Information and Privacy Commissioner, Ontario, Canada

Commissaire à l’information et à la protection de la vie privée, Ontario, Canada

ORDER PO-3420

Appeal PA13-32

The University of Waterloo

November 5, 2014

Summary: The appellant sought access to the successful proposal submitted in response to an RFP for the provision of design build services for the redevelopment of a building owned by the university. Portions of the proposal were disclosed while other parts of it were withheld under the mandatory third party information exemption in section 17(1) and the mandatory personal privacy exemption in section 21(1). In this order, the adjudicator upholds the university’s decision to deny access to much of the personal information in the records, with the exception of that which falls within the ambit of section 2(3). The adjudicator also upholds the university’s decision to deny access to the undisclosed portions of pages 3-9 of the records and determines that certain other portions relating to the affected party’s customers was not responsive to the request, as narrowed.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, definition of personal information in section 2(1), 2(3), 17(1)(a), 21(1), 21(3)(d).

Orders and Investigation Reports Considered: MO-2856, PO-2987.

OVERVIEW:

[1] The University of Waterloo (the university) received a request under the Freedom of Information and Protection of Privacy Act (the Act) for access to information relating to a specific Request for Proposal (RFP). Specifically, the appellant sought access to the following records:

One (1) complete copy of the winning submission for this project

All scorecards, minutes of meetings, evaluation notes, interview notes, etc. pertaining to the decision of this award.

[2] The university identified the winning submission, interview notes for the winning proponent and scoring and evaluation records which are responsive to the request. The university issued a decision granting partial access to the scoring and evaluation records, while denying some other responsive information pursuant to the mandatory third party information exemption in section 17(1)(a) of the Act . Specifically, the university denied access to the winning submission and the interview notes, in their entirety, pursuant to section 17(1)(a) of the Act .

[3] The requester (now the appellant) appealed the decision to this office.

[4] During mediation, the appellant advised that she is not seeking access to the names of personnel or client contact information; nor is she seeking access to information related to the winning proponent’s financial institution, insurance or bonding. Accordingly, I find that the client information contained in the qualifications and experience portion of the proposal and the employee and design team resumes and references at pages 10 to 42 of the records are no longer at issue in this appeal.

[5] At the appellant’s request, the mediator contacted fifteen other proponents who bid on the RFP (the affected parties) seeking their consent to the disclosure of the information relating to them. The mediator was able to obtain the full or partial consent to the disclosure of scoring and evaluation information respecting five of the unsuccessful proponents. The mediator also obtained consent from the winning proponent for disclosure of portions of the winning submission.

[6] The university then issued a supplementary decision providing the appellant with access to the additional information in the records, in accordance with the consents received. The university advised the appellant that access to the remaining responsive information in the records continued to be denied pursuant to section 17(1)(a).

[7] In a letter dated September 3, 2013 near the conclusion of the mediation stage of the appeal process, the appellant advised the mediator that she continues to seek access to the remainder of the information in the winning submission only. As such, the scoring and evaluation records are no longer at issue in this appeal. In the same letter, however, the appellant wrote to the mediator and advised that she continued to seek access to information relating to project experience for the proposed team members (resumes). As a result, information about the affected party’s staff and their qualifications that appears in the staff resumes that were attached to the winning RFP submission remains at issue in this appeal.

[8] As further mediation was not possible, the appeal was transferred to the adjudication stage of the appeals process, where an adjudicator conducts an inquiry under the Act . I sought and received the representations of the university and the successful bidder (the affected party), initially. In its representations, the affected party also raised the possible application of the mandatory personal privacy exemption in section 21(1) of the Act , arguing that those portions of the records which contain information about the qualifications and resumes of its staff qualify as the personal information of these individuals. In addition, the affected party submits that the information in the proposal is also exempt under the mandatory exemptions in sections 17(1)(a), (b) and (c). A complete copy of the university’s representations and a severed version of those of the affected party were then provided to the appellant, who did not submit representations.

