ORDER PO-4144

Appeal PA18-00732

Ontario Cannabis Retail Corporation

May 10, 2021

Summary: The appellant seeks access to a record that shows sales and geographic information of customers who purchased cannabis products through the institution’s website, ocs.ca. The institution located one responsive record and denied the appellant access to it, in full. The appellant appealed the institution’s decision. During the inquiry, the institution confirmed it withheld the record under the discretionary exemptions in sections 14(1)(e) (endanger life or safety), (i) (security) and (l) (facilitate commission of an unlawful act), 18(1)(a), (c) and (d) (economic and other interests), and 20 (danger to safety or health). The institution also applied the personal privacy exemption in section 21(1) to withhold the first five rows of the record from disclosure because they relate to low-population areas. The appellant did not take issue with the institution’s section 21(1) claim, but confirmed his interest in the remainder of the record. In this order, the adjudicator finds the information at issue is exempt from disclosure under section 14(1)(l) of the Act and dismisses the appeal.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, section 14(1)(l).

Cases Considered: Ministry of Community Safety and Correctional Services v. Information and Privacy Commissioner (Ontario), 2014 SCC 31.

OVERVIEW:

[1] The appellant, a reporter, submitted a request under the Freedom of Information and Protection of Privacy Act  (the Act ) to the Ontario Cannabis Retail Corporation (the OCRC) for information about customers who purchased cannabis products on the OCRC’s website. Specifically, the appellant requested a sortable electronic file showing the first three characters of the postal codes (forward sortation areas or FSAs) of customers buying cannabis products through ocs.ca, on the date of the request.

[2] The OCRC located one responsive record, a spreadsheet, and issued an access decision to the appellant denying him access to the record. The OCRC claimed the application of the discretionary exemption in section 18(1) (economic and other interests) of the Act  to the record. The appellant appealed the OCRC’s decision.

[3] During mediation, the OCRC issued a revised access decision, confirming its reliance on sections 18(1) (a), (c), (d) and (g) of the Act  to withhold the record from disclosure. In addition, the OCRC raised the application of section 14(1)(l) (facilitate commission of an unlawful act) to the record. Finally, the OCRC advised the appellant of its position that the first five rows of the record are exempt under the personal privacy exemption in section 21(1) because the information is from low-population areas and could serve to identify an individual or individuals who purchased cannabis.

[4] The appellant reviewed the OCRC’s access decision and confirmed he does not wish to pursue access to the first five rows of the record. Accordingly, the first five rows of the record and the application of section 21(1) to them are not at issue in this appeal. During the inquiry, the appellant further confirmed he does not pursue access to any other rows that relate to a low-population area or contain information that could serve to identify an individual or individuals. Accordingly, an additional three rows of the record were removed from the scope of the appeal because, in my view, these rows could identify an individual or individuals due to the small number of dwellings in the FSA and the existence of publicly available information identifying the number of residents in those FSAs.

[5] The personal privacy exemption in section 21(1) is mandatory. As such, I considered whether the record, beyond the eight rows referred to above, contains personal information or information about an identifiable individual or individuals. I reviewed the information that remains at issue and considered Ministry of Community Safety and Correctional Services v. Information and Privacy Commissioner (Ontario), [1] in which the Supreme Court of Canada found that data based on partial data codes and FSAs can be released without privacy concerns because they typically contain tens of thousands of residents. Upon review, I find that none of the information at issue would, if disclosed, serve to identify an individual or individuals. The information that remains at issue relates to FSAs with a large number of dwellings and it is unlikely an individual or individuals could be identified by an FSA, the number of sales of cannabis over a two- week period, and the number of dwellings in that FSA. I also note the OCRC considered whether the information that remains at issue contains personal information within the meaning of section 2(1) of the Act and decided it did not. While this is not determinative, I agree the information remaining at issue could not serve to identify an individual or individuals if disclosed. Therefore, I will not consider the personal privacy exemption in this order.

