Information and Privacy Commissioner, Ontario, Canada

Commissaire à l’information et à la protection de la vie privée, Ontario, Canada

ORDER MO-3151

Appeal MA12-221

City of Toronto

January 16, 2015

Summary: The requester sought access to a log containing the maintenance requests for the city’s fire services’ Computer-Aided Dispatch (CAD) system. The city decided to grant access to the record in full. The company that provided the CAD system to the city appealed this decision, claiming the application of the mandatory third party information exemption in section 10(1)(a). Order MO-2895 determined that section 10(1)(a) applied to exempt only certain portions of one column of the 13-column record.

An application for judicial review of Order MO-2895 was allowed and the matter was remitted back for a new hearing on the information in columns 10, 12 and 13 of the record. This order finds that all of the information in columns 10 and 12 and most of the information in column 13 of the record is exempt by reason of section 10(1)(a) of MFIPPA.

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. M.56 , as amended, section 10(1)(a).

Orders and Investigation Reports Considered: Order MO-2895.

Cases Considered: Intergraph Corporation v. Information and Privacy Commissioner of Ontario, 2014 ONSC 6484.

BACKGROUND:

[1] The City of Toronto (the city) received an eight part request under the Municipal Freedom of Information and Protection of Privacy Act  (MFIPPA  or the Act ) for access to records concerning a Computer-Aided Dispatch (CAD) system. Part 6 of the request sought maintenance logs for the city’s fire services’ CAD system for the years 2009 to 2011.

[2] The city issued a decision to the requester advising that disclosure of the record responsive to part 6 of the request, may affect the interests of a third party (Intergraph), which has a contract with the city to provide the software and maintenance services for the CAD system.

[3] Accordingly, the city provided Intergraph with an opportunity to make representations concerning the disclosure of the requested record pursuant to section 21  of the Act . Intergraph made written representations arguing against the disclosure of the requested record.

[4] The city then issued a final access decision granting access to the responsive record. The city notified Intergraph of its decision and of its right to appeal the decision to this office.

[5] Intergraph¹ appealed the city’s decision to grant access to the entire record and advised the mediator that it is opposed to the disclosure of the record on the basis that this information qualifies for exemption under the mandatory third party information exemption in section 10(1) (a) of the Act . As mediation did not resolve the issues in this appeal, the file was transferred to the adjudication stage where an adjudicator conducts an inquiry.

[6] I then sought and received representations from Intergraph, the city and the requester in accordance with section 7 of the IPC’s Code of Procedure and Practice Direction 7. In its representations, Intergraph opposed disclosure of the entire record to the requester. The record, a maintenance log, consisted of information contained in a 13 column chart with the following headings:²

[TITLE NOT FOUND]

COLUMN #	TITLE
1	Serial Number
2	Status
3	Sub-status
4	Ext CR #
5	Cust Ref #
6	Created
7	Closed
8	Created By
9	Owned By
10	Priority
11	Product
12	Summary
13	Description

[7] I then issued Order MO-2895, where I found that only some of the information in column 13 of the record was exempt from disclosure under section 10(1) (a) of MFIPPA . I found that the rest of the information in column 13 and all of the information in the other 12 columns of the record was not exempt and I ordered it disclosed.

[8] In particular, in Order MO-2895, I found that some of the information in columns 12 and 13 met part 2 of the three-part test under section 10(1)(a) as it was supplied to the city by Intergraph in confidence. I found that none of the information in column 12 and most of the information in column 13 did not meet part 3 of the test (the harms test) under section 10(1)(a).³

[9] The appellant then sought judicial review of Order MO-2895. At the judicial review hearing, the appellant did not take issue with the disclosure of the information in columns 1 to 9 and 11 of the record. Concerning the information in Columns 10, 12 and 13 of the record, the Divisional Court in Intergraph Corporation v. Information and Privacy Commissioner of Ontario (Intergraph),⁴ determined that I did not apply the test under section 10(1) (a) of MFIPPA  in a consistent manner and that my decision in Order MO-2895 lacked:

…the justification, transparency and intelligibility that is required within the decision-making process. When the Decision is considered as a whole, it is not possible to say that it falls within a range of possible, acceptable outcomes which are defensible in respect of the facts and law.

