ORDER PO-3550

Appeal PA14-455

University Health Network

November 27, 2015

Summary: The hospital received an access request seeking a copy of a previous access request. It granted partial access to the responsive record, denying access to the name and contact information of the individual who made the initial request, pursuant to the mandatory personal privacy exemption at section 21(1) of the Act. In this order, the adjudicator finds that the record contains the personal information of the individual who made the initial access request and that its disclosure would amount to an unjustified invasion of their personal privacy. The adjudicator upholds the hospital’s decision to deny access to the personal information and dismisses the appeal.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, section 2(1) (definition of “personal information”), 21(1)(f), 21(2)(d), 21(2)(h).

Orders and Investigation Reports Considered: Orders P-539, PO-2488, MO-2761 and PO-2764.

OVERVIEW:

[1]  The University Health Network (the hospital) received a request under the Freedom of Information and Protection of Privacy Act  (the Act ) for access to the following information:

… a copy of the initial access to information request which gave rise to institution file number 2014-010.

[2]  The hospital issued a decision letter granting partial access to the requested information. The hospital advised that the name, contact information and signature of the individual who made the initial access request (the affected party) was denied pursuant to the application of the mandatory personal privacy exemption at section 21(1)  of the Act .

[3]  The requester, now the appellant, appealed the hospital’s decision to deny access to the affected party’s information.

[4]  During mediation, it was confirmed that the affected party did not provide consent for the disclosure of their information. As further mediation was not possible, the file was transferred to the adjudication stage of the appeal process for an adjudicator to conduct an inquiry under the Act .

[5]  I began my inquiry into this appeal by sending a Notice of Inquiry setting out the facts and issues on appeal to the hospital, initially. The hospital provided representations in response. Although invited to do so, the affected party chose not to make representations.

[6]  I then sent a copy of the Notice of Inquiry to the appellant, seeking representations. In accordance with this office’s Practice Direction 7, I provided the appellant with a copy of the hospital’s representations, in their entirety. The appellant provided representations in response.

[7]  For the reasons outlined below, I uphold the hospital’s decision and dismiss the appeal.

RECORD:

[8]  The record responsive to the request is a completed access/correction request form. The information that remains at issue in this appeal is the information relating to the individual who made the request, including their name, address, telephone numbers and signature.

ISSUES:

1. Does the record contain “personal information” as defined in section 2(1) and, if so, to whom does it relate?
2. Does the mandatory exemption at section 21(1) apply to the information at issue?

DISCUSSION:

A. Does the record contain “personal information” as defined in section 2(1) and, if so, to whom does it relate?

[9]  In order to determine which sections of the Act  may apply, it is necessary to decide whether the record contains “personal information” and, if so, to whom it relates. The relevant parts of the definition of “personal information” as set out in section 2(1)  of the Act  state:

“personal information” means recorded information about an identifiable individual, including,

…

(d) the address, telephone number, fingerprints or blood type of the individual,

…

(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence.

…

(h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

[10]  The list of examples of personal information under section 2(1) is not exhaustive. Therefore, information that does not fall under paragraphs (a) to (h) may still qualify as personal information. [1]

[11]  Sections 2(3) and (4) also relate to the definition of personal information. These sections state:

(3) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

(4) For greater certainty, subsection (3) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling.

[12]  To qualify as personal information, the information must be about the individual in a personal capacity. As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be “about” the individual. [2] Even if information relates to an individual in a professional, official or business capacity, it may still qualify as personal information if the information reveals something of a personal nature about the individual. [3]

[13]  To qualify as personal information, it must be reasonable to expect that an individual may be identified if the information is disclosed. [4]

Representations

[14]  The hospital states that the information at issue consists of the affected party’s name, address, telephone numbers and signature. The hospital submits that paragraphs (d), (f), and (h) of the definition of “personal information” as outlined in section 2(1)  of the Act  support its finding that the information at issue consists of the affected party’s “personal information.”

[15]  The hospital submits that addresses and telephone numbers are explicitly included in paragraph (d) of the definition of “personal information.” It also submits that the disclosure of either the affected party’s name or signature on the access request form would reveal “other personal information relating to the individual” as contemplated by paragraph (h). Specifically, the hospital submits that the disclosure of the affected party’s name or signature would reveal that the requester made an access request for specific information which, it submits, is “information about an identifiable individual.” Finally, the hospital submits that the access request form was submitted by the affected party to the hospital in a context where there was an implicit expectation of confidentiality as contemplated by paragraph (f) of the definition of “personal information.”