[6] Mediation did not resolve the appeal and the file transferred to the adjudication stage of the appeal process. The adjudicator who had carriage of the file began an inquiry under the Act  by inviting the OCRC to submit representations in response to a Notice of Inquiry, which describes the facts and issues under appeal. The OCRC submitted representations and withdrew its reliance on section 18(1)(g). However, the OCRC raised the application of the exemptions in sections 14(1)(e) (endanger life or safety), 14(1)(i) (security), and section 20 (danger to safety or health). These exemptions and the issue of whether the OCRC should be permitted to raise these exemptions after the deadline for doing so set out in the IPC’s Code of Procedure were added as issues in this appeal.

[7] The adjudicator then sought and received representations from the appellant in response to the Notice of Inquiry and the OCRC’s representations, which were shared with the appellant in accordance with Practice Direction Number 7 of the IPC’s Code of Procedure. The adjudicator then sought and received reply representations from the OCRC in response to the appellant’s representations. The OCRC’s reply representations were then shared with the appellant, who submitted further sur-reply representations. The OCRC submitted further representations in response to the appellant’s sur-reply representations.

[8] The appeal was then transferred to me to complete the inquiry. In the discussion that follows, I uphold the OCRC’s application of section 14(1)(l) to the information at issue and dismiss the appeal. Given this finding, it is not necessary for me to consider the application of the other exemptions claimed by the OCRC to the information at issue, or the issue of whether I should allow the OCRC to raise the exemptions in sections 14(1)(e), 14(1)(i) and 20 after the deadline for doing so.

RECORD:

[9] The record is a twelve-page printed spreadsheet consisting of four columns: the FSA, geo name, sales units and total dwellings in the FSA. For the reasons outlined above, the first eight rows of the records are not at issue. As the OCRC explained in its representations, the numbers in the spreadsheet represent recreational cannabis sales for the two-week period ending on the date of the access request.

ISSUES:

1. Does the discretionary exemption at section 14(1)(l) (facilitate commission of an unlawful act) apply to the information at issue?
2. Did the OCRC exercise its discretion under section 14(1)(l)? If so, should this office uphold the exercise of discretion?

DISCUSSION:

Issue A: Does the discretionary exemption at section 14(1)(l) (facilitate commission of an unlawful act) apply to the information at issue?

[10] The OCRC submits the record is exempt from disclosure under section 14(1) (l) of the Act . Section 14(1)(l) states,

A head may refuse to disclose a record where disclosure could reasonably be expected to,

facilitate the commission of an unlawful act or hamper the control of crime.

[11] Generally, the law enforcement exemption must be approached in a sensitive manner, recognizing the difficulty of predicting future events in a law enforcement context. [2]

[12] It is not enough for an institution to take the position that the harms under section 14 are self-evident from the record or the exemption applies simply because of the existence of a continuing law enforcement matter. [3] The institution must provide detailed evidence about the potential for harm. It must demonstrate a risk of harm well beyond the merely possible or speculative, although it need not prove that disclosure will in fact result in such harm. How much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences. [4]

[13] As background, the OCRC submits the legalization of cannabis in Canada has several purposes, not least of which is the reduction and deterrence of illicit activities in relation to cannabis. The OCRC, which operates as the Ontario Cannabis Store (the OCS), was created through the enactment of the Ontario Cannabis Retail Corporation Act (the OCRC Act). Section 4(c) of the OCRC Act states that one of its objects is “to promote social responsibility in connection with cannabis.” Moreover, section 27(d) of the OCRC Act requires the OCS to take adequate measures to reduce the risk of cannabis being diverted to an illicit market or activity.