[10] The Divisional Court allowed the application for judicial review and remitted the appeal back to this office for a new hearing on the application of section 10(1)(a) to the information in columns 10, 12 and 13 of the maintenance log. The Divisional Court stated that: It would be prudent if Intergraph provided specific information for the new hearing to explain the interplay between the three columns of information.

[11] I then sought representations from the Intergraph in accordance with the terms of the Divisional Court’s decision in Intergraph. I received representations from Intergraph opposing disclosure of the information in columns 10, 12 and 13 of the record. These representations were shared with the requester, less the confidential portions.⁵ The requester did not provide representations in response, but did confirm that he was still interested in receiving access to the entire record.

[12] In this order, I find that all of the information in columns 10 and 12 and most of the information in column 13 of the record is exempt by reason of section 10(1) (a) of MFIPPA .

RECORD:

[13] The record is a log containing maintenance requests for the city’s fire services’ CAD system for the years 2009, 2010, and 2011.

DISCUSSION:

Does the mandatory exemption at section 10(1)(a) apply to the information contained in columns 10, 12 and 13 of the record?

[14] Section 10(1)(a) states:

A head shall refuse to disclose a record that reveals a trade secret or scientific, technical, commercial, financial or labour relations information, supplied in confidence implicitly or explicitly, if the disclosure could reasonably be expected to,

prejudice significantly the competitive position or interfere significantly with the contractual or other negotiations of a person, group of persons, or organization;

[15] Section 10(1) is designed to protect the confidential informational assets of businesses or other organizations that provide information to government institutions.⁶ Although one of the central purposes of the Act  is to shed light on the operations of government, section 10(1) serves to limit disclosure of confidential information of third parties that could be exploited by a competitor in the marketplace.⁷

[16] For section 10(1) to apply, the institution and/or the third party must satisfy each part of the following three-part test:

1. 1. the record must reveal information that is a trade secret or scientific, technical, commercial, financial or labour relations information; and
2. 2. the information must have been supplied to the institution in confidence, either implicitly or explicitly; and
3. 3. the prospect of disclosure of the record must give rise to a reasonable expectation that one of the harms specified in paragraph (a), (b), (c) and/or (d) of section 10(1) will occur.

Part 1: type of information

[17] The columns of the record at issue in this order are the following:⁸

[TITLE NOT FOUND]

COLUMN #	TITLE
10	Priority
12	Summary
13	Description

[18] In its initial representations, Intergraph stated that it used the information in the record to determine what problems and enhancements are necessary and/or desirable to the CAD software. As such, it submitted that the record contained technical information which describes the operation and/or maintenance of the CAD software maintenance.

[19] In its initial representations, the city described the CAD system as a system that assists emergency call dispatchers in communicating with emergency responders and for the collection of data. It stated that:

The affected party is the owner and developer of the CAD system product. The actual CAD system software itself is not at issue in this appeal, nor is the actual software that the city uses to detail certain information on maintenance tasks or performance issues with the CAD software. The record at issue in this appeal is a summary of the maintenance requests, which is created by city staff. Fire Services staff has the ability to export the information they enter and print copies of the summary of the maintenance requests. Although the summary of the maintenance requests record does not contain any detail with respect to the design of the software, specifically its layout, schemes or arrangements, 3 of the 13 fields in the summary contain technical information.

[20] In Order MO-2895, I found that the columns 10, 12, and 13 of the record contained technical information, namely information about the operation or maintenance of the CAD software and that part 1 of the test had been met for this information. Technical information has been defined in prior orders as information belonging to an organized field of knowledge that would fall under the general categories of applied sciences or mechanical arts. While it is difficult to define technical information in a precise fashion, it will usually involve information prepared by a professional in the field and describe the construction, operation or maintenance of a structure, process, equipment or thing.⁹

Part 2: supplied in confidence

Supplied

[21] The requirement that it be shown that the information was supplied to the institution reflects the purpose in section 10(1) of protecting the informational assets of third parties.¹⁰

[22] Information may qualify as supplied if it was directly supplied to an institution by a third party, or where its disclosure would reveal or permit the drawing of accurate inferences with respect to information supplied by a third party.¹¹

Representations of Intergraph on supplied

[23] Intergraph states that the city sourced, received and used its CAD software and generated the maintenance log from it. It describes the maintenance log as a 13-column spreadsheet and states that:

As the reader reviews the log from left to right, various details of the CAD software Maintenance issue are presented. The information in columns 1 through 10 (under the designations SR# through Priority) describe procedural or administrative aspects of the logged issue - its assigned reference number, its status, who reported it, its urgency, and so on.