[9] In this order, I uphold the university’s decision to withhold the majority of the undisclosed portions of the affected party’s RFP submission. Some information describing the name, title, contact information or designation of individuals identified in a business, professional or official capacity from pages 19 to 42 is ordered disclosed.

RECORDS:

[10] The information at issue consists of the undisclosed and responsive portions of page 3 (Appendix C – Pricing), pages 4 and 5 (Corporate Profile), pages 6, 7 and 8 (Design Build Process flow charts), page 9 (Design Team strategies) and pages 19 to 42 (resumes of staff) from the affected party’s winning RFP submission.

ISSUES:

1. A: Do the records contain personal information as that term is defined in section 2(1) of the Act and if so, to whom does it relate?
2. B: Is the personal information exempt from disclosure under the mandatory exemption in section 21(1) of the Act ?
3. C: Are the records exempt from disclosure under the mandatory third party information exemption in section 17(1) of the Act ?

DISCUSSION:

Issue A: Do the records contain personal information as that term is defined in section 2(1) of the Act and if so, to whom does it relate?

[11] In order to determine which sections of the Act  may apply, it is necessary to decide whether the record contains personal information and, if so, to whom it relates. That term is defined in part, in section 2(1) as follows:

personal information means recorded information about an identifiable individual, including,

(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

[12] The list of examples of personal information under section 2(1) is not exhaustive. Therefore, information that does not fall under paragraphs (a) to (h) may still qualify as personal information.¹

[13] Sections 2(3) and (4) also relate to the definition of personal information. These sections state:

(3) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

(4) For greater certainty, subsection (3) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling.

[14] To qualify as personal information, the information must be about the individual in a personal capacity. As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be about the individual.² Even if information relates to an individual in a professional, official or business capacity, it may still qualify as personal information if the information reveals something of a personal nature about the individual.³

[15] To qualify as personal information, it must be reasonable to expect that an individual may be identified if the information is disclosed.⁴

[16] The affected party submits that the undisclosed portions of pages 19 to 42 of the records, consisting of resumes of staff that were included with the RFP proposal, contains information that qualifies as the personal information of these individuals.

[17] A number of recent orders have addressed the question of whether information contained in a resume which is provided in response to an RFP qualifies as personal information for the purposes of the definition of that term in section 2(1). In Orders MO-2856, MO-3091-F and MO-3093, adjudicators determined that such information, whether it included the employee’s names or not, qualified as their personal information in accordance with paragraph (b) of the definition in section 2(1), which relates to, among other things, an individual’s educational and employment history. In each of these orders, the adjudicators found that the information qualified as the personal information of the employees despite the fact that their names were removed from the scope of the information sought in each of the appeals.

[18] In the present appeal, the appellant is seeking access to the information contained in the resumes of the affected party’s staff which appear in the successful proposal. She has not limited the scope of the appeal to include only information relating to their qualifications. Instead, in her letter of September 13, 2013, the appellant indicates that she is seeking access to project experience for the proposed team members (resumes). Based on this statement from the appellant, I find that the information at issue in the successful proposal includes all of the resume information which appears in that document at pages 19 to 42.

[19] I have reviewed these records and find that the undisclosed information from the employees’ resumes qualifies as their personal information as it includes detailed information about their individual education and employment history, as contemplated by paragraph (b) of the definition in section 2(1). The other undisclosed portions of the RFP proposal that comprises the records do not contain personal information relating to any identifiable individuals within the meaning of the definition in section 2(1).

[20] However, section 2(3) provides an exception to the type of information that qualifies as personal information. Under that section, personal information does not include the name, title, contact information or designation of an individual that identifies an individual in a business, professional or official capacity. In the present appeal, I find that the name, title, contact information or designation of the employees which appears at the top of their resumes falls within the ambit of this exception to the definition of personal information. As a result, I find that this information cannot fall within the exemption in section 21(1), which only applies to personal information. I have highlighted in green on a copy of pages 19 to 42 of the records which I have provided to the university, those portions of the resumes which contain only the name, title, contact information or designation of each of the individuals referred to.