[16]  Although the affected party chose not to submit representations, during mediation, they confirmed that they did not consent to the disclosure of the information and advised that the request was submitted in their personal capacity.

[17]  The appellant submits that the information that it seeks on the initial access request form does not constitute “personal information” as defined by the Act . Although the appellant concedes that certain orders have found that an individual’s identity as a requester under the Act  qualifies as that individual’s personal information under section 2(1)  of the Act , [5] it submits that to qualify as personal information, the information must be about the individual in a personal capacity. It states that, generally, information relating to an individual in a professional, official or business capacity will not be considered to be personal information [6] and submits that the information at issue in this appeal relates to the affected party in their professional capacity.

[18]  The appellant refers to Order PO-2225, where former Assistant Commissioner Tom Mitchinson established the approach taken by this office in determining whether information qualifies as personal information or professional information. That test requires that the following questions be asked:

1. In what context do the names of the individual’s appear? Is it a context that is inherently personal, or is it one such as a business, professional or official government context that is removed from the personal sphere?
2. Is there something about the particular information at issue that, if disclosed, would reveal something of a personal nature about the individual? Even if the information appears is a business context, would its disclosure reveal something that it inherently personal in nature?

[19]  The appellant cites Order PO-2764, in which Commissioner Brian Beamish considered a request for a copy of a specific access request submitted by an individual other than the appellant. In Order PO-2764, Commissioner Beamish applied the test enunciated by former Assistant Commissioner Mitchinson in Order PO-2225 and found that the initial requester’s name and contact information should be disclosed. In coming to his decision, Commissioner Beamish assigned significant weight to the fact that the individual who submitted the initial access request used his business contact details on the request form and concluded that there was nothing about that individual’s name, in the context of the appeal, that would reveal something of a personal nature about the individual if it were disclosed. Commissioner Beamish determined that the individual filed his request in a business capacity and, as a result, found that his information did not qualify as personal within the meaning of that term as defined in the Act .

[20]  The appellant submits that without access to the identity of the requester of the initial access request, it does not know the context surrounding the request. It submits that when examining the context of the request a number of questions should be asked to determine if the context is inherently personal or not. The questions suggested by the appellant include whether the address, email address, phone number or fax number relate to a business or an individual; whether the requester is a current or former employee of a business in the medical waste disposal industry; and, whether the cheque used to pay for the application fee was a personal or business cheque.

[21]  The appellant also submits that it attaches significant weight to the fact that the affected party states “we are requesting” on the request form, rather than “I am requesting,” as this suggests that the access request was not made in a personal capacity.

[22]  The appellant further submits that the request is in no way personal in nature as the subject matter of the information sought is commercial and the affected party has not offered any explanation as to why they might have a personal, as opposed to business interest, in such information. The appellant states that it “fail[s] to see how someone could have a personal interest in medical waste disposal contracts.” It reiterates that the affected party’s failure to provide an explanation as to why the information is requested is another indication that the affected party’s interest was commercial rather than personal.

[23]  Finally, the appellant submits that it does not see how the disclosure of the affected party’s name or contact information, in the context of an access request, would reveal something of a personal nature about the affected party. It submits that the only information that would be revealed is their name, contact details, and the fact that they filed an access request in connection with the subject matter outlined therein.

Analysis and finding

[24]  At issue is the information that has been severed from a completed access to information request form. It relates to the identity of the individual who made the request, the affected party, and includes their name, address, telephone numbers and signature.

[25]  As noted by the appellant, previous orders and privacy complaint reports issued by this office have found that an individual’s identity as a requester under the Act  qualifies as that individual’s personal information [7] where a request is not made in a professional or business capacity. [8] The appellant submits that the request for information may have been filed by the affected party in a professional capacity and therefore, the information at issue may fall under section 2(3) which permits the disclosure of contact information where it relates to an individual in a “business, professional or official capacity.”

[26]  In the circumstances of this appeal, I find that there is insufficient evidence for me to conclude that the request was made by the affected party in a professional or business capacity and that the information at issue appears in a professional or business context. Unlike the circumstances which gave rise to Order PO-2764, in the current appeal the information at issue, on its face, appears to be the affected party’s personal information. The address and telephone numbers provided do not relate to a business or professional organization. In addition, in the circumstances, I am not satisfied that either the nature of the requested information or the affected party’s failure to explain why the information was requested amounts to sufficient evidence to establish that the information at issue is professional or business information.

