Information and Privacy Commissioner, Ontario, Canada

Commissaire à l’information et à la protection de la vie privée, Ontario, Canada

ORDER PO-3195

Appeal PA12-6

University of Ottawa

April 30, 2013

Summary: The requester sought access to the personal email addresses of people invited to a reception. He also sought an affidavit certifying who created the list of those invited to the reception and the date and the purpose of the list’s creation. This order upholds the university’s decision to not disclose personal email addresses and declines to order the university to provide the requested affidavit.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, sections 2(1) (definition of personal information and record), 21(1).

Orders and Investigation Reports Considered: Order PO-3172.

OVERVIEW:

[1] The University of Ottawa (the university) received a request pursuant to the Freedom of Information and Protection of Privacy Act  (FIPPA  or the Act ) as follows:

[The university president’s] email invitation to an informal reception at his residence, sent from the Office of the President on August 29, 2011…

The requested record will include the list of recipients of this email; that is, including the list of invitees to the September 12 reception…

I request the original record that will contain all the recipients of the email (To, Cc, and Bcc)…

[2] The university located the responsive record and issued a decision denying access pursuant to section 21(1) (personal privacy) of the Act .

[3] The requester, now the appellant, appealed the university’s decision.

[4] During mediation, the university provided information to the mediator regarding its access decision. The university advised that upon receipt of the request, it conducted a search in the Office of the President, as well as the Office of Ceremonies and Events, but at the time of issuing its decision, it had not actually located the email invitation. The university advised the mediator that it had issued an access decision claiming the application of section 21(1), as it considered the information requested related to a personal gathering, and that it anticipated locating the email invitation shortly.

[5] The university further indicated that it located a list relating to the reception and that this list consisted of a list of names, but no email addresses. The university indicated that although this list related to the reception, it was not known whether it was a list of the invitees or some other list such as a list of the actual attendees.

[6] Also, during the mediation stage of the appeal, the university searched again for the email invitation and ultimately located it in the Office of the President. Page 1 of the email consists of the invitation; email recipients do not appear on page 1. Page 2 consists of the email addresses of the individuals that configured in the bcc field of the email. The university’s decision was to release page 1, with the exception of the reception address, and to deny access to page 2, in full.

[7] Following receipt of the university’s revised decision, the appellant advised the mediator that he objected to the section 21(1) claim and indicated that at the Senate meeting, the university’s president had referred to the reception as an official work function and also that board members and potential donors would be invited to the reception.

[8] The parties were unable to resolve this matter through the process of mediation. The file was transferred to adjudication where an adjudicator conducts an inquiry. During the inquiry stage of adjudication, the university disclosed the list of names, which it advised was a list of invitees to the reception. It also disclosed the email, except for 11 of the email addresses of individuals that configured in the bcc field of the email. I sought and received representations from the university and appellant.

[9] I then asked the university for representations on certain of the email addresses at issue that appeared to be business email addresses. The university responded and agreed that three additional email addresses were business email addresses and sent the appellant a supplementary decision letter disclosing these three email addresses.

[10] In his representations, the appellant seeks access to the remaining eight email addresses in the invitation and also asks that the university provide an affidavit certifying who created the list of invitees and the date and the purpose that it was created.

[11] In this order, I uphold the university’s decision to not disclose personal email addresses. I also do not order the university to issue an affidavit certifying who created the list of invitees and the date and the purpose that it was created.

RECORD:

[12] At issue are eight email addresses listed on page 2 of the August 29, 2011 email from the university’s Office of the President. The university has claimed that the mandatory personal privacy exemption in section 21(1) applies to these email addresses.

PRELIMINARY ISSUE

Is the University required to provide the appellant with a certified copy of the list?

[13] As stated above, during the adjudication stage of the appeal, the university issued a supplementary decision letter to the appellant disclosing the list of invitees (the list). Concerning the list, in its decision letter it states that:

…the University has agreed to provide you with the list of invitees to the event mentioned in your request.

