Information and Privacy Commissioner, Ontario, Canada

Commissaire à l’information et à la protection de la vie privée, Ontario, Canada

ORDER MO-2895

Appeal MA12-221

City of Toronto

June 10, 2013

Summary: The requester sought access to a log containing the maintenance requests for the city’s fire services’ Computer-Aided Dispatch (CAD) system. The city decided to grant access to the record in full. The company that provided the CAD system to the city appealed this decision, claiming the application of the mandatory third party information exemption in section 10(1)(a). This order determines that section 10(1)(a) applies to portions of the record.

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. M.56 , as amended, section 10(1)(a).

Orders and Investigation Reports Considered: Order MO-2786.

BACKGROUND:

[1] The City of Toronto (the city) received a request under the Municipal Freedom of Information and Protection of Privacy Act  (MFIPPA  or the Act ) for access to the following:

1. 1. [named company], Maintenance Service Agreement [number]
2. 2. [named company], Master Services Agreement [number]
3. 3. Printout of WBS# [number] current to 13 Feb 2012
4. 4. RFP or RFQ or other documents that define the deliverables required from [named company] for [named project]
5. 5. Summary or similar analysis of CAD Discrepancy Reports for the years 2009, 2010, 2011
6. 6. Summary or similar analysis of CAD maintenance requests to [named company] for the years 2009, 2010, 2011
7. 7. Current list of report titles generated by the [named company] BI System
8. 8. Documentation illustrating the Additional training, and the development and revision of standard operating guidelines to reduce turnout times described on page 78 of the Toronto 2007 Performance Measurement & Benchmarking Report.

[2] The city issued an access decision regarding parts 3, 5, 7 and 8 of the request. For part 5, the city advised that a responsive record does not exist. For parts 3, 7 and 8, access was granted in full and the records were provided to the requester.

[3] For parts 1, 2, 4, and 6, the city advised that disclosure of the records may affect the interests of a third party (the affected party), which has a contract with the city to provide the software and maintenance services for the Computer-Aided Dispatch (CAD) system.

[4] Accordingly, the city provided the affected party with an opportunity to make representations concerning the disclosure of the requested records pursuant to section 21  of the Act . The affected party made written representations against the disclosure of the requested records.

[5] The city then issued a final access decision regarding parts 1, 2, 4 and 6 of the request. Access was denied to parts 1, 2 and 4 of the request pursuant to the mandatory third party information exemption in section 10(1)  of the Act . Access was granted to part 6 of the request in full. The city notified the affected party of its decision and of its right to appeal the decision to the IPC.

[6] The affected party appealed the city’s decision to grant access to the single record relating to part 6 of the request.

[7] The requester advised the mediator that he remains interested in pursuing access to the record relating to part 6 of the request. Part 6 of the request relates to the maintenance logs for the city’s fire services’ CAD system.

[8] The affected party is opposed to the disclosure of this record as it believes this information qualifies for exemption under section 10(1)(a) of the Act and should be withheld. As mediation did not resolve the issues in this appeal, the file was transferred to the adjudication stage where an adjudicator conducts an inquiry. Representations were sought from all the parties and were exchanged in accordance with section 7 of the IPC’s Code of Procedure and Practice Direction 7.

[9] In this order, I find that portions of the record are exempt by reason of section 10(1) (a) of the Act .

RECORD:

[10] The record is a log containing maintenance requests for the city’s fire services’ CAD system for the years 2009, 2010 and 2011.

DISCUSSION:

Does the mandatory exemption at section 10(1)(a) apply to the record?

[11] Section 10(1)(a) states:

A head shall refuse to disclose a record that reveals a trade secret or scientific, technical, commercial, financial or labour relations information, supplied in confidence implicitly or explicitly, if the disclosure could reasonably be expected to,

prejudice significantly the competitive position or interfere significantly with the contractual or other negotiations of a person, group of persons, or organization;

[12] Section 10(1) is designed to protect the confidential informational assets of businesses or other organizations that provide information to government institutions.¹ Although one of the central purposes of the Act  is to shed light on the operations of government, section 10(1) serves to limit disclosure of confidential information of third parties that could be exploited by a competitor in the marketplace.²

[13] For section 10(1) to apply, the institution and/or the third party must satisfy each part of the following three-part test:

1. 1. the record must reveal information that is a trade secret or scientific, technical, commercial, financial or labour relations information; and
2. 2. the information must have been supplied to the institution in confidence, either implicitly or explicitly; and
3. 3. the prospect of disclosure of the record must give rise to a reasonable expectation that one of the harms specified in paragraph (a), (b), (c) and/or (d) of section 10(1) will occur.