[21] I will now go on to evaluate whether the other personal information in pages 19 to 42 qualifies for exemption under the mandatory personal privacy exemption in section 21(1) of the Act .

Issue B: Is the personal information exempt from disclosure under the mandatory exemption in section 21(1) of the Act?

[22] Where a requester seeks the personal information of another individual, section 21(1) prohibits an institution from releasing this information unless one of the exceptions in paragraphs (a) through (f) of section 21(1) applies. The only exception that could possibly apply in the circumstances of this appeal is section 21(1)(f) which states:

A head shall refuse to disclose personal information to any person other than the individual to whom the information relates except,

if the disclosure does not constitute an unjustified invasion of personal privacy.

[23] Therefore, if a record contains the personal information of an individual other than the appellant, the only way that such a record can be disclosed is if I find that disclosure would not constitute an unjustified invasion of personal privacy of that individual. For the section 21(1)(f) exception to apply, it must be established that disclosure would not be an unjustified invasion of personal privacy.

[24] Sections 21(2), (3) and (4) of the Act  provide guidance in determining whether disclosure of personal information would result in an unjustified invasion of personal privacy. Section 21(2) provides some criteria for the institution to consider in making this determination. Section 21(3) lists the types of information the disclosure of which is presumed to constitute an unjustified invasion of personal privacy. Finally, section 21(4) refers to certain types of information whose disclosure does not constitute an unjustified invasion of personal privacy.

[25] The personal information in pages 19 to 42 is comprised of the employment and educational history of a number of identifiable individuals, and is therefore, subject to the presumption in section 21(3)(d). A number of past orders have determined that information contained in resumes⁵ and work histories⁶ falls within the scope of section 21(3)(d). I agree. Accordingly, I find that the presumption against disclosure in section 21(3)(d) applies to the personal information contained in pages 19 to 42 of the records.

[26] In addition, the Divisional Court has held that once a presumption against disclosure under section 21(3) has been established, it cannot be rebutted by either one or a combination of the factors set out in 21(2). If a section 21(3) presumption against disclosure is established, it can only be overcome if the personal information at issue fits within section 21(4) or if the compelling public interest override at section 23 applies.⁷ I find that section 21(4) does not apply and the appellant has not raised the possible application of the public interest override provision in section 23.

[27] I find that disclosure of the personal information which is not highlighted in green on the copy of pages 19 to 42 which I have provided to the university with a copy of this order would constitute an unjustified invasion of the personal privacy of individuals other than the appellant and that the information is exempt under section 21(1) of the Act .

Issue C: Are the records exempt from disclosure under the mandatory third party information exemption in section 17(1) of the Act?

[28] The affected party and the university submit that the undisclosed portions of the affected party’s RFP submission are exempt from disclosure under the mandatory third party information exemption in section 17(1) of the Act , which reads, in part:

A head shall refuse to disclose a record that reveals a trade secret or scientific, technical, commercial, financial or labour relations information, supplied in confidence implicitly or explicitly, where the disclosure could reasonably be expected to,

(a) prejudice significantly the competitive position or interfere significantly with the contractual or other negotiations of a person, group of persons, or organization;

(b) result in similar information no longer being supplied to the institution where it is in the public interest that similar information continue to be so supplied;

(c) result in undue loss or gain to any person, group, committee or financial institution or agency; or

[29] Section 17(1) is designed to protect the confidential informational assets of businesses or other organizations that provide information to government institutions.⁸ Although one of the central purposes of the Act  is to shed light on the operations of government, section 17(1) serves to limit disclosure of confidential information of third parties that could be exploited by a competitor in the marketplace⁹.

[30] For section 17(1) to apply, the university and/or the affected party must satisfy each part of the following three-part test:

1. 1. the record must reveal information that is a trade secret or scientific, technical, commercial, financial or labour relations information; and
2. 2. the information must have been supplied to the institution in confidence, either implicitly or explicitly; and
3. 3. the prospect of disclosure of the record must give rise to a reasonable expectation that one of the harms specified in paragraph (a), (b), (c) and/or (d) of section 17(1) will occur.

