Information and Privacy Commissioner, Ontario, Canada

Commissaire à l’information et à la protection de la vie privée, Ontario, Canada

ORDER PO-3373

Appeal PA13-405

Ministry of Transportation

July 30, 2014

Summary: The appellant requested access to the dates and names of all individuals who have run the appellant’s license plate number over the last six years, and their reasons for doing so. The ministry responded by stating that the requested record is not included in the definition of record on the basis of section 2 of Regulation 460 of the Act, because the process of producing the record would unreasonably interfere with the operations of the ministry. This order upholds the ministry’s decision.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, section 2(1) definition of record), Regulation 460, section 2.

Orders Considered: PO-2151, PO-2752.

OVERVIEW:

[1] The Ministry of Transportation (the ministry) received a request under the Freedom of Information and Protection of Privacy Act  (the Act ) for access to the dates and names of any and all individuals who have run [the requester’s] licence plate [identified license plate number] and the reasons for it, if available, since January, 2008.

[2] The ministry issued a decision in response, in which it advised that access was denied to the request because Regulation 460, section 2 applies. That provision reads:

A record capable of being produced from machine readable records is not included in the definition of record for the purpose of the Act  if the process of producing it would unreasonably interfere with the operations of an institution.

[3] The decision then read:

The ministry relies on this provision and is of the view that the information you have requested does not fall within the definition of record and, as such, is not governed by or accessible under the Act .

[4] In the decision, the ministry also referred to a previous order of this office (Order PO-2151) in support of its position that the requested information does not fall within the definition of record.

[5] The appellant appealed the ministry’s decision. The only issue in this appeal is whether the requested information is a record as defined in section 2 of the Act and section 2 of Regulation 460.

[6] Mediation did not resolve this appeal, and it was transferred to the inquiry stage of the appeals process. I sent a Notice of Inquiry identifying the facts and issues in this appeal to the ministry, initially. I also provided the ministry with a copy of the appellant’s appeal letter, in which she identified a number of the questions and/or concerns she raises in this appeal.

[7] The ministry provided representations in response. I then sent the Notice of Inquiry, along with a copy of the ministry’s representations, to the appellant, who also provided representations.

[8] In this order I uphold the ministry’s decision that the process of producing the record would unreasonably interfere with its operations under section 2 of Regulation 460, and that the requested record is not included in the definition of record under the Act .

DISCUSSION:

Is the requested information a record as defined in section 2 of the Act and section 2 of Regulation 460?

[9] Record is defined in section 2(1)  of the Act  as follows:

record means any record of information however recorded, whether in printed form, on film, by electronic means or otherwise, and includes,

(a) correspondence, a memorandum, a book, a plan, a map, a drawing, a diagram, a pictorial or graphic work, a photograph, a film, a microfilm, a sound recording, a videotape, a machine readable record, any other documentary material, regardless of physical form or characteristics, and any copy thereof, and

(b) subject to the regulations, any record that is capable of being produced from a machine readable record under the control of an institution by means of computer hardware and software or any other information storage equipment and technical expertise normally used by the institution; (document)

[10] However, section 2 of Regulation 460 also relates to the definition of the word record. It reads:

A record capable of being produced from machine readable records is not included in the definition of record for the purposes of the Act  if the process of producing it would unreasonably interfere with the operations of an institution.

[11] The ministry takes the position that although the record responsive to the request may be capable of being produced from a machine readable record for the purpose of section 2(1)(b) of the definition, the process of producing the record would unreasonably interfere with the operations of the ministry under section 2 of Regulation 460. As a result, the requested record is not included in the definition of record because of the operation of that section.

[12] Accordingly, the issue in this appeal is whether the process of producing the record would unreasonably interfere with the operations of the ministry.

[13] In the course of this appeal, both parties referred in some detail to Order PO-2151, as it related to a request very similar to the one resulting in this appeal. As a result, I will review that order in some detail.

Order PO-2151

[14] In Order PO-2151, issued in 2003, a request under the Act  was made to the ministry for a list of all Authorized Requesters or other persons who obtained the requester’s personal information, including their names and addresses and the reasons why they accessed to requester’s information. In response to the request, the ministry took the position that the process of producing the record would unreasonably interfere with the operations of the ministry.