Part 1: type of information

[14] The affected party states that it uses the information in the record to determine what problems and enhancements are necessary and/or desirable to the CAD software. As such, the affected party submits that the record contains technical information which describes the operation and/or maintenance of the CAD software maintenance.

[15] The city states that the CAD system is a system that assists emergency call dispatchers in communicating with emergency responders and for the collection of data. It states that:

The affected party is the owner and developer of the CAD system product. The actual CAD system software itself is not at issue in this appeal, nor is the actual software that the city uses to detail certain information on maintenance tasks or performance issues with the CAD software. The record at issue in this appeal is a summary of the maintenance requests, which is created by city staff. Fire Services staff has the ability to export the information they enter and print copies of the summary of the maintenance requests. Although the summary of the maintenance requests record does not contain any detail with respect to the design of the software, specifically its layout, schemes or arrangements, 3 of the 13 fields in the summary contain technical information.

[16] The requester did not address this part of the test in its representations.

[17] In reply, the affected party states that the maintenance requests reveal the functionality of the CAD system software and any alleged errors, discrepancies and defects associated with the functionality. Additionally, the maintenance logs contain requests for certain enhancements of the software, report the number of issues, and list and classify alleged errors based on the criticality of the error.

[18] In sur-reply, the city relies on its original representations. The requester did not provide sur-reply representations.

Analysis/Findings

[19] Both the city and the affected party submit that the record contains technical information. This type of information has been discussed in prior orders as information belonging to an organized field of knowledge that would fall under the general categories of applied sciences or mechanical arts. Examples of these fields include architecture, engineering or electronics. While it is difficult to define technical information in a precise fashion, it will usually involve information prepared by a professional in the field and describe the construction, operation or maintenance of a structure, process, equipment or thing.³

[20] At issue are the summary of the maintenance requests for the city’s fire services CAD system. These requests were written by city staff. This record is a chart that contains 13 fields. I agree with the city that only certain fields contain technical information; specifically, I find that the fields entitled priority, summary and description in the record contain technical information. These three fields contain information about the operation or maintenance of the CAD software.

[21] The remaining 10 fields do not contain technical information as they are merely fields that relate to the timing, source and progress of the request by city staff for maintenance of the CAD software. I also find that these fields do not contain the other types of information described in section 10(1).⁴ As no other exemptions have been claimed for these 10 fields and no other exemptions apply, I will order the information in the 10 fields disclosed.

[22] Therefore, I find that three of the thirteen fields in the record contain technical information. Accordingly, part 1 of the test has been met for these three fields.

Part 2: supplied in confidence

Supplied

[23] The requirement that it be shown that the information was supplied to the institution reflects the purpose in section 10(1) of protecting the informational assets of third parties.⁵

[24] Information may qualify as supplied if it was directly supplied to an institution by a third party, or where its disclosure would reveal or permit the drawing of accurate inferences with respect to information supplied by a third party.⁶

In confidence

[25] In order to satisfy the in confidence component of part two, the parties resisting disclosure must establish that the supplier had a reasonable expectation of confidentiality, implicit or explicit, at the time the information was provided. This expectation must have an objective basis.⁷

[26] In determining whether an expectation of confidentiality is based on reasonable and objective grounds, it is necessary to consider all the circumstances of the case, including whether the information was

• • communicated to the institution on the basis that it was confidential and that it was to be kept confidential
• • treated consistently in a manner that indicates a concern for its protection from disclosure by the affected party prior to being communicated to the government organization
• • not otherwise disclosed or available from sources to which the public has access
• • prepared for a purpose that would not entail disclosure.⁸

[27] The affected party states the maintenance requests reveal the functionality of the CAD system software and any alleged errors, discrepancies, defects associated with the functionality. It states that its End User License Agreement with the city provides that its information is confidential. The affected party states that the maintenance requests could not be replicated without violating the nondisclosure terms of the maintenance agreements that it has with its customers.

