Information and Privacy Commissioner, Ontario, Canada

Commissaire à l’information et à la protection de la vie privée, Ontario, Canada

ORDER PO-3412

Appeal PA12-481

Ministry of the Attorney General

October 24, 2014

Summary: The appellant sought access to certain information pertaining to the Defence Counsel Association of Ottawa (DCAO) that came into the possession of the Ottawa Crown Attorney’s office through an anonymous source or sources. The ministry relied on the exemptions at sections 19(b) (solicitor-client privilege) and 49(b) (personal privacy) of the Act to deny access to them, in full. In the course of adjudication, a number of matters were resolved, and the appellant substantially revised the request. In this order, the adjudicator determines that the ministry has failed to establish that disclosing the emails would result in the disclosure of the personal information of the anonymous source or sources of the emails, and orders the ministry to issue a new decision letter with respect to the appellant’s revised request.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, ss. 2(1), 10(1)(b) and 24.

Orders Considered: Orders P-230 and PO-2811.

Cases Considered: Ontario (Attorney General) v. Ontario (Information and Privacy Commissioner) [2001] O.J. No. 4987, affirmed at [2002] O.J. No. 4300 (C.A.); Ontario (Community Safety and Correctional Services) v. Ontario (Information and Privacy Commissioner), 2014 SCC 31.

OVERVIEW:

[1] The Defence Counsel Association of Ottawa (DCAO) is an association of private criminal defence lawyers who practice in Ottawa, Ontario. Members of the DCAO can access a members’ only site and exchange communications about various topics. When some of these communications found their way to the Ottawa Crown Attorney’s office, the request at issue in this appeal soon followed.

[2] The Ministry of the Attorney General (the ministry) received a request under the Freedom of Information and Protection of Privacy Act  (the Act  or FIPPA ) from an individual, in his capacity as the President of the DCAO, for access to the following information:

All correspondence (electronic or otherwise), memorandums, machine readable records, any other documentary material, regardless of physical form or characteristics, and any copy thereof that refer to, relate to, or are authored by the following: DCAO; DEFENCE COUNSEL ASSOCIATION OF OTTAWA; [first named individual]; [named requester]; [second named individual]; [third named individual];S.486; S.486.3; [REQUEST IS SPECIFIC TO MATERIAL FROM THE OFFICE OF THE CROWN ATTORNEY FOR OTTAWA]: REQUEST IS SPECIFIC TO MATERIAL RELATED IN ANY WAY TO DCAO INTERNAL AND CONFIDENTIAL EMAILS THAT WERE PROVIDED IN SOME CAPACITY TO MEMBERS OF THE CROWN ATTORNEY’S OFFICE.

[3] The ministry subsequently sought clarification of the request. In response, the requester clarified the request in the following way:

… I can confirm that our request is specific to material related in any way to DCAO confidential internal emails that we understand to be in the possession of the Crown Attorney’s Office in Ottawa.

…

Accordingly, we request the following information:

All correspondence (electronic or otherwise), memoranda, machine readable records, any other documentary material, regardless of physical form or characteristics and any copy thereof that refer to, relate to or are authored by the following: the Defence Counsel Association of Ottawa; the DCAO; [named requester]; [the three above-stated individuals]; s.486; and/or s.486.3.

[4] The ministry identified records responsive to the request and, relying on the exemptions at sections 19(b) (solicitor-client privilege) and 49(b) (personal privacy) of the Act , denied access to them, in full.

[5] The DCAO, through its then President, (hereinafter both referred to as the appellant) appealed the ministry’s decision.

[6] Mediation did not resolve the appeal and it was moved to the adjudication stage of the appeals process where an adjudicator conducts an inquiry under the Act .

[7] I commenced my inquiry by seeking representations from the ministry on the facts and issues set out in a Notice of Inquiry. In the Notice of Inquiry, I asked the ministry to clearly identify the individuals whose personal information it asserts is contained in the records at issue and to provide contact information for these individuals. In its responding representations on this issue, the ministry simply alleged that the personal information related to the anonymous source(s). The ministry did not identify any other identifiable individual’s personal information that might appear in the records. For example, no representations were provided on whether the emails that are responsive to the request might also contain the personal information of the authors of those emails.

[8] I then sent the appellant a Notice of Inquiry accompanied by the non-confidential representations of the ministry. The appellant provided responding representations. In its representations, amongst other things, the appellant advised that it was revising its request as follows:

The applicant seeks copies of all internal DCAO confidential emails authored by [named individual], [named individual], [named individual], and/or [named individual], that were provided in some capacity to members of the Ottawa Crown Attorney’s office.