Columns 11 through 13 (designated Product, Summary" and Description) in contrast, substantively describe perceived aspects of the CAD software and the operations of the software which may be malfunctioning, being the issue which warranted an entry in the maintenance log by city staff...

When read horizontally, [the record] underscores the importance to the CAD System of the function (or error in the function) which is identified as to location in column 11, summarized in column 12, and described in detail in column 13.

These summary entries [in column 12] comprise in a capsule or snapshot fashion the nature of the issue for which the particular log entry was created. They are a product of a city staff user transcribing or reporting on, briefly but precisely, what the CAD software actually does within the framework of a specific task or function. In virtually all cases the information in column 12 makes specific mention of functional units or routines of the software in question, as well as the specific behaviour of that unit or routine. In cases where they constitute a transcription of the workings of the software as a particular user has experienced it, these entries permit the drawing of accurate inferences with respect to the technical functioning of the software.

Column 13, Description, supplies yet more detail with respect to the software.

[24] Intergraph submits that the preponderance of the information in columns 12 and 13 is a combination of explicitly supplied or information, disclosure of which, would reveal or would permit the drawing of accurate inferences about information supplied by it to the city.

[25] With respect to information it explicitly supplied, Intergraph points to some of the information in the maintenance log, such as actual software code, and software output messages. This information includes the terminology used by the software, the names of specific features and functions of the software, and error and status messages generated by the software. It states that but for Intergraph’s creation and delivery of its software to the city, and the city staff's access to and use of the software, none of this information would be generated, known to, or accessible by city staff.

[26] With respect to information that would reveal or permit the drawing of accurate inferences about information supplied by it, Intergraph states that as city staff enter a log of the software's behaviour, they record both messages generated by the software, as well as the software's observed, in contrast to its desired, behaviour.

[27] Intergraph submits that some of the information in column 13 of the log has not been supplied by it. This information is akin to the information found in columns 1 through 9, such as city staff names, inter-staff advice and observations regarding the effect of the perceived issue on the software's ultimate purpose.

Analysis/Findings re supplied

[28] I agree with Intergraph’s description of the record as a maintenance log that documents any issues that have arisen as a result of city staff’s use of the CAD software's behaviour for purposes of troubleshooting and diagnosis by Intergraph. The record also operates as an indicator to Intergraph of how staff may need additional instruction or guidance in the software's operation.

[29] Based on my review of the record and the detailed and record-specific confidential and non-confidential representations of Intergraph, I agree with Intergraph that on review of the log horizontally and as a whole, all of the information in columns 10 and 12 and most of the information in column 13 were supplied by Intergraph to the city. This information contains descriptions of the software's behaviour and reveal or permit the drawing of accurate inferences with respect to the CAD software.

[30] I also agree with Intergraph that certain information in column 13 was not supplied by Intergraph. This information concerns comments about situations other than the behaviour of the CAD software or information about city staff themselves.

[31] I will now consider whether the information in columns 10, 12 and 13 which I have found to be supplied, was supplied in confidence.

In confidence

[32] In order to satisfy the in confidence component of part two, the parties resisting disclosure must establish that the supplier had a reasonable expectation of confidentiality, implicit or explicit, at the time the information was provided. This expectation must have an objective basis.¹²

[33] In determining whether an expectation of confidentiality is based on reasonable and objective grounds, it is necessary to consider all the circumstances of the case, including whether the information was

• • communicated to the institution on the basis that it was confidential and that it was to be kept confidential
• • treated consistently in a manner that indicates a concern for its protection from disclosure by the affected party prior to being communicated to the government organization
• • not otherwise disclosed or available from sources to which the public has access
• • prepared for a purpose that would not entail disclosure.¹³

Representations of Intergraph on in confidence

[34] Intergraph states that the CAD software was supplied to the city under strictly confidential contractual terms. Its states that its end user license agreement with the city, under which the CAD software was supplied, indicates the confidentiality attaching to both the communication and the treatment of the information.

