ORDER MO-4091

Appeal MA18-536

City of Burlington

July 29, 2021

Summary: The appellant requested access to two records along with associated metadata. The City of Burlington (the city) took the position that the information was not subject to the Municipal Freedom of Information and Protection of Privacy Act  or alternatively did not exist. In this order the adjudicator finds that the two records with associated metadata, if they exist, are responsive records that are subject to the Act. The adjudicator orders the city to conduct a further search for these responsive records.

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act , RSO 1990, c M.56 , as amended, sections 2(1) (definition of “record”), 17 ; Regulation 823, section 1.

Orders and Investigation Reports Considered: Orders M-493 and MO-2129.

Cases Considered: Toronto Police Services Board v. (Ontario) Information and Privacy Commissioner, 2009 ONCA 20.

OVERVIEW:

[1] This appeal involves a consideration of an access request for associated metadata, in addition to the substantive content of a requested record.

[2] It arises out of a request to the City of Burlington (the city) under the Municipal Freedom of Information and Protection of Privacy Act  (the Act  or MFIPPA ) for access to the following information:

1. All records regarding the position of Deputy City Manager, including but not limited to all electronic and written communication, discussions, meeting notes and memos, regarding the creation and implementation of the position of Deputy City Manager.
2. Any job descriptions including draft copies - for the Deputy City Manager position.
3. The hiring process for this position. For the Deputy City Manager position, the City’s hiring policy/procedures and the hiring process that took place for the “incumbent” in that position.

[3] The city identified records responsive to the request and disclosed some of them in paper form, while denying access to others under the labour relations and employment exclusion in section 52(3), the mandatory personal privacy exemption in section 14(1) and the discretionary closed meeting exemption in section 6(1) (b) of the Act .

[4] Not satisfied with the receipt of paper records, the requester submitted a follow- up request for the following information:

… digital copies of the digital electronic WORD files (complete with the metadata) for the following records released in paper format in MFIPPA Access to Records File No. [specified file number]:

1. Deputy City Manager – Core Responsibilities (as found on page 9); and,

2. Deputy City Manager – Competency Questions (as found on page 19).

[5] The city processed this follow up request as a separate matter and issued the following access decision:

In its letter of August 9/18, the city issued a decision on the above records being requested, providing you with the responsive records, in paper format, as per the city’s practice. Under the Act, the city has no obligation to create a record that doesn’t already exist. As such, there is no way to guarantee the integrity of the metadata in the electronic version, if it exists. The records were provided by staff in paper format. A paper document is the original record.

As stated in the email to you dated August 10/18, to protect the security and integrity of records against manipulation or being “lost” in cyberspace or altered, the city does not provide Word formatted records or the associated metadata in response to an FOI request. The city needs to ensure that the security of the original record remain[s].

In certain circumstances, for example, where the records are required immediately or cannot be mailed or picked up, we will provide PDF versions of records on a CD or USB, at a cost of $10. As stated in the August 10^th email, we do provide publicly available documents, and records with no risk, by email, if requested.

As these records have already been mailed to you, yesterday August 13/18, and to ensure the security and integrity of the records, we are denying this request for the same records as already disclosed to you in [specified file number], to be provided and emailed in a Word format, with associated metadata. This file is now closed.

[6] It should be noted that the city did not actually claim the metadata is subject to any exemption under the Act . [1] The city simply advised the appellant that it was closing its file for this request based on the view that it had met its obligations under the Act .

[7] The requester then sent an email to the city taking issue with its decision, noting that the city’s Standard Operating Procedure for FOI states (on page 6) that “Paper copies are provided; records are not provided by email unless specifically requested,” and wrote:

I do not understand why I cannot get the electronic copies that I requested as I do not understand your reason and what you mean by “to ensure protection of the records”. Protection from what…?

… you have released this information through the MFIPPA  process. So the records are now in the public domain. Since these records are now in the public domain, then why can’t they be treated the same way as the City treats other records that are in the public domain?

For example, the City’s Election Officer… sent Word and PDF files to me via email on 01 August 2018 and [an] HR Administrative Assistant …sent me PDF files of City Job Descriptions on 09 July 2018.

