ORDER PO-3902

Appeal PA16-92-2

Algoma University

November 22, 2018

Summary: The university received a request under the Freedom of Information and Protection of Privacy Act  (the Act ) for access to emails pertaining to the requester for a specified period. The university granted access, in part, and relied on the personal privacy exemptions at sections 21(1) and 49(b) and the mandatory third party information exemption at section 17(1)  of the Act  to withhold some information. During the inquiry, the appellant advised that he was no longer interested in the information withheld under section 17(1). In this order, the adjudicator upholds the university’s decision with respect to the personal privacy exemptions, in part, and orders disclosure of the non-exempt information. She upholds the university’s search for records as reasonable.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, sections 2(1) (definition of “personal information”), 21, 24, and 49(b).

Orders and Investigation Reports Considered: Orders PO-2858-I and PO-3894.

BACKGROUND:

[1]  Algoma University (the university) received a request from a former employee under the Freedom of Information and Protection of Privacy Act  (the Act ) for access to all (electronic and written) documents, communications, emails, correspondence, notes and minutes of any and all meetings pertaining to the requester between January 1, 2009 and June 1, 2013.

[2]  In response to the request, the university eventually issued a fee estimate in the amount of approximately $32,650.00. The requester filed an appeal and appeal PA13-332-3 was opened to deal with the fee estimate.

[3]  During mediation, the requester narrowed the time frame of his request to the period from June 1, 2011 to June 1, 2013 in an effort to reduce the fee. The university issued a revised decision and the fee was reduced to $14,724.50. Mediation did not resolve the issues and the appeal proceeded to adjudication, resulting in Order PO-3537 being issued. In that order, the adjudicator reduced the fee estimate to $1,260.00, excluding photocopying costs. The adjudicator allowed the following fees:

• IT time to search for and extract the emails – 21 hours at $30.00 per hour, totaling $630.00
• Manual search time for records to 21 hours at $30.00 per hour, totaling $630.00

[4]  Following this order, the requester amended his request, which is outlined below:

I would like to amend my request to only include the portion regarding ‘the IT time to search for and extract the e-mails – 21 hours at $30.00 per hour, totaling $630.00’, as indicated in the Adjudicator’s ‘Summary of Findings’.

Furthermore, I am requesting electronic copies only of these documents.

[5]  As no decision was issued within 30 days of the amended request, the requester filed a deemed refusal appeal and PA16-92 was opened to deal with this matter. Following receipt of the notice of inquiry, the university then issued an access decision.

[6]  In its decision, the university granted partial access to some of the records, while exemptions were claimed for the balance of the records, pursuant to the exemptions for mandatory third party information at section 17(1), economic and other interests at section 18(1), solicitor-client privilege at section 19 and the mandatory personal privacy exemption at section 21(1)  of the Act .

[7]  The requester, now the appellant, appealed the decision to this office. Subsequently, this appeal, PA16-92-2, was opened.

[8]  During mediation, the appellant raised the issue of reasonable search as he believes there are emails missing from the records provided to him.

[9]  As a result of the mediation, the university issued a letter dated November 11, 2016 and attached emails that have been severed pursuant to section 21(1)  of the Act . Upon further discussions, the university issued a revised decision and provided further clarification on December 12, 2016. The university indicated that only sections 17  and 21(1)  of the Act  were being claimed for the withheld parts in the records. The university was no longer relying upon sections 18  and 19  of the Act  as previously indicated in its original decision.

[10]  As further mediation was not possible, the appeal was moved to the adjudication stage of the appeal process, where an adjudicator conducts an inquiry under the Act .

[11]  I sought and received representations from the university and the appellant. Pursuant to this office’s Code of Procedure and Practice Direction Number 7, non-confidential copies of the parties’ representation were shared. [1]

[12]  In this order, I uphold the university’s decision with respect to the personal privacy exemptions, in part, and order it to disclose the non-exempt information to the appellant. I find that the university has conducted a reasonable search for records and I uphold its search.

RECORDS:

[13]  The records at issue consist of email chains (including duplicates) between June 1, 2011 and June 1, 2013. The university has numbered the pages of the collection of email chains from 1 to 406.

[14]  The university has severed the top left portions of the email chains in which it indicates the name of the person who printed the email. As the name of this individual is not relevant to the appellant’s request, I find these portions to be not responsive to the request.