[14] The OCRC submits the record pertains to the distribution of a regulated substance. The OCRC confirms the record was not created specifically for a law enforcement purpose. Nonetheless, the OCRC maintains the information contained in the record has a direct impact on Ontario’s ongoing law enforcement efforts. The OCRC submits the record was created to record the sales volumes of a regulated substance by geographic location. Insofar as the OCRC is the sole legal distributor of recreational cannabis in the province, the OCRC submits all records created to track the location of cannabis in accordance with the OCRC Act are regulatory in nature.

[15] The OCRC confirms it is not directly involved in efforts to combat and reduce the size of the illicit cannabis market. In any case, the OCRC submits the information it has in its custody and control directly impacts those efforts.

Section 14(1)(l) – facilitate the commission of an unlawful act or hamper the control of crime

The parties’ representations

[16] The OCRC submits the disclosure of the record could reasonably be expected to facilitate the commission of an unlawful act and hamper the control of crime. The information is not publicly available and is treated internally as confidential. The OCRC submits that it, along with partners and stakeholders, have made a concerted effort to grow the legal cannabis market and attract customers from the illicit market. The OCRC submits its efforts have been moderately successful. According to Statistics Canada’s National Cannabis Survey, more cannabis users reported obtaining their product from legal sources and fewer from illegal sources.

[17] However, the OCRC submits if the records are disclosed, it will provide actors in the illicit cannabis market with evidence-based information to more effectively target certain areas and vulnerable populations in those areas to undercut the legal market. The OCRC submits it is reasonable to expect this harm could result because the appellant is a member of the media and likely to publish the information.

[18] The OCRC states the information at issue is not publicly available and cannot be obtained through simple surveillance. The OCRC admits that criminal activity in the cannabis market is not necessarily predicated on knowledge of where demand surpasses legal supply or where there is a high volume of transactions. Nonetheless, the OCS submits the disclosure of the record would facilitate increased criminal activity in specific regions and therefore hamper the control of crime in those areas.

[19] The OCRC submits the illicit cannabis market is deliberate, sophisticated, and opportunistic. It says the illicit cannabis market is largely controlled by organized crime. In fact, the OCRC submits that half of the national high-threat organized crime groups are involved in the illicit cannabis market and operate across the country in all aspects of the distribution chain. The OCRC submits these organizations will seize any advantage they can, including “availing of pertinent business information to inform their activities.” The OCRC submits the illicit market will ensure its supply will meet the demand so long as the demand for cannabis exists with ability to generate a profit with a low risk of monetary or criminal penalty. The OCRC takes the position that criminal organizations would use the cannabis sales data by geographic region at issue to assist regional organizations into a lucrative illicit industry, particularly given that some in the illicit cannabis industry continue to operate in the open and in defiance of laws and regulations.

[20] In addition, the OCRC submits there is a legal cannabis supply shortage and law enforcement continues to face an uphill battle combatting the illicit market. The OCRC submits industry groups, including the Ontario Chamber of Commerce, have recognized the connection between legal cannabis supply issues and increasing activity in the illicit market. The OCRC submits that criminal organizations could cross-reference the data in the record with the location of current and proposed retail stores to identify regions where access to supply is out of proportion with demand. By targeting areas with high demand and limited access, the OCRC submits the illicit market can effectively target vulnerable populations, resulting in an expanded criminal network.

[21] The OCRC submits criminal organizations could also combine the information at issue with other publicly available information to pinpoint specific neighbourhoods within an FSA likely to have a high volume of sales. In addition, the OCRC refers to third party services that assist clients with building cannabis consumer profiles at the postal code level. The OCRC submits individuals could cross-reference the information at issue with the location of current and proposed retail stores and identify regions where access to supply is out of proportion with demand. The OCRC submits the Alcohol and Gaming Commission of Ontario (the AGCO) regularly updates a map of current and proposed cannabis retail stores on its website. By targeting areas with high demand and limited access (e.g. no local retail stores), the OCRC submits the illicit market can effectively target vulnerable populations, resulting in an expanded criminal network.