Moreover, you sent me a WORD document via email asking for my personal VISA payment information which I will be sending back to you via email in order to process this MFIPPA  request. Th[is] is nothing more than an application of a double standard…

[8] The requester, now the appellant, then appealed the city’s access decision to the Information and Privacy Commissioner (IPC). In his Notice of Appeal he wrote the following:

Electronic WORD documents can be encrypted with a password with restrictions that would only allow individuals to access the files as ‘read only’ while denying their ability to edit or change the electronic WORD files in any way, including the ‘metadata’. Furthermore, WORD documents allow the City to embed a ‘Digital Signature’ to ensure the integrity of the documents.

Moreover, the institution’s concerns with the records being lost in cyberspace are also unfounded. They can send the electronic version of the WORD files on CD ROM or USB “with no risk” as indicated in their letter.

[9] At mediation, the appellant confirmed that he seeks access to an electronic copy of the Word files for the documents titled, “Deputy City Manager Core Responsibilities” and “Deputy City Manager Competency Questions” – the records already disclosed to him in paper format – but “complete with the metadata.” The city maintained that providing an electronic copy of a Word document with metadata would amount to the creation of a new record, which the Act  does not require it to do. The city argued that Word files for the records “complete with the metadata” are not “records” as defined by the Act . [2]

[10] Mediation did not resolve the appeal and it was moved to the adjudication stage of the appeals process where an adjudicator may conduct an inquiry under the Act .

[11] In the interim, the appellant sent an email to the mediator after reviewing the mediator’s report, in which he stated:

The electronic version of these documents have to be the original versions of these documents. There is no other way that the paper copies could have been created. If there is, then the City will have to produce the evidence to show how they create paper copies of records.

Furthermore, it is not possible that these electronic versions will result in the creation of a new record, as the City argues. They are the original records, complete with the metadata, not the other way around. The paper copy is just that, a copy of the electronic version. The electronic copy is not a copy of the paper version. [emphasis in original]

[12] The adjudicator originally assigned to this file commenced an inquiry under the Act and representations were exchanged between the city and the appellant in accordance with section 7 of the IPC’s Code of Procedure and Practice Direction 7.

[13] The appeal file was then assigned to me to complete the inquiry.

[14] In this order, I find that the city has not conducted a reasonable search for responsive records and I order it to conduct another search.

RECORDS:

[15] Notionally at issue are electronic copies of the Word files, complete with metadata, for records titled, “Deputy City Manager Core Responsibilities” and “Deputy City Manager Competency Questions.”

ISSUES:

1. Is the requested information a “record” as defined in section 2 of the Act and section 1 of Regulation 823?
2. Did the city conduct a reasonable search for responsive records?

DISCUSSION:

Issue A: Is the requested information a “record” as defined in section 2 of the Act and section 1 of Regulation 823?

[16] In response to the appellant’s first request the city decided to provide a paper copy of the two responsive records. The appellant did not appeal the city’s decision. However, the appellant made a second request which was more specific. He asked for a copy of the electronic word version of the records, with associated metadata. The city raised the issue of whether the information responsive to the appellant’s second request is a “record” as defined in section 2  of the Act , taking into consideration section 1 of Regulation 823. The city maintains that the records requested by the appellant are not “records” for the purpose of the Act  or that a responsive record no longer exists.

[17] Section 2(1)  of the Act  specifically defines a “record” as follows:

“record” means any record of information however recorded, whether in printed form, on film, by electronic means or otherwise, and includes,

(a) correspondence, a memorandum, a book, a plan, a map, a drawing, a diagram, a pictorial or graphic work, a photograph, a film, a microfilm, a sound recording, a videotape, a machine readable record, any other documentary material, regardless of physical form or characteristics, and any copy thereof, and

(b) subject to the regulations, any record that is capable of being produced from a machine readable record under the control of an institution by means of computer hardware and software or any other information storage equipment and technical expertise normally used by the institution;

[18] This definition must be read in conjunction with section 1 of Regulation 823, which reads:

A record capable of being produced from machine readable records is not included in the definition of “record” for the purposes of the Act  if the process of producing it would unreasonably interfere with the operations of an institution.