[15]  During the inquiry, the appellant advised that he is not interested in pursuing the withheld portions of the records in which the university is relying on the mandatory third party information exemption. As such, section 17(1) is no longer an issue in this appeal. These withheld portions are now considered not responsive to the request. [2]

ISSUES:

1. Do the records contain “personal information” as defined in section 2(1) and, if so, to whom do they relate?
2. Does the mandatory exemption at section 21(1) or the discretionary exemption at section 49(b) apply to the information at issue?
3. Did the university exercise its discretion under section 49(b)? If so, should this office uphold the exercise of discretion?
4. Did the university conduct a reasonable search for records?

DISCUSSION:

Preliminary Issue

[16]  In his sur-reply representations, the appellant argued that none of the emails sent to his former work email account after he left the employ of the university is under the custody or control of the university.

[17]  The appellant is clearly of the view that the university ought not to have left his email account open after his departure. The appellant’s concerns in this regard were addressed in his previous privacy complaint made to this office. However, his reasons for raising this issue in the context of this access appeal are not clear, since under section 10(1)  of the Act , he is only entitled to access the records if they are in the custody or control of the university. The university did not take the position that these emails are not in its custody or control.

[18]  If the appellant’s concern is that he had to pay for search time for emails that he believes are not in the university’s custody or control, I note only eight email chains were sent to the appellant’s former work email account after his departure date. In my view, this small number of emails would not have had any impact on the time spent by the university in its search for emails.

A:  Do the records contain “personal information” as defined in section 2(1) and, if so, to whom does it relate?

[19]  In order to determine which sections of the Act  may apply, it is necessary to decide whether the records contain “personal information” and, if so, to whom they relate. That term is defined in section 2(1) as follows:

“personal information” means recorded information about an identifiable individual, including,

 (a)  information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

 (b)  information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

 (c)  any identifying number, symbol or other particular assigned to the individual,

 (d)  the address, telephone number, fingerprints or blood type of the individual,

 (e)  the personal opinions or views of the individual except if they relate to another individual,

 (f)  correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

 (g)  the views or opinions of another individual about the individual, and

 (h)  the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

[20]  The list of examples of personal information under section 2(1) is not exhaustive. Therefore, information that does not fall under paragraphs (a) to (h) may still qualify as personal information. [3]

[21]  Sections 2(2), (3) and (4) also relate to the definition of personal information. These sections state:

(2) Personal information does not include information about an individual who has been dead for more than thirty years.

(3) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

(4) For greater certainty, subsection (3) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling.

[22]  To qualify as personal information, the information must be about the individual in a personal capacity. As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be “about” the individual. [4]

[23]  Even if information relates to an individual in a professional, official or business capacity, it may still qualify as personal information if the information reveals something of a personal nature about the individual. [5]

[24]  To qualify as personal information, it must be reasonable to expect that an individual may be identified if the information is disclosed. [6]

[25]  The university submits that the records contain personal information of both employees and non-employees. More specifically, the university submits there is information about individuals’ employment history or information related to financial transactions in which an individual has been involved.

[26]  The appellant did not make any representations specifically on whether the records contain personal information. He submits that no written consent was provided to use his name or collect information using his name; no written consent was provided for disclosing information that was supplied in confidence to him from third parties, and that there is an unjustified invasion of personal privacy and a risk of harm from disclosed personal information. [7]

Analysis and findings

[27]  On my review of the records, I find that some portions of the withheld information contain “personal information” of identifiable individuals as defined by the Act . These portions contain information about an individual’s name in combination with the person’s address, phone number, family status, employment status and/or education history. They also contain individuals’ finances or information relating to financial transactions in which an individual is involved. As such, I find the withheld information on pages 4, 47, 48, 66, 70, 72, 87, 110, 124, 134, 137, 144, 146, 149, 152, 167, 169, 184, 191, 193, 238, 240, 246, 247, 248, 250, 262, 266, 268, 328, 329, 356, 358, 384, 392, 393, 394, and 395 contains personal information of individuals other than the appellant.

[28]  The university also withheld information on pages 66, 149, 152, 405, and 406 of the records. I find that the withheld information on these pages of the records contains the personal information of both the appellant and other individuals. More specifically, I find that these records contain information pertaining to the appellant and other individuals that qualifies as their personal information within the meaning of paragraphs (a), (b), and (g) of the definition in section 2(1)  of the Act .

[29]  I also find that the withheld information on pages 364 and 388 of the records only contains the personal information of the appellant. Accordingly, I will order the withheld information on these pages disclosed.

