Information and Privacy Commissioner, Ontario, Canada

Commissaire à l’information et à la protection de la vie privée, Ontario, Canada

ORDER PO-3377

Appeal PA12-490

Ryerson University

August 14, 2014

Summary: The appellant made a request to the university for records relating to a specified Request for Proposal. The university granted partial access to the records, and denied access to certain portions of the successful proposal on the basis of the mandatory exemptions in sections 17(1) (third party information) and 21(1) (personal privacy).

This order determines that some information qualifies for exemption under section 21(1). It also finds that while the exemption in section 17(1)(a) applies to portions of the withheld record, one withheld page does not qualify for exemption under section 17(1).

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, sections 17(1)(a) and 21.

OVERVIEW:

[1] Ryerson University (the university) received a request under the Freedom of Information and Protection of Privacy Act  (the Act ), for information relating to a specified Request for Proposal (RFP). The request was for the winning proposal, and all scorecards, evaluation notes, minutes of meetings, interview notes, etc. pertaining to the decision for the award of this project.

[2] After notifying a number of affected parties as required by section 28  of the Act , the university issued an access decision (and a supplementary access decision) indicating that five responsive records were located, and that full or partial access was granted to four of the records. Portions of these records were withheld on the basis of the exemptions in section 17(1) (third party information) and 21(1) (personal privacy) of the Act . The university also took the position that one of the responsive records was excluded from the scope of the Act  on the basis of the exclusion in section 65(6).

[3] The appellant appealed the university’s decision.

[4] During mediation, the appellant indicated that she was not pursing access to certain portions of the records at issue. Also during mediation, one of the affected parties (the successful bidder) consented to the release of some of the records or portions of records, and the university subsequently released certain additional records or portions of records to the appellant.

[5] As a result of mediation, the only records remaining at issue in this appeal are certain portions of Record #1, which is identified as The winning proposal, including pricing.

[6] Mediation did not resolve the remaining issues, and this file was transferred to the inquiry stage of the process. I sent a Notice of Inquiry to the university and an affected party (the winning proponent), initially, and received representations from both of those parties.

[7] In its representations, the affected party indicated that it consented to the disclosure of certain additional pages of records (pages 160-175, 203, 204, 206 and 207). Accordingly, I will not review the possible application of section 17(1) to these pages. Because it is not clear to me whether or not these pages have been disclosed to the appellant, I will order that they be disclosed.

[8] I then sent the Notice of Inquiry, along with a copy of the complete representations of the university and the affected party, to the appellant. I did not receive any representations from the appellant.

[9] In this order, I find that resumes of identified individuals qualify for exemption under section 21(1) of the Act and that the remaining portions of the records at issue, except page 205, qualify for exemption under section 17(1)  of the Act .

RECORDS:

[10] The records remaining at issue consist of the following portions of Record #1 (the winning proposal):

• - pages 189 to 191, 193 to 201 (resumes),
• - page 205 (similar related projects),
• - pages 227 to 231 (summary and milestones),
• - second half of page 237 (implementation information),
• - pages 239 to 251 (quality assurance plan & examples) and
• - pages 258 to 262 (offer and fee proposals)

ISSUES:

1. A. Does the mandatory exemption at section 21(1) apply to pages 189-191 and 193-201?
2. B. Does the mandatory third party exemption at section 17(1) apply to the remaining withheld portions of the record?

DISCUSSION:

Issue A: Does the mandatory exemption at section 21(1) apply to pages 189-191 and 193-201?

[11] The university and the affected party take the position that the resumes of the affected party’s employees, contained on pages 189-191 and 193 to 201, qualify as the personal information of these individuals, and are exempt from disclosure under section 21(1)  of the Act . The appellant does not address this issue.

[12] In order to determine whether the personal privacy exemption at section 21(1) applies, it is first necessary to decide whether the record contains personal information and, if so, to whom it relates. That term is defined in section 2(1) as follows:

personal information means recorded information about an identifiable individual, including,

(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

(c) any identifying number, symbol or other particular assigned to the individual,

(d) the address, telephone number, fingerprints or blood type of the individual,

(e) the personal opinions or views of the individual except if they relate to another individual,

(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

(g) the views or opinions of another individual about the individual, and

(h) the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

[13] The list of examples of personal information under section 2(1) is not exhaustive. Therefore, information that does not fall under paragraphs (a) to (h) may still qualify as personal information.