To be clear, the applicant does not seek any information that would be covered by solicitor-client privilege such as advice given or discussion held in relation to the requested emails.

[9] I determined that the appellant’s representations raised issues to which the ministry should be permitted to reply. Accordingly, I sent a letter to the ministry inviting its reply submissions along with a copy of the appellant’s representations. The ministry provided reply representations. In its representations, amongst other things, the ministry wrote:

The appellant, in the course of their … submissions, further stated that, the [appellant] does not seek any information that would be covered by solicitor-client privilege such as advice given or discussion held in relation to the requested emails. Accordingly, the [ministry] understands that records 1 to 12 are no longer in dispute as those records are properly exempted by way of s. 19 solicitor-client privilege. That leaves only those documents authored by [the four named individuals] and forwarded to the Crown from the anonymous source(s) to be considered as the basis for the remaining request.

[10] I determined that the ministry’s reply representations should be shared with the appellant and I sent the appellant a letter inviting sur-reply submissions, along with a copy of the ministry’s representations. The appellant provided sur-reply representations in response.

RECORDS:

[11] The records at issue consist of emails.

ISSUES:

1. A. What is the scope of the request and what records are responsive to the request?
2. B. Do the records at issue contain personal information and to whom does that information relate?

DISCUSSION:

Issue A: What is the scope of the request? What records are responsive to the request?

[12] Section 24  of the Act  imposes certain obligations on requesters and institutions when submitting and responding to requests for access to records. This section states, in part:

1. (1) A person seeking access to a record shall,
   1. (a) make a request in writing to the institution that the person believes has custody or control of the record;
   2. (b) provide sufficient detail to enable an experienced employee of the institution, upon a reasonable effort, to identify the record;
   3. . . .
2. (2) If the request does not sufficiently describe the record sought, the institution shall inform the applicant of the defect and shall offer assistance in reformulating the request so as to comply with subsection (1).

[13] Institutions should adopt a liberal interpretation of a request, in order to best serve the purpose and spirit of the Act . Generally, ambiguity in the request should be resolved in the requester’s favour.¹

[14] To be considered responsive to the request, records must reasonably relate to the request.²

[15] As set out in the overview above, the appellant revised the request to be for the following:

The applicant seeks copies of all internal DCAO confidential emails authored by [named individual], [named individual], [named individual], and/or [named individual], that were provided in some capacity to members of the Ottawa Crown Attorney’s office.

To be clear, the applicant does not seek any information that would be covered by solicitor-client privilege such as advice given or discussion held in relation to the requested emails.

[16] The ministry’s understanding of what remained at issue was:

That leaves only those documents authored by [the four named individuals] and forwarded to the Crown from the anonymous source(s) to be considered as the basis for the remaining request.

[17] This was not disputed by the appellant in its sur-reply representations. In fact, the appellant appears to agree that the scope of this appeal be revised in this way. In its sur-reply representations the appellant closes its submissions by suggesting that the appellant would consent to [disclosure of] the body of original emails (i.e. those authored by the named authors), with any information tending to indicate parties involved thereafter being redacted.

[18] Accordingly, for the purposes of the appeal before me, I find that the request is for:

copies of all internal DCAO confidential emails authored by [named individual], [named individual], [named individual], and/or [named individual], that were provided in some capacity to members of the Ottawa Crown Attorney’s office.

[19] In this regard, I consider this request to be for copies of the emails in the form that they were provided to the Ottawa Crown Attorney’s office, without any disclosure of any other information.

[20] The modification of the request in this manner amounts to a very dramatic change to the scope of the request. When the initial request was made, the ministry identified various internal email exchanges as being responsive records. What is really at issue in the revised request are the emails from the identified individuals (the authors of the emails) initially provided to the Ottawa Crown Attorney’s office. The appellant’s revision essentially changes the records that the ministry identified as responsive to the request into non-responsive records, except perhaps, for the copies of the emails initially provided to the Ottawa Crown Attorney’s office that may be contained within those responsive records.

[21] The ministry consistently maintained its position that disclosing the emails that were responsive to the request would reveal the personal information of anonymous source(s) of the emails. As set out above, although the ministry was asked to identify whose personal information appears in the records, it only provided representations relating to the personal information of the anonymous source(s). No representations were provided on whether the emails that are responsive to the request might also contain the personal information of the authors of those emails. Furthermore, the authors of the emails were not notified of this appeal.