[15] Adjudicator Laurel Cropley reviewed the representations of the parties, particularly the information provided by the ministry on how the requested information could be extracted from the existing electronic records. She summarized the three steps necessary to extract the information as follows:

Step One – Job set-up

The Ministry does not have a system that, for each individual, records any access to that person’s records. The Ministry does, however, have a system log, which records technical data related to the operation of the database system on the mainframe. The log contains a record for every online message that went into the mainframe (e.g. a request for information), and a record for every message that went out (e.g. a response to an information request).

This log can be searched with a basic utility program that can extract records matching one or more character strings (e.g. vehicle plate number, driver license number). This provides an indirect means of identifying accesses to a particular record. This log is produced daily and is retained for one year in tape form.

Conducting a search of these logs is a laborious, non-standard operation.

• - First, an experienced senior analyst must create the computer processes, or jobs, that will search these tapes. To do this, the analyst identifies the search keys, that is, the various identifiers that can be linked to an individual.
• - Then, he or she will obtain a list of the names of the daily log files from the system. The Ministry indicates that this list is divided into 20 groups and a job control statement must be written for each group. These job control statements are used to run the job on the mainframe.

The Ministry estimates that it will take two days to complete the first step.

Step Two – Job execution

The 20 jobs are then submitted into the mainframe, one at a time, for processing by the utility program. The Ministry indicates that the mainframe service provider, iServ, employs operations staff who are responsible for retrieving and feeding the log tapes into the tape drivers to be read. However, the senior analyst is responsible for all other activities related to submitting and monitoring each job.

The Ministry notes that while each job uses approximately one hour of CPU time, the actual elapsed time to complete each task requires several hours.

The Ministry estimates that performing this task would require approximately 10 days of work for the senior analyst over four weeks of elapsed time.

Step Three – Analysis of Search Results

The Ministry notes that the various programs contained in the mainframe computer produce an estimated 2,200 unique message formats, which are all written in computer code. Therefore, in order to interpret the results, a new program must be written. The Ministry indicates that the new program is required to translate the data into a readable format and to remove data that does not pertain to the appellant.

The Ministry states that interpreting the results requires the talents of a highly skilled technical expert with a wide variety of specialized knowledge about various aspects of the Ministry’s computer applications. Only a very small number of people have the necessary skills and experience to perform these searches.

The Ministry estimates that one hour of programming time is required to interpret each of the 2,200 message formats, for a total of 315 days. In addition, the Ministry expects that a further 60 days will be required to test the program. In total, the Ministry estimates that this step will take 375 days to complete.

The Ministry notes further that in some cases, requests come in by telephone or facsimile and the job is performed by Ministry staff. In these cases, the authorized requester cannot be identified via the computer program because the code will identify the Ministry staff person who performed the search.

Therefore, it will also be necessary to conduct a manual search of paper, microfilmed or other logs on which information is stored. The Ministry states that it is unable at this point to estimate how much time will be required to perform this search because it is not known how many requests for information will be found.

The Ministry points out that the people with the specialized technical skills required to analyze the data are also the ones responsible for the operational health of the Ministry’s most important computer systems. According to the Ministry, there are currently only two specialists on staff with the ability to perform the largest and most complex part of the requested search. The Ministry indicates that they play a vital role in supporting the day-to-day operations of the Ministry’s critical systems, and that they are presently unable to keep pace with the increasing demands for their time and expertise. The Ministry claims that if they are pulled away from their essential duties for days at a time to perform one of these searches, they will fall even further behind.

Additionally, the Ministry asserts that taking the time to create this information will interfere with staff’s ability to perform the regular monitoring of various systems that is necessary to keep them functioning properly. A lack of monitoring could result, for example, in a delay in detecting, diagnosing or resolving a problem suddenly arising in the mainframe systems, potentially affecting the ability of hundreds of users to do their work.

The Ministry submits that by preventing these specialists from performing their normal duties in safeguarding the performance and availability of critical computer systems, undertaking a search of this kind will unreasonably interfere with the Ministry’s operations.