[28] The city submits that the technical information in the record is non-negotiated information that belongs to the affected party. The city states that this information would not have been known to it had the information not been supplied to it. The city states that it is bound by the confidentiality and nondisclosure provisions in both the Master Service Agreement and the Maintenance Service Agreement.

[29] The requester questions how the CAD maintenance reports can be confidential when CAD data is public information. It states that:

The CAD data, which is produced by TFS [Toronto Fire Service] personnel using [the affected party’s] software is public information. The CAD maintenance requests are also produced by TFS personnel and may or may not be produced with the [affected party’s] software. The maintenance requests were not produced by [it], they were provided to [the affected party] by TFS. The maintenance requests are a byproduct of TFS use of the software and are analogous to TFS maintenance requests for a fire truck.

[30] In reply, the affected party states that the CAD system uses industry-standard protocols for exchanging CAD incident information to third-party applications and CAD systems to support mutual aid requests, which is not the same as the maintenance records. The affected party states that its maintenance records belong to it and are contained in a licensed management system, which is different than the CAD system and the maintenance requests at issue. The affected party states that there is no CAD data in the maintenance requests and these maintenance requests are not produced by its software. It further states that even if any maintenance requests are provided to the affected party by the TFS, the TFS is under the contractual and implied obligation of confidentiality.

Analysis/Findings

[31] I found above that three columns in the record contain technical information and meet part 1 of the test under section 10(1). These columns can be identified as follows:

[TITLE NOT FOUND]

COLUMN #	TITLE
10	Priority
12	Summary
13	Description

[32] All of the columns contain information written into the record by city staff. None of the parties provided representations on the specific information in each column of the record.

[33] I find that column 10, which lists the priority of the maintenance request, does not contain information supplied by the affected party to the city. Instead, it contains the city’s interpretation of the priority of the maintenance request. I find that the information in column 10 was not supplied by the affected party, nor would its disclosure reveal or permit the drawing of accurate inferences with respect to information supplied by the affected party. Therefore, part 2 of the test has not been met for column 10 and I will order the information in this column disclosed.

[34] I find that much of the information in columns 12 and 13 was also not supplied by the affected party to the city. This information includes information as to who reported the problem with the CAD system, their contact information, how a city staffer interpreted the problem, and information about other institutions.

[35] I find that the remaining information in columns 12 and 13 contains information supplied in confidence as it contains information about the operation of the affected party’s software. Disclosure of this information would reveal information supplied in confidence by the affected party to the city. This information is not CAD data that may be publicly available as submitted by the requester, but instead describes the operation of the affected party’s software. Accordingly, I find that part 2 of the test has been met for this information in columns 12 and 13. I will now consider whether part 3 of the test has been met for this information.

Part 3: harms

[36] To meet this part of the test, the institution and/or the third party must provide detailed and convincing evidence to establish a reasonable expectation of harm. Evidence amounting to speculation of possible harm is not sufficient.⁹

[37] The failure of a party resisting disclosure to provide detailed and convincing evidence will not necessarily defeat the claim for exemption where harm can be inferred from other circumstances. However, only in exceptional circumstances would such a determination be made on the basis of anything other than the records at issue and the evidence provided by a party in discharging its onus.¹⁰

[38] The need for public accountability in the expenditure of public funds is an important reason behind the need for detailed and convincing evidence to support the harms outlined in section 10(1).¹¹

[39] Parties should not assume that harms under section 10(1) are self-evident or can be substantiated by submissions that repeat the words of the Act .¹²

[40] The affected party states that the CAD system market is highly competitive and it has gained market share through providing cutting edge technological solutions, substantial monetary investment, years of experience in the public safety industry, and the innovation of its engineering team. It states that the maintenance requests help the CAD software developers generate the software code for upgrades and updates of the CAD software.

[41] The affected party states that disclosure of known or alleged defects in the CAD system to the public would result in substantial competitive harm to it by giving its competitors access to such information. It states that:

Because [the affected party] derives a significant part of its revenue from licensing the CAD system to customers who would not otherwise have access to such software, making this proprietary information available to [its] competitors would substantially harm [its] revenue and competitive position in the market…

Additionally, the nature of the technical information contained in the maintenance requests, and the detailed blueprint it provides of [the affected party’s] software development process, means a competitor for this or similar projects would be able to utilize the information in the maintenance requests in creating similar software without having incurred the costs to create the work plan. [The affected party] would be deprived of the value of its know-how if a competitor could access this information at no cost to itself and exploit for its own commercial purposes in competing with [it].