[22] In light of this change to the scope of the request, and as there were no representations provided on whether, albeit they were exchanged in an open forum, the emails might contain the personal information of their authors, I have decided to address the ministry’s position that disclosing the original emails would reveal the anonymous source(s), and thereafter whether the ministry should issue a decision letter identifying records that are responsive to the reframed request. To be clear, in this order, I am only addressing whether disclosing the emails would reveal the personal information of the anonymous source(s).

Issue B: Do the emails provided to the Ottawa Crown Attorney’s office contain personal information and to whom does that information relate?

[23] In order to determine which sections of the Act  may apply, it is necessary to decide whether the record contains personal information and, if so, to whom it relates. That term is defined in section 2(1) as follows:

personal information means recorded information about an identifiable individual, including,

(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

(c) any identifying number, symbol or other particular assigned to the individual,

(d) the address, telephone number, fingerprints or blood type of the individual,

(e) the personal opinions or views of the individual except if they relate to another individual,

(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

(g) the views or opinions of another individual about the individual, and

(h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.

[24] The list of examples of personal information under section 2(1) is not exhaustive. Therefore, information that does not fall under paragraphs (a) to (h) may still qualify as personal information.³

[25] Sections 2(3) and (4) also relate to the definition of personal information. These sections state:

(3) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

(4) For greater certainty, subsection (3) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling.

[26] To qualify as personal information, the information must be about the individual in a personal capacity. As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be about the individual.⁴

[27] Even if information relates to an individual in a professional, official or business capacity, it may still qualify as personal information if the information reveals something of a personal nature about the individual.⁵

[28] To qualify as personal information, it must be reasonable to expect that an individual may be identified if the information is disclosed.⁶

[29] As set out above, the request at issue in this appeal arose when some of the communications between members of the DCAO, found their way to the Ottawa Crown Attorney’s office.

[30] As set out above, the ministry consistently maintained its position that disclosing the emails that were responsive to the request would reveal the personal information of the anonymous source(s) of the emails. No representations were provided by the ministry on whether the emails might also contain the personal information of the authors of those emails.

[31] The ministry’s primary position is that disclosing the DCAO emails will result in the identification of the anonymous source(s) that provided the emails to the Ottawa Crown Attorney’s office, which, in the ministry’s view, is the personal information of the anonymous source(s).

[32] The ministry submits that some of the DCAO emails may have been covertly marked by the DCAO to identify anyone who might forward or leak the emails outside of the DCAO and that disclosing the emails will result in the identification of the individual(s) who supplied the emails to the Ottawa Crown Attorney’s office. The ministry submits that this is not a bona fide request under the Act and it is aimed squarely at exposing the identity of an individual(s) who does not share the views of the DCAO on the issue of the appointment of counsel and any potential conflicts of interest that may arise therein.

[33] The ministry provided both confidential submissions (which I cannot elaborate upon any further in this order) and non-confidential submissions in support of its position.

[34] For example, in its non-confidential submissions, the ministry wrote:

The Crown Attorney’s office does not have any records in its custody or control bearing the name of the individual or individuals who provided the DCAO emails/server postings to the Crown’s office. The Crown Attorney’s office does not, for example, have custody or control of an email sent to the Crown’s office bearing the name of a sender who forwarded the DCAO email postings to the Crown Attorney’s office.

The Crown Attorney’s office has, however, been advised that some of the emails may have been covertly marked by the DCAO to identify anyone who might forward or leak the emails outside of the DCAO. Consequently, the Crown has reason to believe that the materials in their possession may have been marked with an identifying feature that would reveal member(s) of the bar suspected of providing these records to the Crown’s office.

…

The Crown received the records from a source(s) who expressed a desire to remain anonymous. The Assistant Crown who received the records forwarded the information to the Crown Attorney in order to seek legal advice and in contemplation of litigation directly related to the content of the emails. Instructively, the substantive content of the emails are accessible to the DCAO on their own list server. Thus, the objective of the DCAO in making this request is simply to expose the identity of the individual(s) who provided these sensitive records to the Crown Attorney’s office.

[35] The ministry further submits that:

Should the requester receive the documents in issue, the identity of the person(s) who disclosed the record could be discerned by assiduous DCAO representatives who have specialized knowledge of the content of the records and the particular persons involved in the communications …..

[36] The ministry then specifically addresses the issue of whether the records contain personal information in the following way:

It is the position of the Crown that any of the marked emails contain personal information within the meaning of s. 2(1)  of the Act . Information that identifies the individual(s) who provided the emails/postings to the Crown’s office in confidence is personal information within the meaning of s. 2(1)  of the Act . A reasonable expectation that the individual can be identified from these emails is all that is required to attract the privacy protection provisions of the Act .