[27]  Based on the information before me, I find that the request was made in the affected party’s personal capacity and not in a professional or business capacity. I have reviewed the information at issue and I am satisfied that the affected party’s name, address, telephone numbers and signature, as they appear on the access request form, qualify as their personal information as contemplated by paragraphs (d) and (h) of the definition of “personal information” set out section 2(1)  of the Act . The affected party’s address and telephone numbers amount to personal information as specifically contemplated by paragraph (d) and, in my view, as found in prior orders issued by this office, [9] disclosing the affected party’s name and/or signature as they appear on the access request form would reveal the fact that they made a request under the Act , which can be said to amount to “other personal information” about them as contemplated by paragraph (h).

[28]  Additionally, for reasons that will be discussed in more detail below, I accept that in the case of an access request filed by an individual in their personal capacity, the contact portion of that access request form was submitted in a context where there was an implicit expectation of confidentiality as contemplated by paragraph (f) of the definition of “personal information.”

[29]  Accordingly, I find that the information at issue qualifies as the affected party’s “personal information” as defined in section 2(1)  of the Act .

B. Does the mandatory exemption at section 21(1) apply to the information at issue?

[30]  Where a requester seeks personal information of another individual, section 21(1) prohibits an institution from releasing this information unless one of the exceptions in paragraphs (a) to (f) of section 21(1) applies.

[31]  If the information fits within any of paragraphs (a) to (f) of section 21(1), it is not exempt from disclosure under section 21. The section 21(1)(a) to (e) exceptions are relatively straightforward. The section 21(1)(f) exception, allowing disclosure if it would not be an unjustified invasion of personal privacy, is more complex, and requires a consideration of additional parts of section 21. In the circumstances of this appeal, the only paragraph in section 21(1) that could apply is (f). It states:

A head shall refuse to disclose personal information to any person other than the individual to whom the information relates except,

…

if the disclosure does not constitute an unjustified invasion of personal privacy.

[32]  In order for the section 21(1)(f) exception to the mandatory exemption in section 21(1) to apply, it must be established that disclosure would not be an unjustified invasion of personal privacy. The factors and presumptions in section 21(2), (3) and (4) assist in making this determination.

[33]  If any of paragraphs (a) to (h) of section 21(3) apply, disclosure of the information is presumed to be an unjustified invasion of personal privacy under section 21. Once established, a presumed unjustified invasion of personal privacy under section 21(3) can only be overcome if section 21(4) or the “public interest override” at section 23 applies. [10] In the present appeal, the hospital does not rely upon any of the presumptions in section 21(3), and none would apply.

[34]  If any of paragraphs (a) to (c) of section 21(4) apply, disclosure is not an unjustified invasion of personal privacy and the information is not exempt under section 21. In my view, section 21(4) is not applicable in the present appeal. Additionally, there is no evidence that the “compelling public interest” override at section 23 applies to the information at issue in this appeal.

[35]  If no section 21(3) presumption applies, section 21(2) lists various factors that may be relevant in determining whether disclosure of personal information would constitute an unjustified invasion of personal privacy. [11] The list of factors under section 21(2) is not exhaustive. The institution must also consider any circumstances that are relevant, even if they are not listed under section 21(2). [12] The hospital takes the position that the factors at sections 21(2)(d) and (h) are relevant in the circumstances of this appeal. The appellant does not make submissions on whether any factors in section 21(2) might apply.

[36]  Sections 21(2)(d) and (h) state:

A head, in determining whether a disclosure of personal information constitutes an unjustified invasion of personal privacy, shall consider all the relevant circumstances, including whether,

(d)  the personal information is relevant to a fair determination of rights affecting the person who made the request;

…

(h)  the personal information has been supplied by the individual to whom the information relates in confidence;

Section 21(2)(d) – fair determination of rights

[37]  The hospital submits that the factor at section 21(2)(d) is relevant because the appellant has a right to request access to information under the Act . If this factor applies, it weighs in favour of disclosure of the personal information.

