202, 255, and 277, I find that this information is personal information of identifiable individuals other than the appellant in their personal capacity. Therefore, I will consider below whether the mandatory personal privacy exemption in section 21(1) applies to this information.

[19] Based on my review of the information remaining at issue in Records 173 to 179, 194, 195, 204, 205, 266, 268 and 288 to 291, I find that this information is personal information of the appellant, the complainant, and other identifiable individuals in their personal capacity. Therefore, I will consider below whether the discretionary personal privacy exemption in section 49(b) applies to this information.

B. Does the mandatory personal privacy exemption at section 21(1) or the discretionary personal privacy exemption at section 49(b) apply to the information at issue?

[20] Section 47(1)  of the Act  gives individuals a general right of access to their own personal information held by an institution. Section 49 provides a number of exemptions from this right.

[21] Under section 49(b), where a record contains personal information of both the requester and another individual, and disclosure of the information would constitute an unjustified invasion of the other individual’s personal privacy, the institution may refuse to disclose that information to the requester.

[22] If the information falls within the scope of section 49(b), that does not end the matter. Despite this finding, the institution may exercise its discretion to disclose the information to the requester. This involves a weighing of the requester’s right of access to his or her own personal information against the other individual’s right to protection of their privacy.

[23] Under section 21(1), where a record contains personal information only of an individual other than the requester, the institution must refuse to disclose that information unless disclosure would not constitute an unjustified invasion of personal privacy.

[24] The university submits that the information at issue in the records consists of personal contact information and educational history, as well as personal opinions and views which are sensitive and in which were supplied by individuals other than the appellant to the university in confidence.

[25] The university submits that the information at issue in the records falls within the invasion of personal privacy exemption in section 21(1) (f) of the Act  as disclosure would constitute an unjustified invasion of the privacy of these other individuals in the records. This section reads:

A head shall refuse to disclose personal information to any person other than the individual to whom the information relates except,

if the disclosure does not constitute an unjustified invasion of personal privacy.

[26] The university states that disclosure of the information could unfairly affect the individuals in the records other than the appellant and would constitute a presumed unjustified invasion of personal privacy which cannot be rebutted by one or more factors under section 21(2).

[27] The appellant submits that the personal information in the records relates to allegations made against him, conversations stemming from these allegations, and the university’s handling of these allegations. The appellant states that it is completely unreasonable to suggest that it is an unjustified invasion of the complainant’s personal privacy to disclose the records when they clearly discuss his character at length and the information in them was provided willingly for the purpose of continuing a discussion regarding his actions.

Analysis/Findings

[28] In both the case of section 21(1) and 49(b), sections 21(1) to (4) provide guidance in determining whether the unjustified invasion of personal privacy threshold is met.

[29] If the information fits within any of paragraphs (a) to (e) of section 21(1), disclosure is not an unjustified invasion of personal privacy and the information is not exempt under section 49(b) or section 21(1). In this appeal, the information does not fit paragraphs (a) to (e) of section 21(1).

[30] The factors and presumptions in sections 21(2), (3) and (4) help in determining whether disclosure would or would not be an unjustified invasion of privacy under sections 21(1) or 49(b). If any of paragraphs (a) to (d) of section 21(4) apply, disclosure is not an unjustified invasion of personal privacy and the information is not exempt under sections 21(1) or 49(b). If any of paragraphs (a) to (h) of section 21(3) apply, disclosure of the information is presumed to be an unjustified invasion of personal privacy under section 49(b) or 21(1). In this appeal, section 21(4) does not apply. In my view, the presumption in section 21(3)(d) applies to the educational history of the complainant. This section reads:

A disclosure of personal information is presumed to constitute an unjustified invasion of personal privacy where the personal information,

relates to employment or educational history

[31] As section 21(3)(d) applies to the educational history in the records at issue, disclosure of this information is presumed to be an unjustified invasion of personal privacy under section 49(b). In Grant v. Cropley,⁴ the Divisional Court said the Commissioner could:

. . . consider the criteria mentioned in s.21(3)(b) in determining, under s. 49(b), whether disclosure . . . would constitute an unjustified invasion of [a third party’s] personal privacy.