[35] Intergraph states that the maintenance log was prepared by licensed users of the CAD software, for maintenance usage by Intergraph exclusively, and is not otherwise disclosed or available from sources to which the public has access.

[36] Intergraph points out that in its representations in support of Order MO-2895, the city stated that it is bound by the confidentiality and nondisclosure provisions in both the Master Service Agreement and the Maintenance Service Agreement.

Analysis/Findings re in confidence

[37] Based on my review of Intergraph’s representations, the information at issue in the record, and the agreements between the city and Intergraph, I agree with Intergraph that information that I have found to be supplied was supplied in confidence. In making this finding, I note that the end user license agreement states that:

…Confidential Information also shall include, whether or not designated Confidential Information,

(i) all specifications, designs, documents, correspondence, software, documentation, data and other materials and work products produced by either INTERGRAPH or its subcontractors,

(ii) with respect to either party, all information concerning the operations, financial affairs and businesses, and relations with its employees and service providers… [Emphasis added by me]

[38] Accordingly, I find that part 2 of the test has been met for all of the information in columns 10 and 12 and the information that I have found to be supplied in column 13.

Part 3: harms

[39] To meet this part of the test, the institution and/or the third party must provide detailed and convincing evidence to establish a reasonable expectation of harm. Evidence amounting to speculation of possible harm is not sufficient.¹⁴

[40] The failure of a party resisting disclosure to provide detailed and convincing evidence will not necessarily defeat the claim for exemption where harm can be inferred from other circumstances. However, only in exceptional circumstances would such a determination be made on the basis of anything other than the records at issue and the evidence provided by a party in discharging its onus.¹⁵

[41] The need for public accountability in the expenditure of public funds is an important reason behind the need for detailed and convincing evidence to support the harms outlined in section 10(1).¹⁶

[42] Parties should not assume that harms under section 10(1) are self-evident or can be substantiated by submissions that repeat the words of the Act .¹⁷

[43] Section 10(1) (a) of the Act  provides two disjunctive tests for competitive harm. According to that section, a record is not to be disclosed if the disclosure could reasonably be expected to,

• • prejudice significantly the competitive position, or
• • interfere significantly with the contractual or other negotiations of a person, group of persons, or organization.

Representations re: prejudice significantly the competitive position

[44] Intergraph states that the CAD system market is highly competitive and that its market position has been gained through providing cutting edge technological solutions, substantial monetary investment, years of experience in the public safety industry and the innovation of its engineering team. It states that disclosure of maintenance requests for the CAD system could cause immeasurable monetary harm to Intergraph's public safety business. It is concerned that its competitors could use even some apparently minor technical information in the log to imitate, duplicate or otherwise end-run Intergraph's market advantage with this product, without investing the years of investment, research and creativity that was embedded within it by Intergraph.

[45] Intergraph states that the technical information in the maintenance log helps the CAD software developers to generate the software code for upgrades and updates, which constitute a key part of the competitive edge of CAD Systems. Intergraph states that it continually revises and improves its product to compete for a limited number of potential accounts municipal emergency responders.

[46] It submits that the cumulative knowledge that can be gathered from the bulk of the non-code technical information in the 44 page log would afford a competitor valuable and exploitable knowledge about the structure of significant features of Intergraph's software, posing an equal, and substantial, risk of competitive harm.

[47] With reference to the particular information at issue in the record, in its confidential representations, Intergraph provided numerous examples of how disclosure of the information at issue could give an experienced software developer significant insight into the structure and layout of key components of its CAD system.¹⁸

Representations re: interfere significantly with the contractual or other negotiations

[48] Intergraph refers to my findings in Order MO-2895 where I accepted that public disclosure of the confidential descriptions of certain CAD system software information could place it at a competitive disadvantage. I stated that if this highly technical information is interpreted incorrectly, potential future customers may choose not to license its CAD system software based on problems stated in maintenance requests, without giving Intergraph an opportunity to provide any rebuttal as to whether they have been corrected.