[22] The OCRC states the locations of physical stores, on their own, do not provide any “real indication” of trends regarding the consumption of cannabis because retail licenses were awarded based on a random lottery. The OCRC states the winners selected their own locations with no input from the OCRC or government other than prescribed by regulation and by-laws and as limited by the region identified in their lottery application. Therefore, the OCRC takes the position that the locations of the physical stores would not, on their own, provide an accurate view of the consumption of cannabis in specific areas.

[23] However, the OCRC submits an individual could combine the information at issue with other publicly available information to pinpoint specific neighbourhoods within an FSA likely to have a high volume of sales. The OCRC notes the record at issue in this appeal provides the most accurate metric of online sales volumes regarding localized cannabis uptake. The OCRC submits other cannabis sales information is in aggregate form, such as the provincial level sales data provided publicly by Statistics Canada.

[24] The OCRC submits the information at issue is valuable because it provides an accurate metric of online sales volume and localized cannabis uptake at a more granular level. The OCRC submits the disclosure of the record at issue could reasonably be expected to result in the harms contemplated by section 14(1)(l) because the information at issue could encourage or assist criminal organizations to undertake criminal activities in new geographic areas where demand appears high relative to supply. To support its position, the OCRC states its customers have complained of being targeted by illicit operations marketing illegal cannabis products, for instance, by identifying OCS packages and targeting recipients. To further support its argument, the OCRC referred to a number of articles highlighting the challenges faced in the legal cannabis market, including converting customers from the illicit market, and supply and pricing issues.

[25] The appellant submits the OCRC did not provide sufficient evidence to support how the disclosure of cannabis purchase data at the FSA level could help in the commission of crime. The appellant says that the OCRC has submitted a large number of news clippings “tangentially related to the issue”, but not detailed evidence demonstrating a reasonable expectation of harm.

[26] In addition, the appellant refers to correspondence with the OCRC in which he was advised the OCRC created its own Sale of Data program (the OCS Data Program [5] ), similar to the LCBO’s Sale of Data program for beverage alcohol. The appellant states the OCRC advised him that, under the OCS Data Program, it will be selling information relating to sales volumes, performance and specific information around the location of sales. The appellant states the OCRC advised him that geographic characteristics of cannabis sales, including sales by FSA, represents one of the highly demanded data attributes and the OCRC intended to provide this type of information as part of the OCS Data Program in the future.

[27] The appellant also refers to the OCRC’s claim that disclosure of FSA-based customer data could lead to the illegal market knowing where to locate customers. The appellant states grey-market cannabis storefront operations have been systematically shut down across the province. Furthermore, the appellant states the data reflects a population of customers who have made a point of seeking out legal, regulated product, which the grey market cannot provide and is paying a premium to do so. It appears the appellant questions whether the disclosure of the record could reasonably result in the harms contemplated by section 14(1)(l) given these circumstances.

[28] In response, the OCRC submits it provided relevant evidence to meet the threshold for the application of section 14(1)(l). The OCRC reiterates its claim that the disclosure of the record could reasonably be expected to facilitate the commission of an unlawful act by providing those engaged in criminal activity with useful strategic geographic information that allows them to best target their efforts and resources. Further, the OCRC submits the disclosure of the record could reasonably be expected to hamper the control of crime by increasing the success, reach and funding available to those involved in criminal activity thereby making it harder for law enforcement to control the illicit cannabis industry.