Part 1: type of information

[31] Based on my review of the information contained in the successful proposal, it appears that it contains information that may be categorized as commercial, financial or technical in nature. These types of information have been discussed in prior orders:

Technical information is information belonging to an organized field of knowledge that would fall under the general categories of applied sciences or mechanical arts. Examples of these fields include architecture, engineering or electronics. While it is difficult to define technical information in a precise fashion, it will usually involve information prepared by a professional in the field and describe the construction, operation or maintenance of a structure, process, equipment or thing [Order PO-2010].

Commercial information is information that relates solely to the buying, selling or exchange of merchandise or services. This term can apply to both profit-making enterprises and non-profit organizations, and has equal application to both large and small enterprises [Order PO-2010]. The fact that a record might have monetary value or potential monetary value does not necessarily mean that the record itself contains commercial information [P-1621].

Financial information refers to information relating to money and its use or distribution and must contain or refer to specific data. Examples of this type of information include cost accounting methods, pricing practices, profit and loss data, overhead and operating costs [Order PO-2010].

[32] Based on my review of the records, I am satisfied that they contain information that fits within the definitions of technical, commercial and financial information as those categories of information have been defined in past orders of this office.

[33] In particular, I agree with the affected party’s position that the records contain technical information relating to the design and build proposal under consideration by the university. I am also satisfied that the records contain commercial information because they describe the affected party’s fees for the provision for the design and construction of the tendered building for the university. Finally, I also conclude that the records contain financial information, namely information about the affected party’s fee structure and the financial arrangements of other ongoing projects in which it is involved. I find, however, that the withheld information in the records at issue does not consist of trade secret information, as that term is defined and applied in section 17(1) of the Act .¹⁰

[34] In summary, I find that the undisclosed portions of the proposal contains information that qualifies as technical, commercial and financial information for the purposes of part 1 of the test for exemption under section 17(1) of the Act .

Part 2: supplied in confidence

Supplied

[35] The requirement that it be shown that the information was supplied to the institution reflects the purpose in section 17(1) of protecting the informational assets of third parties [Order MO-1706]. Information may qualify as supplied if it was directly supplied to an institution by a third party, or where its disclosure would reveal or permit the drawing of accurate inferences with respect to information supplied by a third party [Orders PO-2020, PO-2043].

[36] Clearly, the information contained in the record was provided by the affected party to the university as part of its RFP proposal, made in response to the university’s Request for Supplier Qualifications in relation to professional design build services for [the redevelopment of an existing building at the University of Waterloo. I conclude that this aspect of the second part of the test under section 17(1) has been satisfied.

In confidence

[37] In order to satisfy the in confidence component of part two, the affected party and the university, who are resisting disclosure, must establish that the supplier had a reasonable expectation of confidentiality, implicit or explicit, at the time the information was provided. This expectation must have an objective basis [Order PO-2020].

[38] In determining whether an expectation of confidentiality is based on reasonable and objective grounds, it is necessary to consider all the circumstances of the case, including whether the information was

• • communicated to the institution on the basis that it was confidential and that it was to be kept confidential
• • treated consistently in a manner that indicates a concern for its protection from disclosure by the affected person prior to being communicated to the government organization
• • not otherwise disclosed or available from sources to which the public has access
• • prepared for a purpose that would not entail disclosure¹¹.

[39] Both the affected party and the university have provided me with evidence regarding the circumstances surrounding the Request for Supplier Qualifications, which acknowledged at Article 2.17 that the university is subject to the Act  while at the same time requesting that bidders identify any information they consider to be confidential. The affected party submits that it responded to the Request with an expectation that the confidential portions of its proposal would be treated confidentially, despite the fact that it did not explicitly state this in its bid documents.

[40] I have considered the confidentiality statement provided by the university in the tender documents and agree that it would lead the affected party and the other bidders with the expectation that the confidential portions of the proposals would not be publicly disclosed. I am satisfied, based on the affected party’s representations that it reasonably expected that the information it supplied to the university would be treated in a confidential manner by the university. In the circumstances, I find the affected party’s evidence regarding its expectation of confidentiality to be persuasive.