Finally, public disclosure of [the affected party’s] confidential technical information could harm its ability to demonstrate its product to future customers. If interpreted incorrectly, potential future customers may choose not to license [its] CAD software based on problems stated in maintenance requests without giving [the affected party] to provide any rebuttal as to whether they have been corrected. Such a situation would place [it] at a disadvantage in the global marketplace. Additionally, because the CAD software is in use by various cities, police forces, fire departments, and the like, showcasing the weaknesses and vulnerabilities in [the] CAD software would likely put such cities and their citizens at risk of a potential security breach.

[42] The city states that:

[It] is not looking to release information about the software code of the CAD system. The fact that the maintenance requests may contribute to the ability of developers to generate software upgrades is not relevant here. Ability is not third party information.

The technical information contained in the 3 fields on the maintenance summary is not detailed enough to infer any significant detail, layout or structure of the CAD system itself. Further the maintenance request summary does not contain any information from the proprietor about how the maintenance request was resolved.

Disclosing this summary information would not disclose other previously supplied third party information, such as proprietary screen and record layout and description of the fields in the record layout (i.e., the code sheet).

It is the city’s position that the representations of the affected party focus primarily on harm associated with disclosure of details involving the database design, structure and the entire database system.

The city submits that it is possible to disclose the summary of maintenance requests without impacting competitive interests that could very well be relevant considerations in the context of a broader disclosure of information, i.e., the database itself. It is the city’s position that disclosure of the summary of maintenance requests would not give competitors access to the internal design, format and logic of the CAD system, therefore no ability to reverse engineer key components of the CAD system or make changes or add-ons to the database, as purported by the affected party.

The request does not relate to the software itself, the screen layouts, reports generated from the database, etc., and, in the city’s view, providing the requester with a maintenance summary could not reasonably be expected to impact these proprietary or competitive interests.

[43] The requester submits that the Windows operating system has been in use for 20 years and that maintenance requests have been a regular and public fact of life for this ubiquitous software. It states that even with the public’s access to the Windows operating system and the publicity of its numerous bugs, no one has successfully reverse engineered the Windows operating system.

[44] The requester also states that the affected party publicly describes the enhancements that it makes to its software on its website and in videos. The requester also refers to the public document ITS Quality Assurance Review which describes time stamps which are proprietary to the affected party’s CAD system and includes an example of a further CAD proprietary data presentation.¹³

[45] In reply, the affected party states that it has made no reverse engineering argument, reference, or claim in the present appeal, which has to do with maintenance requests. As such, the reference to Windows is completely irrelevant.

[46] The affected party states that the enhancements of its software are released only after extensive research, analysis, marketing, and tests have been performed for duplication and verification purposes. It states that the requester’s references to time stamps and sole sourcing award are completely off topic. It states that its sole source award of the Business Intelligence solution is for a completely separate and different system than the CAD system at issue.

Analysis/Findings

[47] Based on my careful review of the record, I find that disclosure of only a very limited amount of information could reasonably be expected to cause the harms set out in section 10(1)(a). This information is contained in column 13 and consists of specific confidential descriptions of certain CAD system software information.

[48] I agree with the affected party that public disclosure of this specific confidential technical information could harm its ability to demonstrate its product to future customers. If this highly technical information is interpreted incorrectly, potential future customers may choose not to license its CAD system software based on problems stated in maintenance requests without giving the affected party an opportunity to provide any rebuttal as to whether they have been corrected. Such a situation would place the affected party at a competitive disadvantage.

[49] I agree with the affected party that disclosure of this highly technical information could allow a competitor of CAD system software to utilize the information in the maintenance requests in creating similar software. The affected party would be deprived of the value of this information if a competitor could access this information at no cost to itself and exploit for its own commercial use.