[30]  I further find that some of the withheld information consists of information about an individual who has been deceased for more than thirty years. As mentioned above, section 2(2) states that personal information does not include information about an individual who has been dead for more than thirty years. As such, I find that the withheld information about this individual on pages 234, 236, 251, 252, 253, 254, 256, 257, 258, and 259 is not his personal information. Since the personal privacy exemptions at section 21(1) and 49(b) can only apply to personal information, and since the university has not claimed any other exemptions, I will order the withheld information on these pages disclosed.

[31]  On my review, I do not find that the withheld information on pages 59, 79, 104, 105, 107, 108, 137, 149, 152, 155, 159, 191, 193, 203, 219, 222, 236, 251, 252, 253, 254, 256, 257, 258, 259, 261, 264, 265, 272, 281, 287, 288, 306, 330, 336, 339, 341, 346, 367, 384, 388 and 395 consists of personal information as it does not contain information about an identifiable individual. For example, some withheld portions are about the university’s access request to an institution. Accordingly, I will order the withheld information on these pages disclosed.

[32]  As mentioned above, the general rule is that information about an individual in their business, professional or official capacity is not personal information. The rationale is that these individuals are identified in the performance of their employment, professional or official duties, not in their personal capacities. On my review, I find a large portion of the withheld information falls into this category. For example, the records contains individuals’ names, titles, work email addresses, work phone numbers and/or work addresses. As such, I find the withheld information on pages 8, 12, 13, 26, 33, 36, 37, 38, 41, 42, 50, 52, 53, 63, 72, 73, 74, 79, 94, 99, 100, 101, 105, 110, 130, 139, 140, 145, 166, 184, 225, 236, 254, 259, 293, 295, 299, 308, 337, 338, 384, 390, and 391 is not personal information. Accordingly, I will order the withheld information on these pages disclosed.

[33]  I will now turn to consider the application of sections 21(1) and 49(b) to the withheld personal information.

B:  Does the mandatory exemption at section 21(1) or the discretionary exemption at section 49(b) apply to the information at issue?

[34]  Section 47(1)  of the Act  gives individuals a general right of access to their own personal information held by an institution. Section 49 provides a number of exemptions from this right.

[35]  Under section 49(b), where a record contains personal information of both the requester and another individual, and disclosure of the information would be an “unjustified invasion” of the other individual’s personal privacy, the institution may refuse to disclose that information to the requester. Since the section 49(b) exemption is discretionary, the institution may also decide to disclose the information to the requester. [8]

[36]  In contrast, under section 21(1), where a record contains personal information of another individual but not the requester, the institution is prohibited from disclosing that information unless one of the exceptions in sections 21(1)(a) to (e) applies, or unless disclosure would not be an unjustified invasion of personal privacy (section 21(1)(f)).

[37]  In determining whether disclosure of the personal information in the records would not be an unjustified invasion of personal privacy under section 21(1)(f) or would be an unjustified invasion of personal privacy under section 49(b), sections 21(1) to (4) provide guidance.

[38]  The factors and presumptions at sections 21(2) and (3) help in determining whether disclosure would or would not be an unjustified invasion of privacy. Additionally, if any of paragraphs (a) to (c) of section 21(4) apply, disclosure is not an unjustified invasion of personal privacy and the information is not exempt under either section 21(1) or 49(b). None of the circumstances listed in section 21(4) is present here.

Sections 21(2) and (3)

[39]  If any of paragraphs (a) to (h) of section 21(3) apply, disclosure of the information is presumed to be an unjustified invasion of personal privacy.

[40]  For records claimed to be exempt under section 21(1) (i.e. records that do not contain the requester’s personal information), a presumed unjustified invasion of personal privacy under section 21(3) can only be overcome if a section 21(4) exception or the “public interest override” at section 16 of the Act  applies. [9] None of the section 21(4) exceptions is relevant here and the public interest override has not been raised.

[41]  If the record is not covered by a presumption in section 21(3), section 21(2) lists various factors that may be relevant in determining whether disclosure of the personal information would be an unjustified invasion of personal privacy and the information will be exempt unless the circumstances favour disclosure. [10]

[42]  For records claimed to be exempt under section 49(b) (i.e. records that contain the requester’s own personal information), this office will consider, and weigh, the factors and presumptions in both sections 21(2) and (3) and balance the interest of the parties in determining whether disclosure of the personal information in the records would be an unjustified invasion of personal privacy. [11]

Analysis and findings re sections 21(1) and 49(b)

Section 21(1)

[43]  I will first consider the application of the mandatory personal privacy exemption to the withheld information contained on pages 4, 47, 48, 66, 70, 72, 87, 110, 124, 134, 137, 144, 146, 149, 152, 167, 169, 184, 191, 193, 238, 240, 246, 247, 248, 250, 262, 266, 268, 328, 329, 356, 358, 384, 392, 393, 394, and 395 of the records as these records contain personal information of other individuals and not the appellant. As stated earlier, the university is prohibited from disclosing the withheld information on these pages unless one of the circumstances listed in sections 21(1)(a) to (e) applies, or unless disclosure would not be an unjustified invasion of personal privacy (section 21(1)(f)). In this case, sections 21(1)(a) to (e) do not apply to these records.

