INTERIM ORDER PO-3612-I

Appeal PA13-441

Ministry of Community and Social Services

May 31, 2016

Summary: There are two issues in this appeal. The first is whether records responsive to the appellant’s request are in the custody or control of the Ministry of Community and Social Services (the ministry). The second issue is whether the ministry’s search for responsive records was reasonable. In this interim order, the adjudicator finds that two personal emails of staff are not in the ministry’s custody or control, but that other records known as card holder activity reports are. In addition, the adjudicator does not uphold the ministry’s search for records as being reasonable and orders the ministry to conduct a further search for responsive records. The ministry is also ordered issue a decision letter to the appellant regarding the card holder activity reports.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, sections 10(1) and 24.

Orders and Investigation Reports Considered: Order MO-2993.

Cases Considered: City of Ottawa v. Ontario, 2010 ONSC 6835.

OVERVIEW:

[1]  This interim order disposes of most of the issues raised as a result of an appeal of a decision made by the Ministry of Community and Social Services (the ministry) in response to the requester’s access request under the Freedom of Information and Protection of Privacy Act  (the Act ). The request was for access to information from a specific Ontario Disability Support Program (ODSP) office, as follows:

• Two email’s sent between named employees with particular subject lines [1] ;
• All non-work related emails between three named employees during a specified time period [2] ;
• An email sent from a named employee to a named manager regarding a particular subject on a specified date; [3] and
• Separate cost estimates for access to both hard copy and electronic versions of the “Card Holder Activity Report” over a specified time period. [4]

[2]  In the first of three decision letters issued to the requester, the ministry advised him that access to items 1 through 4 was denied, claiming the application of the mandatory exemption in section 21(1) (personal privacy) of the Act .

[3]  Concerning item 5, the ministry advised the requester that it would sever the card-holder names and card numbers from the card holder activity reports. The ministry also referred to a previous access request for a similar activity report that the requester had made, and noted that the names of the card holders was withheld at that time. The ministry also advised the requester that if he wished to proceed with access to item 5, he should contact the ministry to advise it, in order to obtain a fee estimate.

[4]  The ministry subsequently issued a fee estimate to the requester regarding item 5. In turn, the requester (now the appellant) appealed the ministry’s decisions to this office.

[5]  During the mediation of the appeal, the ministry issued a revised decision letter to the appellant, explicitly advising that this letter was a revision of the two previous decision letters. In its revised decision, the ministry stated:

Items 1 and 2

A thorough search was undertaken. These two emails are private communications between employees and are unrelated to government business. As such, it has been determined that these records are not in the custody and control of the government and therefore access is denied.

Items 3 and 4

A thorough search was undertaken and no records were found.

Items 5 and 6

A thorough search was undertaken and it was determined that this information is not in the custody and control of the government and therefore access is denied. Furthermore, after careful analysis, it has been determined that these Card Holder Activity Reports are not considered records under the Act .

[6]  The appellant advised the mediator that he wished to appeal the ministry’s revised decision, and that items 3 and 4 should exist. Consequently, reasonable search was added as an issue in the appeal.

[7]  The appeal then moved to the adjudication stage of the appeals process, where an adjudicator conducts an inquiry. In its representations, the ministry advised that it is no longer taking the position that the card holder activity reports do not constitute “records” within the meaning of the Act .

[8]  For the reasons that follow, I find that the two emails, referred to as items 1 and 2 are not in the ministry’s custody or control. Conversely, I find that the card holder activity reports (items 5 and 6) are in the ministry’s custody or control. In addition, I do not uphold the ministry’s search for items 3 and 4 as being reasonable. I order the ministry to issue a decision letter to the appellant regarding items 5 and 6 and to conduct a further search for items 3 and 4.

RECORDS:

[9]  The records consist of specified emails between ODSP employees, and a hard copy and electronic copy of card holder activity reports.

ISSUES:

1. Are the records “in the custody” or “under the control” of the ministry under section 10(1)?
2. Did the ministry conduct a reasonable search for records?

DISCUSSION:

Issue A: Are the records “in the custody” or “under the control” of the ministry under section 10(1)?