The representations

[19] The city initially took the position that metadata is not considered a record as it is only part of the electronic Word version record. In the alternative, the city stated that providing an electronic copy of the requested Word documents complete with metadata would amount to the creation of a new record, which the Act  does not require it to do.

[20] The city explains that in response to the appellant’s request, the city’s Human Resources Director sent a Word version of the responsive records but advised that they may have been subject to “many revisions of others who have reviewed them, given the nature and use of the documents”. The city states that as these documents were changed through internal reviews there is no “original” record that exists. Thus while acknowledging that there is metadata associated with the Word formatted records in its control, the city states that there is no way of ensuring the integrity of the “original” metadata as it has been revised and edited by staff members due to the nature and use of the record. The city submits that to recreate the record would not result in the “original” Word document and associated metadata that the appellant is requesting.

[21] The city is also concerned about the risk of disclosing the requested information, explaining that:

Hidden metadata can provide useful file information to be used internally, especially if there is a need to collaborate on a document; however, it could also impact the security of the documents and internal processes. Microsoft WORD’s metadata, or document properties, stores details about the files and their management throughout time. Each time someone edits and saves a file, WORD updates the document's metadata. We may share these files internally with other staff to review and make comments; however, would never consider sharing a sensitive document to the public without scrubbing the metadata clean and/or converting to an unalterable PDF(a) to protect the record. These records were used for a confidential interview process for the Deputy City Manager position and may have been edited to manage the process as any WORD document can and has been. Revealing metadata could be harmful to the city and the interview process. The city needs to ensure the security and integrity of the Word document as it can be easily manipulated and changed.

[22] The appellant submits that the two electronic copies of the Word files, complete with metadata, are the original records from which paper copies were made in order to fulfill the request. The appellant adds that the two digital records at issue are documents involving content of a general nature, made prior to any interviews being conducted and would not include any potential candidate’s personal information.

[23] The appellant submits that the city has acknowledged that there are different versions of the Word files, complete with metadata, and accordingly, to comply with its obligations under the Act , the city must therefore provide all available digital versions of these records, as revised by different staff members in review of these documents. The appellant suggests that these versions would be available as attachments in various email communications or shared among City staff on a shared public drive on a server.

[24] The appellant takes the position that the city refused to provide the digital electronic Word files as requested and that disclosing paper records does not relieve the city from its obligations to provide access to the digital records, which are not the same records.

[25] In reply, the city clarified that that it does not have “different versions” of the records:

The city only has one WORD document that may have been reviewed by many different staff to facilitate a confidential interview process. See comments above regarding metadata. The city is not obligated under the Act  to provide all versions, if they existed; only that access be provided, subject to limited and specific exemptions. The request was not for “all versions, if they exist”. When releasing records, the best efforts are made to remove duplicates.

Is the requested information a “record”?

[26] To begin, I am satisfied that the definition of a record in section 2(1) is broad, and includes any record of information however recorded, whether in printed form, on film, by electronic means or otherwise. I am satisfied that metadata would qualify as information that falls within the scope of that definition.

[27] In order for a record to further satisfy the definition of ”record” in section 2(1)  of the Act , paragraph (b) of the definition requires that it must be:

1. capable of being produced from a machine-readable record;
2. under the control of the institution; and,
3. capable of being produced by means of computer hardware and software or any other information storage equipment and technical expertise normally used by the institution. [3]

[28] If any of these three requirements are not satisfied, then the information will not constitute a “record” for the purpose of the Act . [4] If all three requirements are satisfied, then there remains the requirement in section 1 of Regulation 823, that producing the record must not “unreasonably interfere” with the operations of the institution. [5]

[29] Although there is some inconsistency in the city’s position regarding the possible existence of records, at no time did the city assert that producing responsive information, if it exists, was not possible. I base this conclusion on the city’s acknowledging that there is metadata associated with the Word formatted records in its control and that the city’s Human Resources Director located a Word version of the responsive records, but it has concerns about the version that may be produced, due to its having been changed over time. I do not interpret the city’s evidence to date as meaning that it is not possible at all to produce a version of a responsive record with associated metadata, whatever that version may be. Accordingly, based on its own evidence, I am satisfied that information in a record of the type sought by the appellant is capable of being produced from machine-readable records “by means of computer hardware and software or any other information storage equipment and technical expertise normally used by the institution.”