[14] Sections 2(2.1) and (2.2) also relate to the definition of personal information. These sections state:

(2.1) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

(2.2) For greater certainty, subsection (3) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling.

[15] To qualify as personal information, the information must be about the individual in a personal capacity. As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be about the individual. Even if information relates to an individual in a professional, official or business capacity, it may still qualify as personal information if the information reveals something of a personal nature about the individual.

[16] The university submits that the information in the resumes qualifies as personal information under paragraph (b) of the definition in section 2(1) as it includes recorded information about the education or employment history of these individuals. On my review of these records, I confirm that they contain information that falls within paragraph (b) of the definition of personal information. Previous orders have confirmed that information found in the resumes of individuals is personal information, as defined in section 2(1).¹

[17] I note that in this appeal, the appellant confirmed that she is not pursuing access to any individuals’ names or contact information, and that this information could be severed from the record. However, information may qualify as personal information if it is reasonable to expect that an individual may be identified if the information is disclosed. In the circumstances of this appeal, given the specific nature of the information contained in the resumes, I find that disclosure of these resumes, even if the names of the individuals were to be withheld, would still qualify as personal information as it is reasonable to expect that these individuals could be identified if the information is disclosed.

[18] Where a requester seeks the personal information of another individual, section 21(1)  of the Act  prohibits an institution from releasing this information unless one of the exceptions in paragraphs (a) through (f) of section 21(1) applies. The only exception with potential application in the circumstances of this appeal is section 21(1)(f) which reads:

A head shall refuse to disclose personal information to any person other than the individual to whom the information relates except,

if the disclosure does not constitute an unjustified invasion of personal privacy.

[19] In order for the section 21(1)(f) exception to the mandatory exemption in section 21(1) to apply, it must be established that disclosure would not be an unjustified invasion of personal privacy. Sections 21(2) , (3)  and (4)  of the Act  provide guidance in determining whether disclosure of personal information would result in an unjustified invasion of personal privacy. Section 21(2) provides some criteria for the institution to consider in making this determination; section 21(3) lists the types of information the disclosure of which is presumed to constitute an unjustified invasion of personal privacy; section 21(4) refers to certain types of information whose disclosure does not constitute an unjustified invasion of personal privacy.

[20] Where the record contains the personal information of an individual other than the appellant, the only way that such a record can be disclosed is if I find that disclosure would not constitute an unjustified invasion of personal privacy of that individual. The appellant has not provided representations in support of the position that any factors favouring disclosure of the portions of the records at issue apply. Accordingly, in the absence of factors favouring disclosure, I find that disclosure of the resumes, which contain the personal information of identifiable individuals, would constitute an unjustified invasion of the personal privacy of those individuals.

[21] As a result, I find that section 21(1) applies to pages 189-191 and 193-201.

Issue B: Does the mandatory third party exemption at section 17(1) apply to the remaining withheld portions of the record?

[22] The university and the affected party take the position that the remaining withheld portions of the record (pages 205, 227 to 231, 239 to 251, 258 to 262, and the bottom of page 237) qualify for exemption under section 17(1).

[23] Section 17(1) states in part:

A head shall refuse to disclose a record that reveals a trade secret or scientific, technical, commercial, financial or labour relations information, supplied in confidence implicitly or explicitly, where the disclosure could reasonably be expected to,

(a) prejudice significantly the competitive position or interfere significantly with the contractual or other negotiations of a person, group of persons, or organization;

(b) result in similar information no longer being supplied to the institution where it is in the public interest that similar information continue to be so supplied;

(c) result in undue loss or gain to any person, group, committee or financial institution or agency;

[24] Section 17(1) is designed to protect the confidential informational assets of businesses or other organizations that provide information to government institutions.² Although one of the central purposes of the Act  is to shed light on the operations of government, section 17(1) serves to limit disclosure of confidential information of third parties that could be exploited by a competitor in the marketplace.³

[25] For section 17(1) to apply, the institution and/or the third party must satisfy each part of the following three-part test:

1. 1. the record must reveal information that is a trade secret or scientific, technical, commercial, financial or labour relations information; and
2. 2. the information must have been supplied to the institution in confidence, either implicitly or explicitly; and
3. 3. the prospect of disclosure of the record must give rise to a reasonable expectation that one of the harms specified in paragraph (a), (b), (c) and/or (d) of section 17(1) will occur.