[41] Therefore, I find that the undisclosed portions of the affected party’s proposal were supplied in confidence for the purpose of part 2 of the test for exemption under section 17(1).

Part 3: harms

General principles

[42] To meet this part of the test, the institution and/or the third party must provide detailed and convincing evidence to establish a reasonable expectation of harm. Evidence amounting to speculation of possible harm is not sufficient¹².

[43] The failure of a party resisting disclosure to provide detailed and convincing evidence will not necessarily defeat the claim for exemption where harm can be inferred from other circumstances. However, only in exceptional circumstances would such a determination be made on the basis of anything other than the records at issue and the evidence provided by a party in discharging its onus [Order PO-2020].

[44] The need for public accountability in the expenditure of public funds is an important reason behind the need for detailed and convincing evidence to support the harms outlined in section 17(1) [Order PO-2435].

[45] Parties should not assume that harms under section 17(1) are self-evident or can be substantiated by submissions that repeat the words of the Act  [Order PO-2435].

Section 17(1)(a): prejudice to competitive position

[46] The affected party has provided very detailed and thorough representations expressing its reasons for taking the position that disclosure of the remaining portions of its proposal could reasonably be expected to result in prejudice to its competitive position. These submissions took the form of a set of representations which were shared with the appellant, as well as a confidential statement from the owner of the affected party in which he describes in greater detail the nature of his concerns about the possible consequences of disclosure of the information in the proposal.

[47] The affected party relies on the following principle extracted from Order PO-2987 in which Adjudicator Daphne Loukidelis stated that:

As past orders of this office have acknowledged, the disclosure of information relating to a procurement process must be approached thoughtfully, with consideration of the tests developed by this office, as well as an appreciation of the commercial realties of a procurement process and the nature of the industry in which the procurement occurs (Order MO-1888). In each case, the quality and cogency of the evidence presented, including the positions taken by affected parties, the passage of time, and the nature of the records and the information at issue in them must be considered. Furthermore, the strength of an affected party's evidence in support of non-disclosure must be weighed against the key purposes of access-to-information legislation, namely the need for transparency and government accountability (see Order MO-2496-I).

[48] In its confidential representations, the affected party sets out the competitive environment in which the design and build process was undertaken by the university. It also describes the nature of the affected party’s project management methods and processes which it argues is key to its business strategy and unique in its field. The affected party points out that in the design and build sector context, project management methodology, processes, terms and language are uncommon amongst suppliers, unlike those in the management consulting or larger infrastructure context. The appellant has not provided any submissions to dispute or challenge this assertion.

[49] The affected party goes on to submit that the methodology described in pages 4-5, 6-8 and 9 is a specific, and not a general, description of [its] business methodology which are central to, and going directly to the heart of, performance of the RFP itself, and provide a how to manual for the design and successful implementation of the contract, in enough detail to permit duplication. It also argues that the disclosure of the remaining information in the proposal will prejudice its competitive advantage in future bids by compromising [its] ability to differentiate itself from its competitors if those competitors were able to make use of the information in the records to structure their own RFP proposals.

[50] In addition, the affected party argues that the disclosure of the pricing information in Appendix C, page 3 of the records, would reveal its pricing information and profit margins, which would also disclose its cost structure. It argues that this information could be used by its competitors to under-bid in future RFPs by providing them with "the knowledge of how to reduce their consultant costs, thereby removing [the affected party’s] advantage in this area.

[51] As noted above, the appellant did not participate in the inquiry and did not provide any representations favouring the disclosure of the information at issue.