[10]  The ministry claims that the emails referred to as items 1 and 2, as well as the card holder activity reports, referred to as items 5 and 6, are not in the ministry’s custody or control. Under section 10(1) , the Act  applies only to records that are in the custody or under the control of an institution. A record will be subject to the Act  if it is in the custody or under the control of an institution; it need not be both. [5]

[11]  Section 10(1) states, in part:

Every person has a right of access to a record or a part of a record in the custody or under the control of an institution unless . . .

[12]  A finding that a record is in the custody or control of an institution does not necessarily mean that a requester will be provided access to it. [6] A record within an institution’s custody or control may be excluded from the application of the Act under one of the provisions in section 65, or may be subject to a mandatory or discretionary exemption (found at sections 12 through 22 and section 49). The courts and this office have applied a broad and liberal approach to the custody or control question. [7]

[13]  Based on the above approach, this office has developed a list of factors to consider in determining whether or not a record is in the custody or control of an institution, as follows. [8] The list is not intended to be exhaustive. Some of the listed factors may not apply in a specific case, while other unlisted factors may apply. Factors to consider include:

• Was the record created by an officer or employee of the institution? [9]
• What use did the creator intend to make of the record? [10]
• Does the institution have a statutory power or duty to carry out the activity that resulted in the creation of the record? [11]
• Is the activity in question a core, central or basic function of the institution? [12]
• Does the content of the record relate to the institution’s mandate and functions? [13]
• Does the institution have physical possession of the record, either because it has been voluntarily provided by the creator or pursuant to a mandatory statutory or employment requirement? [14]
• If the institution does have possession of the record, is it more than bare possession? [15]
• Does the institution have a right to possession of the record? [16]
• Does the institution have the authority to regulate the record’s content, use and disposal? [17]
• Are there limits on the use to which the institution may put the record, what are those limits, and why do they apply to the record? [18]
• To what extent has the institution relied upon the record? [19]
• How closely is the record integrated with other records held by the institution? [20] and
• What is the customary practice of the institution and institutions similar to the institution in relation to possession or control of records of this nature, in similar circumstances? [21]

Items 1 and 2 – emails

[14]  The ministry submits that the two emails at issue are the personal emails of ministry employees and do not relate to the ministry’s mandate or functions. In particular, the ministry argues that:

• • The records were distributed by ministry employees but it does not appear that they were created by them;

• • The ministry has no statutory power or duty to carry out any activity that resulted in the creation of the emails;

• • There is no connection between the emails and any ministry function, let alone any that could be considered core, central or basic to its function. The content of the emails has no relation to the ministry’s mandate;

• • The ministry’s possession of the emails is bare possession, because it has no responsibility for the care and protection of them, and the emails were not created pursuant to any statutory requirement or in relation to any service delivery;

• • The emails do not form part of the ministry’s records, nor do they constitute public records within the meaning of the Archives and Recordkeeping Act 2006  [22] because they were not made or received by the ministry in carrying out the ministry’s activities; and

• • The employees could have forwarded the emails via another email address, but chose to use their ministry accounts out of convenience. The fact that they used the ministry’s email server is not sufficient to bring these emails with the ambit of the Act .

[15]  The ministry also submits that the decision of the Divisional Court in City of Ottawa v. Ontario [23] is applicable. In that decision, the ministry states, the Court determined that when a municipal employee used his workplace email address to send and receive personal emails completely unrelated to his work, those emails did not fall within the scope of the Act . The ministry goes on to state that the monitoring of the email system by the City of Ottawa was not sufficient to give it control of the records. [24]

[16]  The ministry argues that the circumstances in the City of Ottawa case are the same as those in this appeal, and that the findings of the Divisional Court are equally applicable to the emails at issue.

[17]  The appellant submits that the ministry’s Acceptable Use of I & IT Resources guideline states that nothing in emails is off the record, and that all emails using the government email accounts are government property and may be accessed through, for example, freedom of information legislation. The appellant also argues that the content of the emails at issue is related to a ministry function, which is to eliminate poisoned work environments.