[37] The ministry explains that:

The emails/postings sought in this request are significant because of the identifiable markings they may contain. To contextualize this request, the following factors must be considered:

i) The DCAO has access to each of the e-mails sought in this request as the emails have been posted on a server which can be accessed by a large number of people including members of the DCAO and anyone with access to a DCAO log-in and;

ii) Members of the DCAO, in their own postings, recognize that the postings are being accessed: BTW this board is not safe for discussion and if you don’t think THESE emails are going to end up in the spouse’s hands either through [named individual] or the offender or his supporters, then you are too naïve to be a defence lawyer. [emphasis in original]

[38] The DCAO denies that the emails were covertly marked. The DCAO submits:

No confidential, internal DCAO emails … have been covertly marked by the DCAO to identify anyone who might forward or leak the emails outside of the DCAO. There is therefore no reasonable objective basis to believe that the disclosure of the private internal DCAO emails would disclose the identity of the person or person(s) who provided copies of the emails to the Crown’s office.

[39] In reply, the ministry submits:

[Named individual] indicated in his … submissions that no emails have been covertly marked by the DCAO in an effort to identify any potential sources of leaked information. The [ministry] infers from this position that [the individual] has undertaken that neither him nor Messrs. [named individual], [named individual] or [named individual] made such markings in their emails. However, they cannot speak for every other member of the DCAO who may have come into possession of the records in question. [Footnote omitted]. Consequently, the [ministry] continues to assert there are important reasons to protect the personal identity/information of the anonymous source(s). … Further, the [ministry] maintains the overarching purpose of the appellant’s request falls outside the spirit and intention of [FIPPA]⁷.

…

In this particular instance, the [ministry] was specifically informed that DCAO emails may have been marked by members of the organization so as to identify those suspected of providing the records to the Crown’s office. The [ministry] was also informed that the source(s) who provided the information to the Crown’s office wished to remain anonymous – the clear inference being that the source(s) was/were concerned about being identified by DCAO membership. In light of these factors, the [ministry] was, and remains, obligated to take such concerns under serious consideration in applying the relevant exemptions.

[40] As an alternative to its position that the emails are covertly marked, the ministry further submits that:

… there may well be other ways to identify the anonymous source(s) apart from markings that are embedded in the emails. For instance, it may be that only a few select individuals were privy to specific conversations contained in the emails authored by the four individuals or were otherwise part of certain emails chains. In those circumstances, disclosing the emails may either explicitly, or by careful deduction, reveal the identity of the anonymous source(s). This is but one example of how disclosing the emails in their entirety could adversely impinge upon the legitimate privacy interests of anonymous sources.

[41] In sur-reply, the appellant submits that:

The purpose of retrieving these emails is to determine exactly what confidential information has been disclosed; therefore, it is entirely irrelevant whether or not the appellant has copies of the same messages on its servers.

Furthermore, it is possible that the disseminated information, initially written by a member of the DCAO, has been altered without the knowledge or consent of its author. It could have been forwarded and the initial text changed in a fundamental manner. This could very possibly negatively reflect on its author. The only way to verify what information has been shared against the author’s will, purporting to be written by him, is to access the record that has been disseminated. That person is entitled to know what is being done with their information.

[42] In addition, the appellant submits that, though the ministry uses a broad definition for what could constitute personal information, it engages in conjecture, and provides no specific information as to what information in an email at issue would contain that would meet that definition. The appellant submits that:

The [ministry] does not meet its burden of showing a reasonable expectation that any person, other than the person asking for the emails, could be identified by viewing the emails.

Analysis and finding

[43] The ministry consistently maintained its position that disclosing the emails that were responsive to the request would reveal the personal information of anonymous source(s) of the emails. As set out above, although the ministry was asked to identify whose personal information appears in the records, it only provided representations relating to the personal information of the anonymous source(s). No representations were provided on whether the emails that are responsive to the revised request might also contain the personal information of the authors of those emails. As no representations were provided with respect to the authors of the emails, and they were not notified of this appeal, I am only addressing whether disclosing the emails at issue would reveal the personal information of the anonymous source(s).

[44] As set out above, personal information means recorded information about an identifiable individual. In Order P-230, former Commissioner Tom Wright set out the basic requirements of identifiability as follows:

If there is a reasonable expectation that the individual can be identified from the information, then such information qualifies under subsection 2(1) as personal information.