Full access is granted to the list of invitees…

[14] The appellant seeks to have the list of invitees certified by the university. He states that:

The University’s Aug. 20, 2012 supplementary decision letter included a printout of a list, which consists of a table with the title Reception in Celebration of the New Academic Year 2011 and a list of entries under the headings Given name and Surname.

Affidavit certification of the list given to me is necessary because, as it stands, the list is an undated, unsigned document, the purpose of which is unspecified. Without identification and affidavit certification of who created the list, when it was created, and for what purpose it was created, the list does not satisfy my request for the list of invitees to the Sept. 12, 2011 event.

Furthermore, it has been established in the IPC’s Revised mediator’s report that there is uncertainty as to whether the list is a list of names of invitees, actual event attendees, or something else…

There is an important distinction between a list of invitees to an event and a list of people who in fact attended an event. A certified statement in the form of an affidavit is required, containing affirmation of: who created of the list, what date the list was created, and for what purpose it was created. The said affidavit is required in order to establish the authenticity of the list as a document containing the names of all persons invited to the Sept. 12, 2011 reception.

Analysis/Findings

[15] The situation in this appeal is similar to that in Order PO-3172 where the appellant in that appeal sought official certified true copies of the records that are stamped and signed as true copies. In that order, Adjudicator Stella Ball stated that:

The appellant raises concerns about the authenticity of the records in this appeal and asks that the university be required to provide certified copies of the records. I have reviewed the representations of the appellant on this issue, and I do not see any basis for his concern about the authenticity of the records. I also note that the appellant has provided no statutory or legal basis to support his argument that the university must provide certified copies of the records to him.

The term record is defined in section 2(1)  of the Act  as any record of information however recorded. There is no reference in the definition of record in section 2(1) to a certified or official copy. There is also no requirement in the Act  for an institution to provide a certified copy of a record that is responsive to a request.

In asking that the university be required to provide certified copies of the records, the appellant is, in essence, asking the university to create records that do not exist. The university, however, has identified existing records that are responsive to the request. Previous orders of this office have established that an institution is not required to create a record in response to an access request if one does not exist.¹ In accordance with these previous orders, and taking into account the fact that the university has located existing responsive records, I find that the university is not required to create certified copies of the records in this appeal.

[16] I agree with and adopt the analysis of Adjudicator Ball in Order PO-3172. The list in this appeal was identified by the university in its supplementary decision letter as a list of invitees. The university is not required to create an affidavit for this record for the appellant. To do so would be to create a record. Accordingly, I am not ordering the university to create an affidavit certifying who created the list of invitees and the date and the purpose that it was created.

ISSUES:

1. A. Does the record contain personal information as defined in section 2(1) and, if so, to whom does it relate?
2. B. Does the mandatory personal privacy exemption at section 21 apply to the information at issue?

DISCUSSION:

A. Does the record contain personal information as defined in section 2(1) and, if so, to whom does it relate?

[17] In order to determine which sections of the Act  may apply, it is necessary to decide whether the record contains personal information and, if so, to whom it relates. That term is defined in section 2(1) as follows:

personal information means recorded information about an identifiable individual, including,

(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

(c) any identifying number, symbol or other particular assigned to the individual,

(d) the address, telephone number, fingerprints or blood type of the individual,

(e) the personal opinions or views of the individual except if they relate to another individual,

(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

(g) the views or opinions of another individual about the individual, and

(h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

[18] The list of examples of personal information under section 2(1) is not exhaustive. Therefore, information that does not fall under paragraphs (a) to (h) may still qualify as personal information [Order 11].

[19] Sections 2(3) and (4) also relate to the definition of personal information. These sections state:

(3) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

(4) For greater certainty, subsection (3) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling.