[16] After reviewing the representations of the appellant and a number of orders which dealt with the application of Regulation 460, Adjudicator Cropley found that, based on the ministry’s explanation of the time and effort required to produce a record responsive to the appellant’s request, she was satisfied that doing so would unreasonably interfere with the operations of the ministry. As a result, she found that even though a record was capable of being produced in response to the request, it did not fall within the definition of record because the process of producing it would unreasonably interfere with the ministry’s operations.

The current appeal - Representations

The ministry’s representations

[17] The ministry provides representations in support of its position that, as in Order PO-2151, the process of producing a record responsive to the request in this appeal would unreasonably interfere with its operations. It states:

While there have been considerable changes to the channels through which information reaches the Ministry since 2002, the back end of the Ministry’s IT infrastructure is essentially unchanged, and it is this back end which must be searched to produce the records requested in this appeal. That back end is a legacy mainframe application system which is some 42 years old.

[18] The ministry then reviews in some detail the changes that have been made to its databases since the time that Order PO-2151 was issued, but confirms that these changes have been made to the front end of the systems. It states that the back end of the ministry’s systems are the same as they were in 2002. It also confirms that the demands made on the system have grown since 2002, and then provides the following information on how it can access the information:

… the core system for managing the Ministry’s driver and vehicle information has not changed in any significant way [since 2002]. The steps involved in responding to a request of this nature are essentially unchanged since 2003. These steps and the context in which they are taken are as follows:

• • There is no dedicated system for tracking accesses to a particular individual’s records.
• • There are logs, produced daily in the back end where the databases reside and maintained in tape form, for tracking input to the mainframe back end database system, and responses from the mainframe.
• • These logs can be searched by a utility program that searches for certain character strings.
• • The above searches are laborious to carry out, and senior personnel must write 20 job statements for each year’s 365 daily logs.
• • Each of the 20 jobs takes up to one hour of CPU time, but several hours of elapsed time.
• • Carrying out the above jobs requires about up to 10 days of work for a senior analyst, over 4 weeks of elapsed time.
• • The results of the above jobs will be some 2,200 unique message formats, which must be translated by a specially written new program that will transform the cryptic data into readable form, and will strip out data that does not pertain to the requester. This will take approximately 375 days of programming time to complete.

Unlike the case in 2002, there would likely be a lesser need for manual searches for requests coming in by telephone, mail or fax, as most of these originated with Authorized Requesters. Such requests now come to the Ministry through the Authorized Requester Information System, and are logged on the mainframe.

As was the case in 2002, there are still only two staff persons qualified to perform the most complex part of the search, and they still play a vital role in supporting the Ministry’s daily IT operations. These are persons who possess expertise in IBM information management database system log formats, allowing them to analyze data in the logs. They also require knowledge of other Ministry applications and how to interpret the system logs for those applications.

These individuals are tasked with supporting the daily operations of the mainframe system. Calling them away to perform these searches would risk compromising the proper functioning of that system.

[19] In its representations, the ministry also addresses a question raised by the appellant during the processing of this file. It states:

The appellant states that the information at issue should be retrievable with a quick SQL [structured query language] command. This is to fundamentally misconstrue the nature of the system, as described above and in Order PO-2151, on which the information is stored. SQL commands have no application to the logs on which the raw data is stored. The mainframe back end uses the Information Management System (IMS) transaction management (TM) and the IMS Database (DB) which is a Hierarchical database management system to store most of its data. The IMS TM/DB data and logs are not accessible or interpretable by SQL. SQL is Relational Database Management System query language.

The appellant’s representations

[20] The appellant provides detailed representations, however, the bulk of her representations raise questions about why the ministry is unable to produce the record more efficiently than it could in 2002. I review these issues under Additional Matter, below.

[21] With respect to the issue of whether producing a record responsive to her request would unreasonably interfere with the operations of the ministry, the appellant states that, as identified in Order PO-2151, what constitutes an unreasonable interference is a matter which must be considered on a case-by-case basis.

Analysis and findings

[22] A number of previous orders have addressed the issue of whether the process of producing a record would unreasonably interfere with the operations of an institution under section 2 of Regulation 460. In Order P-50, Former Commissioner Sidney B. Linden first addressed this issue and stated:

What constitutes an unreasonable interference is a matter which must be considered on a case-by-case basis, but it is clear that the Regulation is intended to impose limits on the institution's responsibility to create a new record.