[32] As sections 21(3) and (4) do not apply to the remaining personal information, section 21(2) lists various factors that may be relevant in determining whether disclosure of this personal information would constitute an unjustified invasion of personal privacy [Order P-239].

[33] The list of factors under section 21(2) is not exhaustive. The institution must also consider any circumstances that are relevant, even if they are not listed under section 21(2) [Order P-99].

[34] As the university refers to the sensitivity of the personal information in the records and argues that it was supplied in confidence, it appears to be relying on the factors that favour non-disclosure in sections 21(2)(f) and (h), which read:

A head, in determining whether a disclosure of personal information constitutes an unjustified invasion of personal privacy, shall consider all the relevant circumstances, including whether,

(f) the personal information is highly sensitive;

(h) the personal information has been supplied by the individual to whom the information relates in confidence; and

[35] For section 21(2)(f) to apply, for the personal information to be considered highly sensitive, there must be a reasonable expectation of significant personal distress if the information is disclosed [Orders PO-2518, PO-2617, MO-2262 and MO-2344].

[36] The personal information at issue in the records includes the personal information of the complainant and other individuals other than the appellant. Based upon my review of the personal information at issue, I find that there is a reasonable expectation of significant personal distress to the complainant and the other individuals if their personal information is disclosed. Accordingly, I find that the consideration in section 21(2)(f) is a significant factor favouring non-disclosure.

[37] For section 21(2)(h) to apply, both the individual supplying the information and the recipient had to have had an expectation that the information would be treated confidentially, and that expectation is reasonable in the circumstances. Thus, section 21(2)(h) requires an objective assessment of the reasonableness of any confidentiality expectation [Order PO-1670].

[38] I find that the factor in section 21(2)(h) applies in this case as the personal information of the complainant and the other identifiable individuals was supplied in confidence. The factor in 21(2)(h) is a factor weighing strongly in favour of a finding that disclosure of the personal information in the records would constitute an unjustified invasion of personal privacy.

[39] I find that the personal information in the records that is both the personal information of the appellant and that supplied by the complainant and other individuals is so intertwined with the personal information of the appellant that it cannot be reasonably severed.⁵ Accordingly, I find that the factors in both sections 21(2)(f) and (h) apply to this information and weigh against the disclosure of the personal information in the records that is the mixed personal information of the appellant and other individuals in the records.

[40] As I stated in Interim Order PO-3026-I, in this appeal, unlike the situations in Orders P-1014, PO-1750 and PO-1767, the appellant is aware of the allegations made against him and was given the ability to respond to these allegations. The appellant instructed the mediator that neither the mediator nor the adjudicator were to contact the individuals whose personal information is found in the records referred to in the records (the affected persons) to seek their representations on disclosure of their personal information. Therefore, I find that it is not unreasonable or unfair that the appellant is not being provided with the withheld personal information of other identifiable individuals in the records that is related to the complaint made against him.

[41] Accordingly, the unlisted factor raised by the appellant that the records discuss his character and the information in them was provided willingly for the purpose of continuing a discussion regarding his actions carries little weight in favour of disclosure of the information that is the mixed personal information of the appellant and other individuals in the records.

[42] Therefore, taking into consideration the findings in the orders considered above⁶ and balancing the factors favouring the protection of privacy in sections 21(2)(f) and (h) against the factor raised by the appellant favouring access, I find that the factors favouring the non-disclosure of the information that includes the personal information of the complainant and the other individuals in the records are more compelling. This information was provided to the university with a clearly-stated expectation of confidentiality and makes reference to a number of highly sensitive facts relating to the complainant. Because of the nature of this personal information in the records and the fact that the appellant has been provided with a significant amount of information concerning the allegations made against him by the complainant, I find that the considerations favouring privacy protection outweigh those which favour the appellant’s right of access to them.

[43] The records also contain emails exchanged between the two professors named in the request. Included in this exchange are emails in Records 176 and 179 which contain information that only discusses the appellant. In addition, Record 268 contains an email from the appellant. As this information relates only to the appellant or was supplied by the appellant, the factors in section 21(2)(f) and (h) do not apply to the disclosure of this information as the personal information is not highly sensitive and was not supplied by the complainant or the other individuals in the records in confidence. Disclosure of this information would not constitute an unjustified invasion of the personal privacy of the complainant or the other individuals in the records under section 49(b) and I will order this information that only discusses the appellant disclosed to him.