Part 1: type of information

[26] The university takes the position that the withheld portions of the record contain commercial and financial information. It states that they contain information relating to the business or the proposed business activities, plans and strategies of the affected party related to the provision of the project services, and that this is properly characterized as commercial information for the purposes of section 17  of the Act . The university refers to Order P-1629 in support of this position. It also states that information about past and related projects constitute commercial information, and refers to a number of orders in support.⁴

[27] The appellant did not provide representations on this issue.

Findings

[28] Commercial information has been defined in prior orders as follows:

Commercial information is information that relates solely to the buying, selling or exchange of merchandise or services. This term can apply to both profit-making enterprises and non-profit organizations, and has equal application to both large and small enterprises.⁵ The fact that a record might have monetary value or potential monetary value does not necessarily mean that the record itself contains commercial information.⁶

[29] The record is the affected party’s proposal in response to an RFP for construction management services for an identified building. Based on my review of the withheld portions of the record, I find that they reveal commercial information about the selling of the affected party’s services to the ministry. As I have found that the record reveals commercial information, part 1 of the test under section 17(1) has been met.

Part 2: supplied in confidence

[30] The requirement that it be shown that the information was supplied to the institution reflects the purpose in section 17(1) of protecting the informational assets of third parties.⁷

[31] Information may qualify as supplied if it was directly supplied to an institution by a third party, or where its disclosure would reveal or permit the drawing of accurate inferences with respect to information supplied by a third party.⁸

[32] The contents of a contract involving an institution and a third party will not normally qualify as having been supplied for the purpose of section 17(1). The provisions of a contract, in general, have been treated as mutually generated, rather than supplied by the third party, even where the contract is preceded by little or no negotiation or where the final agreement reflects information that originated from a single party.⁹

[33] In order to satisfy the in confidence component of part two, the party resisting disclosure must establish that the supplier had a reasonable expectation of confidentiality, implicit or explicit, at the time the information was provided. This expectation must have an objective basis.¹⁰

[34] In determining whether an expectation of confidentiality is based on reasonable and objective grounds, it is necessary to consider all the circumstances of the case, including whether the information was:

• • communicated to the institution on the basis that it was confidential and that it was to be kept confidential;
• • treated consistently in a manner that indicates a concern for its protection from disclosure by the affected person prior to being communicated to the government organization;
• • not otherwise disclosed or available from sources to which the public has access; and
• • prepared for a purpose that would not entail disclosure.¹¹

[35] The university takes the position that the proposal at issue in this appeal was supplied to it by the affected party in confidence. With respect to whether the RFP was "supplied, it states:

The Confidential Records were supplied by the third party in a non-negotiated context, namely an RFP. …

The Confidential Records were supplied by the third party to the University in response to an RFP. The Confidential Records were sent directly from the third party to the University.

The University states on its RFP template that Proposals must be physically received in a sealed package …. The sealed package requirement indicates efforts to ensure that the information in the proposal has not been altered by any other party.

The University notes that the Appellant requested the University’s copy of the third party’s proposal, not the University’s contract with the third party. … The IPC has found in previous orders that a third party’s proposal or tender information submitted in response to an RFP to be supplied for the purpose of section 17(1)  of the Act .¹²

[36] Regarding whether the RFP was supplied in confidence, the university states that the record was supplied with a reasonable expectation of confidentiality, with such expectation being both explicit and implicit. It states:

It is normal commercial practice to treat competitive proposals as proprietary and confidential and the third party communicated its proposal, including the [withheld records], to the University on the basis that it was confidential and would be kept confidential. The University has an established process for securing the proposals throughout the information lifecycle, and limiting and controlling access to the proposals. The proposals are not publicly accessible. They are stored in secure locations. The communication of the proposal, including the Confidential Records, to the University was part of a commercial process where confidentiality is implicit.

In addition, the confidentiality of proposals communicated to the University is also explicit.

[37] The university then refers to the confidentiality assurances on its procurement web page, as well as the references to the confidentiality of the records in the university’s template for responses to RFPs.

[38] The appellant did not provide representations on this issue.

Analysis and findings

[39] Based on the representations of the university, I am satisfied that the record at issue, the affected party’s RFP submission, was supplied to the university within the meaning of section 17(1). This finding is consistent with many previous orders of this office that have considered the application of section 17(1) or its municipal equivalent to RFP proposals.¹³ As this office stated, in Order MO-1706, in discussing a winning proposal:

…it is clear that the information contained in the Proposal was supplied by the affected party to the Board in response to the Board’s solicitation of proposals from the affected party and a competitor for the delivery of vending services. This information was not the product of any negotiation and remains in the form originally provided by the affected party to the Board. This finding is consistent with previous decisions of this office involving information delivered in a proposal by a third party to an institution….