[23] Orders since then have reviewed the various circumstances where this case-by-case analysis has been conducted. In Order PO-2752, Assistant Commissioner Brian Beamish reviewed a number of these orders and their findings. He also noted that these orders have confirmed that, in order to establish interference, an institution must, at a minimum, provide evidence that responding to a request would obstruct or hinder the range of effectiveness of the institution’s activities.¹ These orders have also noted that, where an institution has allocated insufficient resources to the freedom of information access process, it may not be able to rely on limited resources as a basis for claiming interference.² Although government organizations are not obliged to maintain records in such a manner as to accommodate the various ways in which a request for information might be framed,³ an institution must provide sufficient evidence beyond stating that extracting information would take time and effort in order to support a finding that the process of producing a record would unreasonably interfere with its operations.⁴

[24] In Order PO-2752, Assistant Commissioner Beamish applied these principles to the circumstances before him, and found that an estimate of 1377 hours to produce responsive records would unreasonably interfere with the ministry’s operations.

[25] I agree with the approach taken by the Assistant Commissioner and adopt it for the purpose of this appeal.

[26] With respect to the amount of time it would take to produce the responsive records, the ministry has provided detailed evidence in support of the estimate of the number of hours it would take to produce the records. It identifies the reasons why it would take this amount of time, including the types of searches that must be conducted, the nature of the searches and the expertise of the personnel required to conduct the searches. The ministry also identifies the impact that these searches would have on its operations.

[27] In the circumstances, and based on the information provided, I accept the ministry’s estimate of the approximate number of hours it would take to produce the records responsive to this request. I also accept the ministry’s statements regarding the expertise required by the individuals conducting the searches and producing the records, and that producing the records would unreasonably interfere with the ministry’s operations.

[28] As a result, I am satisfied that the ministry has established that producing the record would unreasonably interfere with its operations. Accordingly, even if a record is capable of being produced in response to the appellant’s request, it does not fall within the definition of record because the process of producing it would unreasonably interfere with the ministry’s operations.

Additional matter

[29] As noted above, the issues in this appeal are similar to those addressed in Order PO-2151.

[30] In that order, after finding that producing the record would unreasonably interfere with the ministry’s operations, Adjudicator Cropley addressed the question of whether the ministry had met its obligations to the public. In reviewing this question, she stated:

As repositories of personal information, government institutions have a duty to control, monitor and account for the manner in which that personal information is collected and used. The Act  mandates this. And in doing so, it creates a reasonable expectation on the part of the public that institutions will be able to respond to public queries about the use of their personal information, except where specific exemptions apply (i.e. sections 21(5)  and 14(3)  of the Act ). …

In this decision, I have upheld the basis for the Ministry’s refusal to provide the appellant with information about the manner in which his personal information has been used. I accept that there is a general public interest in government institutions operating in an efficient and fiscally responsible manner.

The Act  recognizes that there will be times when the interests of individual requesters are subordinate to these other interests. Section 2 of Regulation 460 allows institutions to balance these two competing interests. It does not, however, relieve the Ministry from taking the necessary steps to ensure that the information it collects is accessible.

I strongly encourage the Ministry, when reviewing its information collection and storage methods and database creation, to take into account the functionality of its database model in order to facilitate accessibility to the public.

[31] Throughout this appeal the appellant has questioned the ministry’s response to her request, and indicated her concerns that, ten years after the issuance of Order PO-2151, the ministry’s response to a request for information about who has accessed an individual’s personal information remains the same. In her appeal letter, she stated:

When the adjudicator … signed the Order PO-2151 [she] strongly encouraged the Ministry, when reviewing its information collection and storage methods and database creation, to take into account the functionality of its database model in order to facilitate future accessibility to the public. It begs the question, Has nothing changed in ten years that the Ministry of Transportation is still unable to grant access? …

Without the public having access to its personal information, what and how can any measures ever be taken to ensure that the request from any Authorized Requestors is a bona fide request; and that the information obtained is used only for bona fide purposes as stipulated in the agreements with the Ministry? … I contend that it does not comply with the underlying philosophy of the legislation or reasonable expectations of Ontarians.