Analysis and findings

[18]  Generally speaking, records of ministry employees are subject to the Act , and subject to the exemptions enumerated in the Act . [25] However, I find that, applying the factors of custody or control developed by this office and the courts, the two emails at issue are not in the ministry’s custody or control. In my view, the emails do not relate to the ministry’s mandate and functions, they were not created pursuant to any statutory requirement or in relation to any service delivery, and there is no evidence that the ministry has used or relied on these emails.

[19]  Item 1 is an email that was received by a ministry employee from an unknown individual (with a non-ministry email address). The employee then forwarded the email to another ministry employee. Item 2 is also an email, which was sent from one ministry employee to four others and then forwarded on to a fifth employee. In both cases, the emails contain personal content that is not related to the work of the ministry.

[20]  In City of Ottawa, the Divisional Court found that when a government employee uses his or her workplace email address to send and receive personal emails completely unrelated to his or her work, those emails are not in the custody and control of the institution and, therefore do not fall within the scope of the Act . Justice Molloy, speaking for the panel, stated:

Much will depend on the individual circumstances of each case, but generally speaking, I would expect very few employee emails that are personal in nature and unrelated to government affairs to be subject to the legislation merely because they were sent or received on the email server of an institution subject to the Act .

[21]  I find that the emails at issue are comparable to the type of records that the Divisional Court found were not in the custody of the city in City of Ottawa, [26] which was subsequently followed by Assistant Commissioner Sherry Liang in Order MO-2993.

[22]  In coming to this conclusion, I have considered the appellant’s arguments referencing the ministry’s Acceptable Use of Information & Information Technology Resources Guidelines. This policy addresses Unacceptable Use of IT and IT Resources.

[23]  That portion of the policy identifies that it deals with the Unacceptable Use of Government Email and describes its scope as including using government resources for sending, receiving, viewing and storing unacceptable emails and attachments. A number of bullet points are listed under the Rationale/Warning portion of this page, and these include: that messages and attachments must not contribute to the creation of a poisoned work environment; that simply receiving offensive emails and deleting them can be a violation of the Workplace Discrimination and Harassment Prevention Policy (WDHP); that nothing is off the record and all emails are government property and may be accessed – e.g.: under freedom of information legislation; and that when inappropriate emails are sent, they will bear the address of the OPS and their ultimate destinations cannot be controlled. Also included in this page of the policy is a list of examples of unacceptable uses.

[24]  I have considered the appellant’s argument that this policy, which identifies that nothing in emails is off the record and that all emails are government property and may be accessed, means that all emails are in the custody and control of the ministry for the purposes of the Act . I do not accept this blanket statement. As noted above, this office has developed a list of factors to consider in determining whether or not a record is in the custody or control of an institution. All factors must be considered and an institution’s statement in a policy regarding whether it has or does not have custody or control of a record does not necessarily make it so. Although I agree that the existence of this policy is one factor favouring a finding that the ministry has custody or control of the record, it is simply one factor.

[25]  I also note that a policy governing the acceptable use of emails was also present in the City of Ottawa decision referenced above, where the Court determined that the city did not have custody or control of records notwithstanding a city policy establishing that electronic information and IT assets remain the property of the City. The Court stated:

. . . Understandably, employers who allow employees to use their electronic servers for personal matters will typically have policies to ensure that these electronic media are not being used in a manner that is inappropriate or illegal or that compromises the security of the entire system.

. . .

It was the City’s policy with respect to the management of its IT services that led the Arbitrator to find that the personal emails of [named employee] were actually in the custody of the City. The Arbitrator held that the policy meant the City: (1) had physical possession and the right to possession of the emails; and (2) the City had the authority to regulate the use and disposal of the records on its system. In my view, those factors are not determinative of control given the purpose for which the City retained the right to monitor its system, as contrasted to the underlying purpose of freedom of information legislation.

Employers from time to time may also need to access a filing cabinet containing an employee’s personal files. That does not make the personal files of the employee subject to disclosure to the general public on the basis that the employer has some measure of control over them. The nature of electronically stored files makes the need for monitoring more pressing and the actual monitoring more frequent, but it does not change the nature of the documents, nor the nature of the City’s conduct in relation to them. It does not, in my view, constitute custody by the City, within the meaning of the Act .