[50] In making my finding, I have relied on the findings of Senior Adjudicator Sherry Liang in Order MO-2786. In that order, the information at issue revealed details of an affected party’s software proposal in a non-winning bid made to the City of Sarnia. Senior Adjudicator Liang considered the application of section 10(1)(a) to certain specific detailed software information. She states that:

…I find that disclosure of parts of the record could reasonably be expected to result in significant prejudice to the competitive position of the appellant. I accept the appellant’s assertion that it markets its products exclusively to municipalities and that, within this market, there is a limited number of competitors. The appellant has identified the bases on which these competitors distinguish themselves in RFP processes, including the detailed pricing structure and detailed explanations of how the functional requirements will be met.

Section 3 of the proposal contains the detailed information about how the appellant’s software handles the functional requirements of the RFP, including examples of screen shots. While the appellant’s website also includes sample screenshots, they appear to be visual representations of some of the different pages generated by some of its software, but with details obscured. I accept that disclosure of the detailed screen shots found on pages 7, 9 to 16 and 18 to 24 in Section 3 Software Implementation, text on pages 10 and 11, and the information on pages 24 and 25 starting with the first complete paragraph on page 24 could reasonably be expected to prejudice significantly the competitive position of the appellant in future RFP processes, for the reasons described above.

[51] In this appeal, I find that disclosure of some of the information in column 13 of the record could reasonably be expected to prejudice significantly the competitive position of the affected party under section 10(1) (a) of the Act . This information contains specific details about how the affected party’s software handles the functional requirements of the CAD system.

[52] Nevertheless, I do not agree with the affected party that the remaining information, which consists of general information about CAD system maintenance requests could reasonably be expected to result in potential future customers choosing not to license its CAD software. Nor do I find from a review of this information that it would likely put the public at risk of a potential security breach as claimed by the affected party. Although the affected party made this claim in its representations, it did not provide specific representations as to which information could likely result in a potential security breach.

[53] I agree with the city that disclosure of the remaining technical information in the record does not give rise to the harms set out in section 10(1)(a). This technical information is contained in the column 12 and portions of column 13. I find that this information is not detailed enough to infer any significant detail, layout or structure of the CAD system itself. I agree with the city that disclosing this summary information would not disclose other previously supplied third party information, such as proprietary screen and record layout and description of the fields in the record layout (i.e., the code sheet).

[54] The information that I have found to be exempt under section 10(1)(a) would not give the affected party’s competitors access to the internal design, format and logic of the CAD system.

[55] I agree with the requester that maintenance requests of software operating problems are regularly made of software developers and this information may be publicly available. However, I find that the information that I have found to be exempt under section 10(1)(a) is not general maintenance request information, but is information not otherwise available publicly, which provides a detailed blueprint of the affected party’s software development process. I find that disclosure of this specific technical information, which is unique to the affected party’s CAD system software, could reasonably be expected to result in the harms set out in section 10(1) (a) of the Act .

Conclusion

[56] In conclusion, I find that the mandatory third party information exemption in section 10(1) (a) of the Act  only applies to some of the information in column 13 of the record. As no other exemptions apply to the remaining information in the record, I will order this remaining information disclosed.

ORDER:

1. 1. I uphold the city’s decision that certain information in column 13 of the record is exempt under section 10(1) (a) of the Act . For ease of reference, I have provided the city with a copy of the record highlighting the information that I have found exempt.
2. 2. I order the city to disclose the remaining information in the record to the requester by July 16, 2013 but not before July 11, 2013.
3. 3. In order to verify compliance with this order, I reserve the right to require the city to provide me with a copy of the information disclosed to the requester upon my request.

Original signed by: Diane Smith Adjudicator

June 10, 2013

---

¹ Boeing Co. v. Ontario (Ministry of Economic Development and Trade), [2005] O.J. No. 2851 (Div. Ct.)], leave to appeal dismissed, Doc. M32858 (C.A.).

² Orders PO-1805, PO-2018, PO-2184 and MO-1706.

³ Order PO-2010.

⁴ Trade secret, scientific, commercial, financial and labour relations information.

⁵ Order MO-1706.

⁶ Orders PO-2020 and PO-2043.

⁷ Order PO-2020.

⁸ Orders PO-2043, PO-2371 and PO-2497.

⁹ Ontario (Workers’ Compensation Board) v. Ontario (Assistant Information and Privacy Commissioner) (1998), 41 O.R. (3d) 464 (C.A.).

¹⁰ Order PO-2020.

¹¹ Order PO-2435.

¹² Order PO-2435.

¹³ Order MO-2660.