[32] In this appeal, the ministry did provide information about the efforts it has made to update its systems. During mediation it advised that it was in the process of reviewing its Licensing and Control System Database as part of a modernization project, and that when this project has concluded, it is possible that the type of information requested will then be available. The ministry stated that this project began in November of 2009 and it is unsure when this project will be completed.

[33] In its representations, the ministry also addresses some of the appellant’s concerns. It states:

The Ministry has established a modernization program with respect to its driver, vehicle and carrier databases, but the process of doing so has been phased, costly and difficult. The phase involving the Ministry’s Licence Control System has not yet been undertaken. The cost and resource implications of the modernization program are significant, and the completion date of this process cannot be forecast at this time.

While the back end of the Ministry’s systems are the same as they were in 2002, the same cannot be said for the front end of the system, or for the number of transactions processed and the number of registered vehicles on the system.

The introduction of the Authorized Requester Information System, while it replaced a pre-existing system for access by Authorized Requesters, resulted in a greatly expanded number of clients and transactions. The Inquiry Services System (ISS), on the other hand, is an entirely new and powerful means of accessing the Ministry’s databases for law enforcement and government services authorized by statute.

[34] The appellant’s representations respond at length to the ministry’s position. She questions the ministry’s commitment towards upgrading their back end, tape form system, and asks for further information about the ministry’s back end modernization program. She refers to private sector companies she is aware of that required a similar modernization of their database, and which were efficiently completed. She also suggests that the system maintained by the ministry is far costlier to maintain in the long run than other, upgraded options which have been available for some time.

[35] The appellant also identifies her concerns that, although changes have been made to the front end of the systems, there have effectively been no changes made to the back end since 2002. She states that it is not possible to confirm that the personal information being provided by the ministry to authorized users is being used with strict adherence to the existing contractual terms or statutory requirements. She also states that the ministry’s response has not addressed compliance with the requirements of the Act , in particular, the right of individuals to identify potential abuses or misuses of … personal data, and references Adjudicator Cropley’s statement in Order PO-2151 that it does not relieve the ministry from taking the necessary steps to ensure that the information it collects is accessible.

[36] The appellant then refers to the ministry’s statement that it enters formal agreements with the authorized users which limit these organizations’ use and disclosure of the personal information they obtain, and that the ministry can terminate these agreements if they are not followed. She asks how the ministry can determine whether these agreements have been breached, as most abuses or misuses of personal information would be identified by the Ontario Driver after being given an opportunity to access same. She concludes by stating:

At minimum, I believe the Ministry owes [the public] a reasonable forecast as to the completion date of the modernization project to their legacy mainframe which is being cited as the cause of their inability to meet their obligations under [the Act ]. If not, I fear that in a decade we will be having the same discussion.

[37] Even though I have found above that the information requested by the appellant is not a record for the purposes of the Act , I have summarized the positions taken by the appellant and the ministry regarding the changes (or lack of changes) that have taken place since the issuance of Order PO-2151 because, in my view, the appellant asks compelling questions about the ministry’s work on changing the back end of its information systems.

[38] I agree with the statements made by Adjudicator Cropley in Order PO-2151 that there is a general public interest in government institutions operating in an efficient and fiscally responsible manner and that the Act  recognizes that there will be times when the interests of individual requesters are subordinate to these other interests. I also agree with her statement that section 2 of Regulation 460 allows institutions to balance these two competing interests. However, I acknowledge the appellant’s stated concerns that, if no actual changes are made to the back end of the systems, the ministry’s response to requests of this nature will not change.

[39] Although the ministry has identified the changes that have been made to the front end of the system, and the factors it considers in determining where to allocate resources for further changes, I urge the ministry to carefully consider its statutory obligations under the Act  as it continues to establish and implement its modernization program with respect to its driver, vehicle and carrier databases.

ORDER:

I uphold the ministry’s decision.

Original signed by: Frank DeVries Adjudicator

July 30, 2014

---

¹ Reference to Orders P-850 and PO-2151.

² Reference to Orders MO-1488 and PO-2151.

³ Reference to Order M-583.

⁴ Reference to Order MO-1989, upheld in Toronto (City) Police Services Board v. Ontario (Information and Privacy Commissioner), [2009] O.J. No. 90 (C.A.); reversing [2007] O.J. No. 2442 (Div. Ct.).