[38]  For section 21(2)(d) to apply, previous orders have stated that the appellant must establish that:

(1)  the right in question is a legal right which is drawn from the concepts of common law or statute law, as opposed to a non-legal right based solely on moral or ethical grounds; and

(2)  the right is related to a proceeding which is either existing or contemplated, not one which has already been completed; and

(3)  the personal information which the appellant is seeking access to has some bearing on or is significant to the determination of the right in question; and

(4)  the personal information is required in order to prepare for the proceeding or to ensure an impartial hearing. [13]

[39]  In the circumstances of this appeal, I have been provided with insufficient evidence to conclude that the factor at section 21(2)(d) applies. The appellant has not established any of the requisite criteria set out above. Therefore, I find that the factor at section 21(2)(d) is not relevant to my consideration of whether, in the circumstances of this appeal, disclosure of the information at issue would be an unjustified invasion of the affected party’s personal privacy.

Section 21(2)(h) – information supplied in confidence

[40]  The hospital submits that the factor at section 21(2)(h), weighing against disclosure of the personal information at issue, is relevant in the circumstances of this appeal. It submits that the affected party submitted the access request with a reasonable expectation of confidence and should “be able to rely upon the fact that, absent unusual circumstances, the hospital would protect against the disclosure of any personal information listed therein.” The hospital submits that previous decisions of this office have found that an access request is supplied with an expectation of confidence: Privacy Complaint Reports MC-040012-1, MC-05005-1, MC050034-I and Order PO-1998.

[41]  The hospital refers to this office’s Practice Direction 16: Maintaining the Confidentiality of Requesters and Privacy Complainants which states under the heading “Employees’ Obligations”:

Any employee who assists the Co-ordinator in responding to requests for personal information should be reminded that all information about the requester’s identity and the request should remain confidential.

[42]  The hospital also refers to Order PO-1998 in which former Assistant Commissioner Mitchinson referred to and cited former Commissioner Ann Cavoukian’s comment in the 2000 Annual Report that it “is not acceptable … to routinely identify the requester…” and found that “[e]xcept in unusual circumstances, there is no need for requesters to be identified because their identity is irrelevant.”

[43]  Referring again to this office’s 2000 Annual Report, the hospital submits that in not disclosing the affected party’s identity it was guided by the following statement found on page 4 of that report:

A basic premise underlying the operation of all freedom of information schemes is that the identity of a requester should only be disclosed within an institution on a “need to know” basis. Requiring individuals to demonstrate a need for information or explain why they are submitting a request would erect an unwarranted barrier to access.

[44]  Finally, the hospital reiterates its position that the factor at section 21(2)(h) is relevant and weighs against the disclosure of the information, as the affected party would have submitted the information with an expectation of confidence. The hospital also submits that there are no unusual circumstances surrounding the request that would merit the disclosure of the affected party’s personal information.

[45]  I agree with the hospital’s position that in the context of the submission of an access to information request, a requester such as the affected party would have a reasonably held expectation that any personal information that they supplied as a requester would be subject to a degree of confidentiality and not disclosed to third parties. Accordingly, I find that the factor at section 21(2)(h) is a relevant consideration carrying significant weight in favour of protecting the privacy of the affected party by withholding their personal information.

Conclusion

[46]  Where a record contains the personal information of an individual other than the appellant, the only way that the personal information can be disclosed is if its disclosure would not amount to an unjustified invasion of the personal privacy of the individual to whom it relates. I have found that none of the presumptions at section 21(3) apply, that none of the exceptions in section 21(4) apply, and that, as a “compelling public interest” in the disclosure of the personal information does not exist, the override at section 23 does not apply.

[47]  Additionally, I have considered the possible application of the factors in section 21(2) weighing both in favour and against the disclosure of the personal information. Based on the information before me, the parties’ representations, and the record itself, I have found that the only factor that applies is the factor weighing against disclosure listed at section 21(2)(h). In my view, requesters such as the affected party who make access to information requests to institutions, have an expectation that their personal information will not be disclosed to third parties. In the absence of sufficient evidence to support any factor favouring disclosure, I find that the exception at section 21(1)(f) does not apply, and the disclosure of the personal information at issue would constitute an unjustified invasion of the affected party’s personal privacy.

[48]  Accordingly, I find that the mandatory exemption at section 21(1)  of the Act  applies and that the portions of the record at issue are exempt from disclosure.

ORDER:

I uphold the hospital’s decision and dismiss the appeal.

Original Signed by:		November 27, 2015
Catherine Corban
Adjudicator