[40] In the appeal before me, the appellant seeks access to the winning proposal, which is the record at issue.¹⁴ In these circumstances, I am satisfied that that the information in the proposal was supplied to the university by the affected party within the meaning of section 17(1).

[41] I am also satisfied, based on the representations of the university, that the RFP was supplied with a reasonably held expectation of confidentiality, both implicit and explicit.

Part 3: harms

[42] To meet this part of the test, the institution and/or the third party must provide detailed and convincing evidence to establish a reasonable expectation of harm. Evidence amounting to speculation of possible harm is not sufficient.¹⁵

[43] The failure of a party resisting disclosure to provide detailed and convincing evidence will not necessarily defeat the claim for exemption where harm can be inferred from other circumstances. However, only in exceptional circumstances would such a determination be made on the basis of anything other than the records at issue and the evidence provided by a party in discharging its onus.¹⁶

[44] The need for public accountability in the expenditure of public funds is an important reason behind the need for detailed and convincing evidence to support the harms outlined in section 17(1).¹⁷

[45] Parties should not assume that harms under section 17(1) are self-evident or can be substantiated by submissions that repeat the words of the Act .¹⁸

[46] The university takes the position that disclosure of the withheld portions of the record would result in the identified harms to the affected party, specifically, that disclosure would prejudice their competitive position under section 17(1) (a) of the Act . The university refers to the affected party’s statement, made to the university when it objected to disclosure, that:

We do not ever provide this information to our competitors and we do not ever make this information publicly available. To do so would provide insight into how we win projects and would undeniably erode a significant competitive advantage that we have gained through years of experience and our internal expertise.

[47] The university also refers to the competitive climate in the industry which provides the services responsive to the university’s project, and states that providing the appellant with access to detailed information about the affected party’s confidential records would severely affect the competitive position of the third party with respect to any future RFP’s.¹⁹ It then states:

There is a reasonable expectation of harm to the third party’s competitive position should the detailed commercial and financial information at issue, including information about the third party’s clients, pricing, approaches, processes, and methods it proposed for the University’s project, be disclosed to the Appellant. The overall result would be undue loss to both the University and the third party.

[48] In their representations, both the university and the affected party refer to the specific information remaining at issue in the withheld portions of the record, and provide representations on the harms that will flow from disclosure of these portions. I will separately review each of these portions of the record, and the representations of the parties, to determine whether they qualify for exemption under section 17(1).

Similar related projects (page 205)

[49] In its representations, the affected party has consented to the disclosure of most of the withheld records which relate to similar projects. The only remaining record in this category is page 205, which consists of a letter of recommendation from a previous client of the affected party.

[50] The affected party does not provide representations on this record. The university states that release of this type of information would provide information on the strategy and approach of the affected party.

[51] I note that page 205 consists of a letter of recommendation written by a former client of the affected party, and it generally summaries the nature of the work done by the affected party, as well as comments on the manner in which the work was done. On my review of this record, I am not satisfied that its disclosure could reasonably be expected to result in any of the harms set out in sections 17(1)(a), (b) or (c), nor have I been provided with evidence to support such a finding. The information on this page is very general in nature, and I find that it does not qualify for exemption under section 17(1).

Project summary, milestones and the BIM implementation (pages 227 to 231, and the second half of page 237)

[52] The parties state that disclosure of these pages to competitors of the affected party would result in the harms set out in section 17(1)(a) and (c).

[53] Pages 227-231 consist of a formatted chart/timeline setting out the project milestones.

[54] The affected party states that the information on these pages is its third party licensed software scheduling pertaining to the project, and is directly connected to the estimate of costs, which are driven by the dates on this record.

[55] The second half of page 237 is the Building Information Modelling [BIM] implementation. The university states that the BIM implementation records are proprietary records generated through the use of project information and the application of variables, estimates, and economic models developed by the third party. It goes on to states that disclosure would allow competitors familiar with the software to accurately determine the third party’s underlying information. Both parties state that disclosure would result in loss of the competitive position of the affected party and lead to undue gain for a competitor.