[44]  To determine whether disclosure of the withheld information on these pages would be an unjustified invasion of personal privacy, I need to consider whether any of the presumptions in section 21(3) applies. If so, the disclosure of the withheld information is presumed to be an unjustified invasion of personal privacy.

[45]  On my review, I find that two of the presumptions listed in section 21(3) apply. The presumption at paragraph 21(3)(d) (relates to employment or educational history) applies to the withheld information on pages 4, 72, 134, 137, 144, 146, 149, 152, 167, 169, 184, 191, 238, 240, 247, 248, 250, 262, 266 and 384. I also find that the presumption at paragraph 21(3)(f) (describes an individual’s finances, income, assets, liabilities, net worth, bank balances, financial history or activities, or creditworthiness) applies to the withheld information on pages 70, 191, 193, 393, 393, 394 and 395. As such, I find that disclosure of the withheld information on these pages are presumed to be an unjustified invasion of the individual’s privacy and is exempt from disclosure under the mandatory privacy exemption at section 21(1)  of the Act . [12]

[46]  The remaining withheld personal information ranges from home phone numbers and addresses to assessments of an individual’s work quality. From my review of the information, and considering the evidence before me, I find that none of the factors weighing in favour of disclosure apply. I find that the factor listed in paragraph 21(2)(f) (the personal information is highly sensitive) applies to some of the information, weighing against the disclosure of the withheld information. Accordingly, I find that the disclosure of the withheld information on these pages would result in an unjustified invasion of personal privacy for the individuals in question. As such, I find that the withheld personal information on these pages is exempt under section 21(1)  of the Act .

Section 49(b)

[47]  As noted above, pages 66, 149, 152, 405 and 406 are found in records which contain the personal information of both the appellant and other individuals. As such, the appropriate personal privacy exemption to consider for this information is that at section 49(b).

[48]  For section 49(b) to apply, the factors weighing against disclosure must outweigh the factors weighing in favour of disclosure. As no factors favouring disclosure have been established nor do they appear to be relevant, it is not necessary for me to consider the relevance of the factors at paragraphs 21(2)(e) to (i) in detail.

[49]  Given that the presumption at paragraph 21(3)(d) (relates to employment or educational history) applies to the personal information on pages 149 and 152, and the fact that no factors favouring disclosure have been established, balancing all the interests, I am satisfied that disclosure of the personal information on these pages would constitute an unjustified invasion of the personal privacy of the individual to whom that information relates.

[50]  With respect to the withheld personal information on page 66 of the record, I find the factor at paragraph 21(2)(f) (the personal information is highly sensitive) to be relevant to it. The personal information on this page contains information about individuals’ dates of birth and their date of marriage. Considering that no factors favouring disclosure have been established, balancing all the interests, I am satisfied that disclosure of the personal information on this page would constitute an unjustified invasion of the personal privacy of the individual to whom that information relates.

[51]  Subject to my review of the university’s exercise of discretion, I find that the withheld personal information on pages 66, 149 and 152 of the records is exempt from disclosure under the discretionary personal privacy exemption at section 49(b).

[52]  With respect to the withheld personal information on pages 405 and 406, I find that the absurd result principle applies to it. This principle states that where the appellant originally supplied the information, or the appellant is otherwise aware of it, the information may not be exempt under section 49(b), because to withhold the information would be absurd and inconsistent with the purpose of the exemption. [13] In this case, the appellant was one of the recipients on the email chain contained on these two pages of the record, and so he would be aware of the context of these emails. As such, I find that it would be absurd to withhold the information from him. Accordingly, I find that the personal information on these pages is not exempt from disclosure under the discretionary privacy exemption at section 49 (b) of the Act .

C:  Did the university exercise its discretion under section 49(b)? If so, should this office uphold the exercise of discretion?

[53]  The section 49(b) exemption applies to the withheld personal information on pages 66, 149 and 152 of the records. The section 49(b) exemption is discretionary, and permits an institution to disclose information, despite the fact that it could withhold it. An institution must exercise its discretion. On appeal, the Commissioner may determine whether the institution failed to do so.