[52] In Order MO-2856, Adjudicator Loukidelis articulated the following statement with respect to the determination of whether the third part of the test under the mandatory third party information exemption in section 17(1) (section 10(1) of the municipal Act in that case) has been satisfied. She held that:

Many past orders of this office have addressed the treatment of information provided in response to RFP processes under section 10(1) of the Act . The result, in terms of disclosure of the information in an RFP, will naturally differ from one appeal to the next, based on the evidence before the adjudicator, including the parties’ submissions, the content of the records and other circumstances. Regardless of the conclusion, however:

The decision whether to disclose information contained in a tender document must be approached in a careful way, applying the tests as developed over time by this office while appreciating the commercial realities of the tendering process and the nature of the industry in which the tender takes place.¹³

[53] I adopt this approach for the purposes of the current appeal. I find that the affected party has provided me with sufficiently cogent evidence to establish that disclosure of the withheld information could reasonably be expected to lead to the harms contemplated by section 17(1)(a). I accept the position of the affected party that the design build services field is very competitive and requires the use of an innovative approach in order to stand out when submitting proposals in response to RFPs.

[54] After reviewing the records, as well as the affected party’s representations, I am satisfied that the disclosure of the withheld portions of the records could reasonably be expected to result in the harms identified in section 17(1)(a) of the Act . In particular, I find that the affected party has provided me with sufficient evidence to demonstrate that disclosure of those portions of pages 3-9 of its proposal would disclose its methodologies for the supply of design build services which are unique to it.

[55] Accordingly, I accept the affected party’s position that disclosure of the information in these portions of the records would provide a detailed description of its business practices and approach to this type of work. I am satisfied that disclosure of this information would enable its competitors to make use of the affected party’s methodology in order to undercut the affected party when responding to similar RFPs. Accordingly, I find that disclosure of these sections could reasonably be expected to result in a loss of competitive advantage amounting to significant prejudice to the affected party’s competitive position. I find, therefore, that the undisclosed portions of pages 3-9 of the affected party’s proposal satisfy the third part of the test and that they are exempt under section 17(1)(a).

[56] Because of the manner in which I have addressed the application of section 17(1)(a) to the records, it is not necessary for me to also consider whether they qualify for exemption under sections 17(1)(b) or (c).

ORDER:

1. 1. I uphold the university’s decision to deny access to the undisclosed portions of the records on the basis that they are exempt under section 17(1)(a).
2. 2. I order the university to disclose those portions of the resumes at pages 19 to 42 which contain only the name, title, contact information or designation of each of the individuals referred to therein by December 11, 2014 but not before December 5, 2014. I have highlighted in green on the copy of these records which I provided to the university with this order those portions of pages 19 to 42 which are ordered disclosed.
3. 3. In order to verify compliance with this order, I reserve the right to require the university to provide me with copies of the records which are disclosed pursuant to order provision 2.

Original signed by: Donald Hale Adjudicator

November 5, 2014

---

¹ Order 11.

² Orders P-257, P-427, P-1412, P-1621, R-980015, MO-1550-F and PO-2225.

³ Orders P-1409, R-980015, PO-2225 and MO-2344.

⁴ Order PO-1880, upheld on judicial review in Ontario (Attorney General) v. Pascoe, [2002] O.J. No. 4300 (C.A.).

⁵ Orders M-7, M-319 and M-1084.

⁶ Orders M-1084, MO-1257 and MO-2847.

⁷ John Doe v. Ontario (Information and Privacy Commissioner) (1993), 13 O.R. (3d) 767.

⁸Boeing Co. v. Ontario (Ministry of Economic Development and Trade), [2005] O.J. No. 2851 (Div. Ct.), leave to appeal dismissed, Doc. M32858 (C.A.).

⁹ Orders PO-1805, PO-2018, PO-2184, MO-1706.

¹⁰ Trade secret means information including but not limited to a formula, pattern, compilation, programme, method, technique, or process or information contained or embodied in a product, device or mechanism which (i) is, or may be used in a trade or business; (ii) is not generally known in that trade or business, (iii) has economic value from not being generally known, and (iv) is the subject of efforts that are reasonable under the circumstances to maintain its secrecy (Order PO-2010).

¹¹ Orders PO-2043, PO-2371, PO-2497.

¹² Ontario (Workers’ Compensation Board) v. Ontario (Assistant Information and Privacy Commissioner) (1998), 41 O.R. (3d) 464 (C.A.).

¹³ Order PO-1888. See also Order PO-3055.