[56] On my review of these withheld portions of the record, I am satisfied that they contain specific details that identify information relating to the affected party’s proposed approach to the project, including information about its licensed software templates and formats. I also accept that disclosure of this information to competitors could allow those familiar with the software to accurately determine the third party’s underlying information. In my view, the unique information identified in these portions of the proposal discloses a particular approach to the project taken by the affected party. I conclude that disclosure could reasonably be expected to prejudice significantly the competitive position of the affected party, as it provides specific templates of those types of documents. Accordingly, I am satisfied that these portions of the record qualify for exemption under section 17(1)(a).

Quality assurance plan & examples, and offer of services (pages 239-251 and 258–262)

[57] Both the university and the affected party state that disclosure of these withheld portions of the record would reveal information about the affected party’s business approach and strategy, and would result in prejudice to the affected party’s competitive advantage, and undue loss to it. The affected party confirms that the Quality Assurance forms included on these pages were developed by it. It also states that the offer of services (or estimate) contains detailed information about the proposal, that this estimate of costs is its informational asset and that if this information are disclosed, it could be exploited by competitors.

[58] On my review of these withheld portions of the record, I note that pages 239-251 are contained in Attachment 4, and consist largely of specific samples of the types of reporting records used by the affected party in carrying out the quality assurance plan for the project. Pages 258-262 are identified as the offer of services but are also titled Fee Proposal.

[59] I find that the disclosure of the specific information contained on pages 239-251 (Attachment 4), which includes specific samples of the types of reporting records used by the affected party in carrying out the project, and the specific manner in which this information is recorded, could reasonably be expected to prejudice significantly the competitive position of the affected party, as it provides specific templates of those types of documents.²⁰ Accordingly, I am satisfied that these portions of the record qualify for exemption under section 17(1)(a).

[60] In addition, I am satisfied that the disclosure of the detailed information in the offer of services, which includes a breakdown of certain fee proposals, contained on pages 258-262 could reasonably be expected to prejudice significantly the competitive position of the affected party. I find that the disclosure of the breakdown of the proposed fees would reveal information about the affected party which may be exploited by competitors, as it provides specific information about the affected party’s costs. Accordingly, I am satisfied that these portions of the record qualify for exemption under section 17(1)(a).

[61] In summary, I find that page 205 of the record does not qualify for exemption under section 17(1), but that the remaining withheld portions of the record qualify for exemption under that section.

ORDER:

1. 1. I uphold the application of the exemption in section 21(1) to pages 189-191 and 193-201.
2. 2. I uphold the application of the exemption in section 17(1) to pages 227 to 231, 239 to 251, 258 to 262, and the bottom of page 237.
3. 3. I order the university to provide the appellant with a copy of pages 160-175 and 203-207, by September 19, 2014 but not before September 15, 2014.

Original signed by: Frank DeVries Adjudicator

August 14, 2014

---

¹ See for example Orders MO-2151, MO-2193 and MO-2856.

² Boeing Co. v. Ontario (Ministry of Economic Development and Trade), [2005] O.J. No. 2851 (Div. Ct.), leave to appeal dismissed, Doc. M32858 (C.A.).

³ Orders PO-1805, PO-2018, PO-2184, and MO-1706.

⁴ The university references orders PO-3038, MO-1237, MO-2070, MO-2197 and MO- 2686.

⁵ Order PO-2020.

⁶ Order P-1621.

⁷ Order MO-1706.

⁸ Orders PO-2020 and PO-2043.

⁹ This approach was approved by the Divisional Court in Boeing Co. v. Ontario (Ministry of Economic Development and Trade), cited above. See also Orders PO-2018, MO-1706, PO-2496, upheld in Grant Forest Products Inc. v. Caddigan, [2008] O.J. No. 2243 and PO-2497, upheld in Canadian Medical Protective Association v. John Doe, [2008] O.J. No. 3475 (Div. Ct.).

¹⁰ Order PO-2020.

¹¹ Orders PO-2043, PO-2371 and PO-2497.

¹² The university refers to orders PO-2755 and MO-2787-I in support of its position.

¹³ See, for example, Orders MO-2151, MO-2176, MO-2435, MO-2856 and PO-3202.

¹⁴ As noted by the university, the appellant requested the affected party’s proposal, not the contract between the university and the affected party.

¹⁵ Ontario (Workers’ Compensation Board) v. Ontario (Assistant Information and Privacy Commissioner) (1998), 41 O.R. (3d) 464 (C.A.).

¹⁶ Order PO-2020.

¹⁷ Order PO-2435.

¹⁸ Order PO-2435.

¹⁹ The university refers to Orders PO-3038, PO-3055 and MO-2070

²⁰ See orders MO-2176 and MO-2151.