[54]  In addition, the Commissioner may find that the institution erred in exercising its discretion where, for example,

• it does so in bad faith or for an improper purpose
• it takes into account irrelevant considerations
• it fails to take into account relevant considerations.

[55]  In either case, this office may send the matter back to the institution for an exercise of discretion based on proper considerations. [14] This office may not, however, substitute its own discretion for that of the institution. [15]

[56]  The university submits that it properly exercised its discretion under section 49(b). It submits that care was taken in determining the severances were necessary, and the administrative staff involved in preparing the records acted in good faith.

[57]  Although the appellant provided representations, his representations did not address this issue.

[58]  Based on my review of the parties’ representations and the nature and the content of the records at issue, I find that the university properly exercised its discretion to withhold the personal information pursuant to the discretionary personal privacy exemption at section 49 (b) of the Act . I am satisfied that the university took into account relevant considerations, and did not act in bad faith or for an improper purpose. Accordingly, I uphold the university’s exercise of discretion in deciding to withhold the personal information on pages 66, 149 and 152 of the records, pursuant to the section 49(b) exemption.

D:  Did the university conduct a reasonable search for records?

[59]  Where a requester claims that additional records exist beyond those identified by the institution, the issue to be decided is whether the institution has conducted a reasonable search for records as required by section 24. [16] If I am satisfied that the search carried out was reasonable in the circumstances, I will uphold the institution’s decision. If I am not satisfied, I may order further searches.

[60]  The Act  does not require the institution to prove with absolute certainty that further records do not exist. However, the institution must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. [17] To be responsive, a record must be "reasonably related" to the request. [18]

[61]  A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records which are reasonably related to the request. [19]

[62]  A further search will be ordered if the institution does not provide sufficient evidence to demonstrate that it has made a reasonable effort to identify and locate all of the responsive records within its custody or control. [20]

[63]  Although a requester will rarely be in a position to indicate precisely which records the institution has not identified, the requester still must provide a reasonable basis for concluding that such records exist. [21]

[64]  The appellant argues that there are missing emails. He points out that the university initially identified 10,549 responsive emails. However, the university only provided 8,762 emails and withheld 332 emails pursuant to the exemptions at sections 17(1) , 18(1) , and 19  of the Act , along with the personal privacy exemptions at sections 21(1) and 49(b). Thus, the appellant argues there are 1,455 missing emails.

[65]  In response, the university explains that its Information Technology (IT) Services Department provided the number 10,549 based on the number of emails appearing at the bottom left hand corner of its Microsoft Outlook screen. The university further explains that once a thorough review was completed by those involved in the access request, it was realized that there were several email chains containing the same information or duplicate information. As such, the university provided the appellant with the last email in the email chain to avoid any duplication of the information he received. Anything that was not included was in fact duplicate information. It also decided not to provide him with any email communication in an email chain where it no longer pertained to him and he was no longer included as part of the “to”, “cc” or “subject” sections of the email.

[66]  After carefully considering the parties’ arguments, I am satisfied that there are no missing emails. I accept and find the university’s explanation on how it determined what emails to provide to the appellant to be reasonable. Accordingly, I find that the university conducted a reasonable search for records.

ORDER:

1. I uphold the university’s decision with respect to the personal privacy exemptions at section 21(1) and 49(b), in part.
2. I order the university to disclose the withheld information on the following pages: 8, 12, 13, 26, 33, 36, 37, 38, 41, 42, 50, 52, 53, 59, 63, 72, 73, 74, 79, 94, 99, 100, 101, 104, 105, 107, 108, 110, 130, 137, 139, 140, 145, 149, 152, 155, 159, 166, 184, 191, 193, 203, 219, 222, 225, 234, 236, 251, 252, 253, 254, 256, 257, 258, 259, 261, 264, 265, 272, 281, 287, 288, 293, 295, 299, 306, 308, 330, 336, 337, 338, 339, 341, 346, 364, 367, 384, 388, 390, 391, 395, 405 and 406.

This disclosure is to be completed by December 27, 2018 but not before December 23, 2018 in accordance with the highlighted records I have enclosed with the university’s copy of this order. To be clear, the highlighted information should not be disclosed to the appellant.

3. I reserve the right to require the university to provide me with a copy of the records disclosed to the appellant.
4. I uphold the university’s search for records as reasonable.

Original Signed by:		November 22, 2018
Lan An
Adjudicator