[26]  I also note that Assistant Commissioner Liang in Order MO-2993 considered the impact of a policy establishing that a city employee’s personal records, created on the city’s IT resources, became part of the city’s record-holdings for the purposes of the Act . She found that this did not establish that the records at issue before her were in the city’s custody or control. In doing so, she referred to the findings of the Divisional Court in City of Ottawa, and then stated:

With respect to [the argument that if the records were created using the city’s resources, they should be subject to the Act ], I find that it conflates the city’s interests in ensuring appropriate use of its resources, with the city’s interests and responsibilities in responding to an access to information request. The appellant has referred to the appearance that the Mayor has used city resources to further personal and professional interests, and argues that if taxpayers have, in a sense, subsidized the creation of records, albeit about a personal matter, the records should be covered by the Act . If the appellant is concerned that the activities of the Mayor in connection with Ford Fest raise issues of conflict of interest or appropriate use of the city’s IT resources, the remedy is found in the city’s processes and procedures for dealing with such matters. The possibility of such conduct does not lead to a conclusion that the records are therefore city records for the purpose of the Act , when the criteria for a finding of custody or control do not otherwise support such a conclusion.

[27]  Adopting the approach taken by the Divisional Court and MO-2993, and on my review of the factors to consider in determining custody and control, I find that the two emails are not in the custody or control of the ministry for the purpose of the Act .

[28]  Lastly, I have considered the appellant’s argument that part of the ministry’s function is to prevent and address poisoned work environments. I note that the Acceptable Use of Information & Information Technology Resources Guidelines refers to the ministry’s Workplace Discrimination and Harassment Prevention Policy. Policies and guidelines such as those are clearly created to govern appropriate use of workplace resources, and presumably establish procedures to follow and possible sanctions in the event that they are breached. The ministry provided the emails at issue to this office in the course of this appeal, and the ministry is clearly aware of the content of the emails. It is in the position to determine whether the content of the emails is appropriate or not, contributes to a poisoned work environment, or is otherwise in breach of any policies that exist. If the records are used by the ministry for disciplinary or other purposes, this may affect the ministry’s custody or control of those records; however, I have no evidence establishing that these email records were used by the ministry for any purpose.

[29]  After considering all of the factors, I find that the two emails at issue are not in the custody or control of the ministry for the purpose of the Act .

Items 5 and 6 – card holder activity reports

[30]  The ministry advises that the card holder activity reports (the activity reports) capture the date and time when an individual has entered a specified ODSP office, using an entry card. The activity reports do not capture the time when an individual has left the office.

[31]  The ministry submits that the activity reports are not in the ministry’s custody or control, and that its possession of these records constitutes only bare possession. The ministry submits that the following factors are relevant and should be taken into consideration:

• • Although the activity reports are accessed by ministry staff, this is done so only where necessary to respond to a security incident, where it is necessary to determine which staff had accessed the office;

• • The ministry does not have a statutory duty to carry out the activity that resulted in the creation of the record; rather this is an administrative record used for security purposes;

• • The activity in question (security purposes) does not constitute a core, central or basic function of the institution, nor does it relate to the institution’s mandate or functions;

• • The content of the records does not relate to the ministry’s mandate and functions, and are not generated in relation to any decision making or service delivery to the ODSP; and

• • The ministry has not relied upon the record in any way; it was generated only to respond to the current access request.

[32]  Further, the ministry states that decision in City of Ottawa is equally applicable to the activity reports. It argues that the animating purpose of the Act  is to further democratic values by providing its citizens with access to government information, but that this purpose is not engaged in the context of this request. It goes on to argue that the information in the activity reports is not politically relevant information and, therefore, falls outside the scope of the Act . The ministry reiterates that the activity reports are maintained for security purposes. As previously stated, the activity reports only capture when individuals entered the office, not when they left. [27]

[33]  Lastly, the ministry discusses the first part of the two-part test enumerated by the Supreme Court of Canada in Canada (Information Commissioner) v. Canada (Minister of National Defence) [28] to determine whether records were in the control under the federal  Access   to Information Act . The Court set out the first part of test, stating:

Step one of the test acts as a useful screening device. It asks whether the record relates to a departmental matter. If it does not, that indeed ends the inquiry. The Commissioner agrees that the Access to Information Act  is not intended to capture non-departmental matters in the possession of Ministers of the Crown. If the record requested relates to a departmental matter, the inquiry into control continues. [29]

[34]  Finally, the ministry argues that the activity reports do not relate to a departmental matter, as contemplated in National Defence.