[49] Intergraph states that the likelihood of competitive harm to it is no less severe, however, if other aspects of the maintenance log besides highly technical software code are interpreted incorrectly. It states that problems and issues related by users and recorded in the maintenance logs, whether they arose from bugs in the software, user error or misinterpretation of software functions, if disclosed, all clearly raise the potential for the same chilling effect on future potential customers.

Analysis/Findings

[50] In Order MO-2895, I found that only the disclosure of specific confidential descriptions of certain CAD system software information in column 13 could reasonably be expected to cause the harms set out in section 10(1)(a). I found that this information contains specific details about how Intergraph’s software handles the functional requirements of the CAD system and that disclosure could harm Intergraph’s ability to demonstrate its product to future customers. I stated that if this highly technical information is interpreted incorrectly, potential future customers may choose not to license its CAD system software based on problems stated in maintenance requests without giving Intergraph an opportunity to provide any rebuttal as to whether they have been corrected. I found that such a situation would place the affected party at a competitive disadvantage.

[51] I also found that disclosure of this highly technical information could allow a competitor of CAD system software to utilize the information in the maintenance requests in creating similar software. Intergraph would be deprived of the value of this information if a competitor could access this information at no cost to itself for its own commercial use.

[52] I have now had the benefit of detailed representations from Intergraph which include confidential portions that explain how the specific information at issue in the record could reasonably be expected to result in the harms set out in section 10(1)(a). This includes representations on the interplay between the columns at issue in the record, along with submissions on how this information interacts with the remainder of the record.

[53] Based on my review of the record and taking into account, in particular, the confidential representations of Intergraph, I find that disclosure of the information in columns 10, 12, and most of 13 in combination with the information being disclosed in the remaining columns of the record, could reasonably be expected to afford a competitor knowledge about the structure of significant features of Intergraph's software. In addition, disclosure could also reasonably be expected to provide Intergraph’s competitors access to important aspects of the design and logic of the CAD system.

[54] As such, I find that disclosure of the information at issue in columns 10, 12 and most of 13 could reasonably be expected to prejudice significantly the competitive position of Intergraph as well as interfere significantly with the contractual or other negotiations of Intergraph and this information is exempt under section 10(1) (a) of MFIPPA .

ORDER:

1. 1. I order the city to disclose to the requester the information in columns 1 to 9 and 11 of the record, as well as the highlighted information in column 13 of the record, by February 23, 2015 but not before February 17, 2015. For ease of reference, I have provided the city with a copy of the record highlighting the information in column 13 that should be disclosed to the requester.
2. 2. I order the city to withhold the remaining information in column 13 and the information in columns 10 and 12 of the record.
3. 3. In order to verify compliance with this order, I reserve the right to require the city to provide me with a copy of the information disclosed to the requester upon my request.

Original signed by: Diane Smith Adjudicator

January 16, 2015

---

¹ Intergraph is the appellant and the affected party in this order.

² Columns 4 and 5 of the record did not contain any information.

³ See below for a description of the three-part test under section 10(1)(a).

⁴ Intergraph Corporation v. Information and Privacy Commissioner of Ontario, 2014 ONSC 6484.

⁵ I did not seek representations from the city as the city had not opposed disclosure of the information at issue.

⁶ Boeing Co. v. Ontario (Ministry of Economic Development and Trade), [2005] O.J. No. 2851 (Div. Ct.), leave to appeal dismissed, Doc. M32858 (C.A.).

⁷ Orders PO-1805, PO-2018, PO-2184 and MO-1706.

⁸ Not at issue are columns 1 to 9 and 11.

⁹ Order PO-2010.

¹⁰ Order MO-1706.

¹¹ Orders PO-2020 and PO-2043.

¹² Order PO-2020.

¹³ Orders PO-2043, PO-2371 and PO-2497.

¹⁴ Ontario (Workers’ Compensation Board) v. Ontario (Assistant Information and Privacy Commissioner) (1998), 41 O.R. (3d) 464 (C.A.).

¹⁵ Order PO-2020.

¹⁶ Order PO-2435.

¹⁷ Order PO-2435.

¹⁸ Unlike the situation with respect to its representations in support of Order MO-2895, where it did not provide record-specific detailed representations.