Conclusion

[44] Subject to my review of the university’s exercise of discretion, the personal information at issue in the records that includes the personal information of other identifiable individuals is exempt under the personal privacy exemptions in sections 21(1) or 49(b). As the information for which the university has claimed the discretionary solicitor-client exemption in section 49(a) in conjunction with section 19 is subject to section 49(b), there is no need for me to consider the application of the solicitor-client exemption in this order.

[45] The information that includes only the personal information of the appellant is not subject to the personal privacy exemptions in sections 21(1) or 49(b). The university has not claimed that any other exemptions apply to this information; therefore, I will order it disclosed.

C. Did the university exercise its discretion under section 49(b)? If so, should this office uphold the exercise of discretion?

[46] The section 49(b) exemption is discretionary, and permits an institution to disclose information, despite the fact that it could withhold it. An institution must exercise its discretion. On appeal, the Commissioner may determine whether the institution failed to do so.

[47] In addition, the Commissioner may find that the institution erred in exercising its discretion where, for example,

• • it does so in bad faith or for an improper purpose
• • it takes into account irrelevant considerations
• • it fails to take into account relevant considerations.

[48] In either case this office may send the matter back to the institution for an exercise of discretion based on proper considerations [Order MO-1573]. This office may not, however, substitute its own discretion for that of the institution [section 54(2)].

[49] The university submits that when exercising its discretion it took into consideration the purpose of the Act , whether the requester was seeking his own personal information, whether the requester had a sympathetic or compelling need to receive the information and whether disclosure would increase public confidence in the operation of the university.

[50] Concerning the records for which it applied the personal privacy exemption, it submits that the university is not in the practice of disclosing personal information about an individual to someone other than the individual to whom the personal information relates without consent. It also states that there is no sympathetic or compelling need for the appellant to receive the personal information remaining at issue in the records.

[51] The appellant submits that as he is seeking his own personal information and information directly relating to him and accusations made against him, he has the right to view all files maintained in his name. He states that this right is in accordance with the Act  which upholds that individuals should have a right of access to their own personal information and that exemptions from the right of access should be limited and specific.

[52] The appellant feels that the university acted in bad faith to withhold his personal information and relied on this information to justify excluding him from university activities and withholding services from him that were offered to other students.

Analysis/Findings

[53] Based upon my review of the parties’ representations and considering the fact that the remaining records contain the personal information of identifiable individuals other than the appellant, I find that the university exercised its discretion in good faith.

[54] In the circumstances of this appeal, I find that there is no sympathetic or compelling need for the appellant to receive the information at issue in the records and that the privacy of the individuals other than the appellant in the records should be protected.

[55] In exercising its discretion, I find that the university exercised its discretion in a proper manner, taking into account relevant considerations and not taking into account irrelevant considerations. Accordingly, I uphold the university’s exercise of discretion under section 49(b).

ORDER:

1. 1. I order the university to disclose to the appellant all of the information at issue in Records 171 and 172 and the portions of Records 176, 179 and 268 that I have found to not qualify for exemption by August 27, 2012. For the sake of clarity, with this order, I have provided a copy of Records 176, 179 and 268 with the information to be disclosed from these three records highlighted.
2. 2. I uphold the university’s decision to withhold the remaining information at issue in the records.
3. 3. In order to verify compliance with order provision 1, I reserve the right to require the university to provide me with a copy of the records provided to the appellant.

Original signed by: Diane Smith Adjudicator

August 3, 2012

---

¹ See Final Order PO-3009-F regarding a discussion of the criteria for determining whether records held by Association of Professors of the University of Ottawa (APUO) members are in the university’s custody or control.

² The responsive records that are not records sent or received by the two named professors were adjudicated upon in Interim Order PO-3026-I.

³ Order PO-1880, upheld on judicial review in Ontario (Attorney General) v. Pascoe, [2002] O.J. No. 4300 (C.A.).

⁴ [2001] O.J. 749.

⁵ Order PO-2967.

⁶ Orders PO-1756, PO-1767, PO-2916, PO-2967.