[35]  The appellant submits that the activity reports are used for more than simply responding to security incidents, such as: facilitating workplace health and safety; determining when staff members are at work; and monitoring compliance with proper service delivery to ODSP clients. The appellant goes on to argue that the activity reports comprise a collection of data that can be analyzed in different contexts, and that the context gives meaning to, and defines the usefulness of, these records.

[36]  Lastly, the appellant’s position is that the activity reports contribute to his ability to participate in the democratic process. He states that they provide valuable insights into the accountability of government employees, which is politically relevant information.

Analysis and findings

[37]  Unlike the personal emails that I have found are not in the ministry’s custody or control, I find that the activity reports are. The ministry submits that the activity reports are merely administrative records used solely for security purposes and that, consequently, it only has bare possession of these records. The ministry goes on to argue that the activity that resulted in the creation of the records (security) is not a core, central or basic function, or part of its statutory duty. The ministry also submits that the records do not relate to its mandate and functions, or to any decision making or service delivery, and that it has not relied on the record in any way, other than to respond to this access request. I disagree, and I find that the activity reports are in the custody and control of the ministry.

[38]  The ministry acknowledges that the activity reports are accessed by ministry staff where it is necessary to determine, for security purposes, which staff had accessed the office. In my view, the maintenance of the security of the office which employs ministry staff carrying out a government program (the ODSP), and which presumably houses client files (hard copy or electronic) and equipment used to deliver that program, is part of the ministry’s mandate and function. In other words, the ministry’s oversight of the security of the office, including having a record of when staff members enter the building, is part of its basic function and mandate.

[39]  The fact that the activity reports may be administrative in nature does not change the fact that they are used by the ministry and for the ministry as part of its service delivery function, and would also be relied upon by the ministry in the event of a breach of the office’s security. There are likely various types of administrative records which are not created by the ministry as a result of any statutory duty, but as part of its day-to-day operations. To suggest that these types of administrative records are not part of the ministry’s mandate or function and therefore not in the custody and control of the ministry is too broad an interpretation. Such an interpretation is not in keeping with the spirit of the Act , which is that government records should be available to the public, subject to the exemptions and exceptions set out in it.

[40]  I also do not accept the ministry’s argument that the decision in City of Ottawa is applicable to the activity reports. That case is distinguishable because the records at issue on which that decision was based were, as previously discussed, the personal emails of a government staff. The activity reports are of a completely different nature and are related to the ministry’s work at this office. These records capture the date, time and location of entry of staff members who have entered the ODSP office and are, according to the ministry, used for security purposes. I also reject the ministry’s position that the content of the activity reports is not politically relevant information and therefore must fall outside the scope of the Act . [30] As stated by the ministry, the Divisional Court found in City of Ottawa that the animating purpose of the Act  is to further democratic values by providing requesters with access to government information. These activity reports consist of government information because they capture the entry time of staff on a day-to-day basis and relevant information in the event of a security breach, which speaks to government security. This information, in my view, could be used to further democratic values.

[41]  The ministry also raised the application of the first part of the two-part test in National Defence, arguing that the activity reports do not relate to a departmental matter and are therefore not in its custody or control. In my view, records showing when individuals are entering a ministry office relate to the security of that office, and I find that this type of information is a departmental matter. Departmental matters can encompass all aspects of the delivery of a program, including office security.

[42]  Consequently, for the reasons cited above, I find that the activity reports (items 5 and 6) are within the ministry’s custody and control. Accordingly, I order the ministry to issue a decision letter to the appellant with respect to these records.

Issue B: Did the ministry conduct a reasonable search for records?