[29] As background, the OCRC says it created the OCS Data Program to “enable innovation and growth in the Canadian cannabis industry through the strategic fee-based provisioning of data and insights.” The goal of the OCS Data Program is to monetize the data the OCRC collects as part of its work in the cannabis industry, such as de-identified product and sales information. In its representations, OCRC states its OSC Data Program does not currently include geographic information or FSAs and it is not selling postal code- based sales data. The OCRC reiterates its position that the public release of postal code- based sales data is unacceptably dangerous. The OCRC states that, even if it were to sell postal code-based sales data, all of the participants in its sale of data program are required to sign and abide by a confidentiality agreement that prohibits them from further disseminating the information. The OCRC states this confidentiality agreement is legally binding and allows the OCRC to seek damages for any contravention of the agreement. The OCRC states the OCS Data Program operates in a manner that allows the OCRC to identify the source of a breach and then pursue legal remedies. Therefore, the OCRC appears to suggest that any geographic sales information that may be sold would be protected from further disclosure. In any case, the OCRC confirmed it does not currently sell postal code-based sales data as part of its OCS Data Program.

Analysis and findings

[30] The record at issue consists of 521 rows on an electronic spreadsheet containing the following columns of data:

1. Forward sortation areas (FSAs), defined as a geographical unit represented by the first three characters of a postal code;
2. GEO_NAME, which contains the FSA;
3. the number of recreational cannabis purchases per FSA for a two- week period; and
4. the number of private dwellings located in an FSA as reported in the most recent census.

[31] Based on my review of this information and the parties’ representations, I find the information is exempt under section 14(1) (l) of the Act . Specifically, I am satisfied the OCRC provided sufficient evidence to demonstrate there is a reasonable expectation the disclosure of the record could facilitate the commission of unlawful acts or hamper the control of crime.

[32] The OCRC demonstrates that the legal cannabis market is in direct competition with the illicit cannabis market. In addition, the OCRC shows the legal cannabis market is vulnerable to competition from illicit market, which can have fewer supply and pricing issues. The OCRC has provided evidence to demonstrate there is a legal cannabis supply issue since legalization. It is clear the provincial government is working to increase supply and to divert customers from the illegal cannabis market. Nonetheless, the illegal cannabis market continues to operate in defiance of laws and regulations. Furthermore, the OCRC has demonstrated the utility of the information at issue to illicit cannabis market players. Specifically, the cannabis sales data by geographic region could be used to identify areas in which legal access to supply is out of proportion with demand. I accept the OCRC’s claim that publicly available information regarding the number of cannabis retail stores in a geographic area does not capture the cannabis demand in that area as precisely as the information contained in the record. I find the OCRC has provided sufficient evidence to prove it is reasonable to expect that members of the illicit market will use the information at issue to target vulnerable populations and specific geographic areas to sell illegal cannabis.

[33] I am also mindful of the OCRC’s claim that the information at issue is specific and accurate. It is not akin to other publicly available cannabis sales information, which is provided at the provincial level or in another aggregate form. Given the specific nature of the information at issue, I am satisfied by the OCRC’s claim that it could reasonably be used by criminal organizations to further target its sales and marketing of illegal cannabis.

[34] I find the OCRC provided sufficient evidence to demonstrate a risk of harm well beyond the merely possible or speculative. [6] In the circumstances of this appeal and due to the fact that cannabis was legalized relatively recently, it is important to approach the exemption claimed in a sensitive matter and I must recognize the challenge of predicting future events in the law enforcement context and the effects the disclosure of this record may have. The OCRC has demonstrated the illicit market is a sophisticated and dynamic economic enterprise and not deterred by laws and regulations. Given these circumstances, I find it reasonable to expect the players in the illicit cannabis market would use the information at issue to further their illegal enterprise. Therefore, I find the disclosure of the record could reasonably be expected to facilitate an unlawful act and hamper the control of crime.

[35] I note the appellant points out the province has been systematically shutting down grey-market cannabis operations and the data reflects a population of customers who have made a point of seeking out a legal, regulated product. It appears the appellant questions whether the harms contemplated by section 14(1)(l) could reasonably be expected to result if these circumstances exist. I accept the appellant’s claims that the province has shut down a number of grey-market cannabis operations and that consumers are choosing to purchase cannabis through legal means. However, I find this evidence does not support the appellant’s claim that section 14(1) does not apply to the information at issue. I find that it is nonetheless reasonable to expect that illegal cannabis businesses or organizations will use the information at issue to target their marketing in certain areas, so as to divert demand towards the illicit market, if the record is disclosed.