[20] To qualify as personal information, the information must be about the individual in a personal capacity. As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be about the individual.²

[21] Even if information relates to an individual in a professional, official or business capacity, it may still qualify as personal information if the information reveals something of a personal nature about the individual.³

[22] To qualify as personal information, it must be reasonable to expect that an individual may be identified if the information is disclosed.⁴

[23] The university submits that the severed email addresses in the blind copy (bcc) list are personal email addresses of individuals that have not been made public.

[24] The appellant did not provide representations on this issue.

Analysis/Findings

[25] All that remains at issue in this appeal are eight personal email addresses. None of these email addresses are that of the appellant. Previous orders of this office determined that personal email addresses are the personal information of the individuals who are identified therein.⁵ In this appeal, I find that these are personal email addresses of individuals not acting in a professional, official or business capacity.

[26] I will now consider the application of the mandatory personal privacy exemption to the eight personal email addresses.

B. Does the mandatory personal privacy exemption at section 21 apply to the information at issue?

[27] Where a requester seeks personal information of another individual, section 21 prohibits an institution from releasing this information unless one of the exceptions in paragraphs (a) to (f) of section 21(1) applies.

[28] If the information fits within any of paragraphs (a) to (f) of section 21(1), it is not exempt from disclosure under section 21. In this appeal, the university submits that the records partially disclosed pursuant to section 21  of the Act  contain personal information of other individuals, which does not fall within one of the exceptions at section 21(1) and that the mandatory exemption at section 21 applies to the information at issue. The appellant did not provide representations on the application of section 21(1) to the information at issue.

[29] In this appeal, I find that none of the exceptions in section 21(1)(a) to (e) apply. I will now consider whether the exception in section 21(1)(f) applies. This exception is more complex and requires a consideration of additional parts of section 21. Section 21(1)(f) reads:

A head shall refuse to disclose personal information to any person other than the individual to whom the information relates except,

if the disclosure does not constitute an unjustified invasion of personal privacy.

[30] The factors and presumptions in sections 21(2), (3) and (4) help in determining whether disclosure would or would not be an unjustified invasion of privacy under section 21(1)(f). If any of paragraphs (a) to (d) of section 21(4) apply, disclosure is not an unjustified invasion of personal privacy and the information is not exempt under section 21(1). Section 21(4) does not apply in this appeal.

[31] If any of paragraphs (a) to (h) of section 21(3) apply, disclosure of the information is presumed to be an unjustified invasion of personal privacy under section 21. Section 21(3) does not apply in this appeal.

[32] If no section 21(3) presumption applies, section 21(2) lists various factors that may be relevant in determining whether disclosure of personal information would constitute an unjustified invasion of personal privacy.⁶ The list of factors under section 21(2) is not exhaustive. The institution must also consider any circumstances that are relevant, even if they are not listed under section 21(2).⁷

[33] In order to find that disclosure does not constitute an unjustified invasion of personal privacy, one or more factors and/or circumstances favouring disclosure in section 21(2) must be present. In this appeal, none of the factors and/or circumstances favouring disclosure apply. In the absence of a finding that one or more factors and/or circumstances favouring disclosure apply, the exception in section 21(1)(f) is not established and the mandatory section 21(1) exemption applies.⁸ Accordingly, I find that the information at issue in the record is exempt under the mandatory personal privacy exemption in section 21(1) and ought not to be disclosed.

ORDER:

I uphold the university’s decision and dismiss the appeal.

Original signed by: Diane Smith Adjudicator

April 30 , 2013

---

¹ Orders P-50, MO-1422 and PO-2237.

² Orders P-257, P-427, P-1412, P-1621, R-980015, MO-1550-F and PO-2225.

³ Orders P-1409, R-980015, PO-2225 and MO-2344.

⁴ Order PO-1880, upheld on judicial review in Ontario (Attorney General) v. Pascoe, [2002] O.J. No. 4300 (C.A.).

⁵ Orders MO-2847 and PO-3119.

⁶ Order P-239

⁷ Order P-99.

⁸ Orders PO-2267 and PO-2733.