[43]  Where a requester claims that additional records exist beyond those identified by the institution, the issue to be decided is whether the institution had conducted a reasonable search for records as required by section 24. [31] If I am satisfied that the search carried out was reasonable in the circumstances, I will uphold the institution’s decision. If I am not satisfied, I may order further searches.

[44]  The Act  does not require the institution to prove with absolute certainty that further records do not exist. However, the institution must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. [32] To be responsive, a record must be “reasonably related” to the request. [33] A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records which are reasonably related to the request. [34] A further search will be ordered if the institution does not provide sufficient evidence to demonstrate that it has made a reasonable effort to identify and locate all of the responsive records within its custody or control. [35]

[45]  Although a requester will rarely be in a position to indicate precisely which records the institution has not identified, the requester still must provide a reasonable basis for concluding that such records exist. [36]

[46]  The ministry submits that the searches for items 3 and 4 were carried out by the employees alleged by the appellant to have authored or received the responsive emails, and that the search included a search of the relevant email folders, as well as archived emails. The ministry also provided a sworn affidavit as part of its evidence regarding the issue of search.

[47]  The affiant, the Freedom of Information lead for the relevant region, swears that items 3 and 4 could not be located. In regard to the search conducted, the affiant states that the following steps were taken:

• • Given the specificity of the request, the ministry determined that there was no need to clarify the request. The appellant had named the specific employees, specific dates and subject matter of the emails in his request;

• • Employee 1 spent 40 minutes searching her email folders for responsive records during the specified time period. [37] Her search included all archived and sent emails. No responsive records were located; and

• • Employee 2 spent approximately 2.5 hours searching her emails for responsive records based on the dates provided by the appellant and using keywords that were included in the appellant’s request. [38] The search included sent emails, deleted emails and archived emails. No responsive records were located.

[48]  The appellant submits that two employees received an inappropriate email from Employee 1. The appellant further submits that the ministry’s search was unreasonable as Employee 1 was the only person who searched for this email and it is unlikely that she would turn over an inappropriate email to the ministry.

[49]  With respect to the second email involving Employee 2, the appellant submits that the search was unreasonable because Employee 2 sent the email to a manager, yet the manager’s emails were not searched.

Analysis and findings

[50]  As previously stated, a reasonable search is one in which an experienced employee expends a reasonable amount of effort to locate records which are reasonably related to the request. [39] Based on the ministry’s representations, I am satisfied that the searches conducted by Employee 1 and 2 were reasonable. Given that the subject matter of the appellant’s request was for specific emails allegedly sent by Employees 1 and 2 to other employees, I am satisfied that the nature of the searches, which was for their emails, was reasonable. I am also satisfied with the extent of the searches; in particular, that searches were conducted in various email folders, including archived emails.

[51]  However, given that the emails were allegedly sent by Employees 1 and 2 to other named employees, I am not satisfied that the totality of the ministry’s search for responsive records was reasonable. In my view, the other three employees, one of whom is a manager, should have also been asked to conduct a search for records responsive to the request, which all the parties acknowledge was very specific. The ministry has not provided a reason why these three employees were not each asked to conduct a search for responsive records. Accordingly, I do not uphold the ministry’s search as being reasonable and I will order the ministry to conduct another search for items 3 and 4, focusing on the three employees referred to above.

ORDER:

1. I find that the ministry does not have custody or control of the records listed as items 1 and 2.
2. I find that the ministry has custody or control of the records listed as items 5 and 6 and I order the ministry to issue a decision letter to the appellant with respect to these records, treating the date of the order as the date of the request.
3. I do not uphold the ministry’s search for records listed as items 3 and 4. I order the ministry to conduct a further search for those records by June 30, 2016. The ministry is to search the ministry-issued email folders of the three employees referred to in the order. If the further searches yield responsive records, I order the ministry to issue a decision letter to the appellant. If the further searches do not yield responsive records, I order the ministry to provide the appellant with a written explanation of the searches conducted.
4. I order the ministry to provide this office with representations detailing the searches ordered conducted in order provision 3 by July 6, 2016.
5. I remain seized of the issues in this appeal.

Original Signed by:		May 31, 2016
Cathy Hamilton
Adjudicator