[36] Finally, the appellant raised a possible contradiction in the OCRC’s representations; that is, the fact that the OCRC was selling the geographic or FSA-based sales information as part of its sale of data program. However, the OCRC affirms that it is not selling FSA- based data. Further, even if it were to do so, there are strict confidentiality requirements and accountability measures around any information provided under the OCS Data Program. Therefore, I find that the OCS Data Program is not at odds with its position on the application of section 14(1)(l) in the circumstances.

[37] In conclusion, I find the information at issue is exempt from disclosure under section 14(1) (l) of the Act , subject to my review of the OCRC’s exercise of discretion below.

[38] Given my finding, it is not necessary for me to decide whether the other exemptions relied on by the OCRC apply to the record.

Issue B: Did the OCRC exercise its discretion under section 14(1)(l)? If so, should this office uphold the exercise of discretion?

[39] The exemption in section 14(1)(l) is discretionary, and permits an institution to disclose information, despite the fact it could withhold it. The OCRC must exercise its discretion in applying section 14(1)(l) to the information at issue. On appeal, the IPC may determine whether the OCRC failed to do so. In addition, the IPC may find the OCRC erred in exercising its decision where it did so in bad faith or for an improper purpose; where it took into account irrelevant considerations; or where it failed to take into account relevant considerations. In either case, I may send the matter back to the OCRC for an exercise of discretion based on proper considerations. [7] However, according to section 54(2)  of the Act , I may not substitute my own discretion for the OCRC’s.

[40] The OCRC submits it exercised its discretion appropriately. It claims it considered the wording of the exemptions claimed and the interests those exemptions seek to protect. The OCRC submits its exercise of discretion is consistent with the letter and spirit of the law. The OCRC states the appellant does not seek access to his own personal information but is acting in his capacity as a member of the media. The OCRC acknowledges access to information is a public right and the media plays an essential role in ensuring a democratic society’s government service is operating transparently and in accordance with the law. However, in this case, any public interest in the volume of cannabis sales can be satisfied by information that is already publicly available. The OCRC takes the position that no public harm will result from withholding the specific information at issue.

[41] In addition, the OCRC considered whether the disclosure of the record would increase public confidence in the government’s ability to control the production and distribution of legal cannabis and found that it would not.

[42] The OCRC states it is a new institution operating in a newly regulated space. The OCRC notes the industry is young and it is uncertain how illicit players in the market will use the information at issue. Given these circumstances, the OCRC states it exercised its discretion to withhold the record from disclosure with a warranted amount of caution.

[43] Finally, the OCRC states the information at issue is not available in any other province or for any other regulated commodity, such as alcohol, in the province and is treated internally as confidential and sensitive.

[44] I reviewed the parties’ representations and the information I have found to be exempt under section 14(1)(l). Based on that review, I am satisfied the OCRC properly exercised its discretion under section 14(1)(l) in deciding to withhold the information at issue. I am satisfied the OCRC considered relevant factors in exercising its discretion and did not take into account irrelevant considerations. I find the OCRC considered the nature of the information at issue, the purpose of the exemption claimed and whether disclosure would serve some public purpose despite the application of section 14(1)(l). While the appellant raised a possible inconsistency in the OCRC’s position, that is, its possible sale of the same type of information under the OCS Data Program, while also claiming section 14(1)(l), the OCRC confirmed that the geographically based sales information at issue is not part of its sale of data program.

[45] In conclusion, upon review of the record and the parties’ representations, I find the OCRC exercised its discretion under section 14(1)(l) appropriately and I uphold its exercise of discretion.

ORDER:

I find the information at issue is exempt under section 14(1)(l) and dismiss the appeal.

Original signed by:		May 10, 2021
Justine Wai
Adjudicator