[45] In my view, the ministry has failed to provide me with sufficiently detailed and convincing evidence to establish that disclosing the emails will reveal the identity of the individual who supplied the emails to the Ottawa Crown Attorney’s office. Neither in its confidential nor non-confidential submissions does the ministry actually explain how emails may be covertly marked. Its submissions, in my view, amount to simple speculation. Accordingly, putting aside the blanket denials by the DCAO, I am not satisfied on the evidence provided that the emails at issue have been covertly marked in such a way as to reveal the identity of the individual who provided the emails to the Crown Attorney’s office.

[46] The ministry advanced a secondary argument: that the individual who supplied the emails to the Ottawa Crown Attorney’s Office could be could be identified by virtue of the number of individuals that were privy to specific conversations contained in the emails authored by the four individuals or were otherwise part of certain email chains. The ministry submits that in those circumstances, disclosing the emails may either explicitly, or by careful deduction, reveal the identity of the anonymous source(s).

[47] Orders and decisions of this office that involve a specific determination of identifiability of information consider a range of variables in the circumstances, including the size of the group of individuals from which the identification could be made. This has been referred to as the concept of small cell count. As described by former Senior Adjudicator John Higgins in Order PO-2811:

the term small cell count refers to a situation where the pool of possible choices to identify a particular individual is so small that it becomes possible to guess who the individual might be, and the number that would qualify as a small cell count varies depending on the situation.⁸

[48] The question then is whether it is reasonable to expect that an individual could be identified because of the size of the group of individuals, the nature of the information at issue, or when the information at issue is combined with information from sources otherwise available.⁹

[49] The ministry does not provide a specific number of individuals who may have had access to the DCAO emails at issue in this appeal. It did submit, however, that the emails have been posted on a server which can be accessed by a large number of people, including members of the DCAO and anyone with access to a DCAO log-in and that at the time of the request, the DCAO website listed 150 members. Furthermore, there is a possibility that the person who obtained the emails through access to the DCAO blog may not be the same person who provided the emails to the ministry. Providing the example cited by the ministry and then simply stating that disclosing the emails may either explicitly, or by careful deduction, reveal the identity of the anonymous source(s) is not sufficient. The ministry must provide a sufficient basis for the application of its secondary position and not simply engage in further speculation. I am simply not satisfied that the ministry has provided sufficient evidence to establish that the disclosure of the emails, even if they are not covertly marked, would reveal the personal information of the anonymous source(s).

[50] In my view, based on the evidence before me, I find that there is no reasonable expectation that the individual(s) who provided the emails to the Ottawa Crown Attorney’s office, can be identified by the disclosure of the emails that are responsive to the revised request.

[51] In light of my findings above, and because the revised request is for access to all internal DCAO confidential emails authored by four identified individuals in the form that they were provided to the Ottawa Crown Attorney’s office, without any disclosure of any other information, I will order the ministry to provide a new access decision with respect to these records.

ORDER:

1. 1. I order the ministry to issue an access decision in response to the appellant’s revised request for copies of all internal DCAO confidential emails authored by four identified individuals in the form that they were provided to the Ottawa Crown Attorney’s office, without any disclosure of any other information, treating the date of this order as the date of the revised request, all in accordance with sections 26 , 28  and 29  of the Act .
2. 2. I further order the ministry to send me a copy of the access decision issued to the appellant pursuant to Provision 1 of this order when the decision is issued to the appellant.

Original signed by: Steven Faughnan Adjudicator

October 24, 2014

---

¹ Orders P-134 and P-880.

² Orders P-880 and PO-2661.

³ Order 11.

⁴ Orders P-257, P-427, P-1412, P-1621, R-980015 and PO-2225.

⁵ Orders P-1409, R-980015, PO-2225 and MO-2344.

⁶ Order PO-1880, upheld on judicial review in Ontario (Attorney General) v. Ontario (Information and Privacy Commissioner) [2001] O.J. No. 4987, affirmed at [2002] O.J. No. 4300 (C.A.).(Pascoe).

⁷ Throughout its representations, the ministry challenged the bona fides of the appellant’s request. Section 10(1) (b) of the Act  allows an institution to deny access to a record when the head is of the opinion on reasonable grounds that the request for access is frivolous or vexatious. This section was never relied upon by the ministry in this appeal or even touched upon in the ministry’s decision letter. In the absence of such a specific claim it is not necessary for me to address this issue any further.

⁸ Order PO-2811 at page 8. Order PO-2811 was upheld in Ontario (Community Safety and Correctional Services) v. Ontario (Information and Privacy Commissioner), 2014 SCC 31.

⁹ Pascoe, supra; as applied in many decisions, including Orders MO-2407, PO-2551 and PO-2811. Order PO-2811 was upheld in Ontario (Community Safety and Correctional Services) v. Ontario (Information and Privacy Commissioner), 2014 SCC 31.