[30] Finally, section 1 of regulation 823 operates to exclude information from the definition of record if the process of producing it would unreasonably interfere with the operations of an institution.

[31] However, in this case, the city’s concerns about disclosure turns more on the consequences of disclosure, rather than concerns that producing the record would unreasonably interfere with its operations. Based on the evidence provided by the city about the pitfalls of producing multiple versions of the records, I am satisfied that producing responsive information, if it exists, would not unreasonably interfere with the city’s operations.

[32] Accordingly, I find that responsive Word documents with associated metadata would be included in the definition of a record for the purposes of the Act .

Issue B: Did the city conduct a reasonable search for responsive records?

[33] Section 17  of the Act  imposes certain obligations on requesters and institutions when submitting and responding to requests for access to records. This section states, in part:

1. A person seeking access to a record shall,
1. make a request in writing to the institution that the person believes has custody or control of the record, and specify that a request is being made under this Act ;
2. provide sufficient detail to enable an experienced employee of the institution, upon a reasonable effort, to identify the record;
2. . . .
3. If the request does not sufficiently describe the record sought, the institution shall inform the applicant of the defect and shall offer assistance in reformulating the request so as to comply with subsection (1).

[34] This establishes that the city has an obligation to search for responsive records. Where a requester claims that additional records exist beyond those identified by the city, the issue to be decided is whether the city has conducted a reasonable search for records as required by section 17. [6]

[35] Institutions should adopt a liberal interpretation of a request, in order to best serve the purpose and spirit of the Act . Generally, ambiguity in the request should be resolved in the requester’s favour. [7] To be considered responsive to the request, records must “reasonably relate” to the request. [8] To be responsive, a record must be "reasonably related" to the request. [9] A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records which are reasonably related to the request. [10]

[36] A further search will be ordered if the institution does not provide sufficient evidence to demonstrate that it has made a reasonable effort to identify and locate all of the responsive records within its custody or control. [11]

[37] Although a requester will rarely be in a position to indicate precisely which records the institution has not identified, the requester still must provide a reasonable basis for concluding that such records exist. [12]

Analysis and finding

[38] In response to the appellant’s first request the city decided to provide a paper copy of the responsive records. The appellant did not appeal the city’s decision. However, the appellant made a second request which was more specific. He asked for a copy of the Word version of the records, with associated metadata. In that regard, and as discussed further below, the city may have responsive information, even if it’s not exactly in the form the requester is asking for.

[39] Generally speaking, an institution is not required to create a new record in response to a request under the Act . [13] In addition, this office has previously stated that government organizations are not obliged to maintain records in such a manner as to accommodate the various ways in which a request for information might be framed. [14]

[40] In Order M-493, former Senior Adjudicator John Higgins provided some guidance with respect to the extent to which an institution should respond to questions directed to it by a requester, stating:

In my view, when such a request is received, the [institution] is obliged to consider what records in its possession might, in whole or in part, contain information which would answer the questions asked. Under section 17  of the Act , if the request is not sufficiently particular “... to enable an experienced employee of the institution, upon a reasonable effort, to identify the record", then the [institution] may have recourse to the clarification provisions of section 17(2).

[41] In Order MO-2129, in the course of addressing a request for information that appeared to exist within the record holdings of an institution, but not in the format asked for by the appellant in that appeal, Adjudicator Colin Bhattacharjee went on to address the obligations of the Toronto Police Services Board (the Police) in the circumstances of that appeal, determining that:

… If the request is for information that currently exists in a recorded format different from the format asked for by the requester, as is the case in this appeal, the Police have dual obligations.

First, if the requested information falls within paragraph (a) of the definition of a record (e.g., paper records), the Police have a duty to identify and advise the requester of the existence of these related records (i.e., the raw material). However, the Police are not required to create a record from these records that is in the format asked for by the requester (e.g., a list).

Second, if the requested information falls within paragraph (b) of the definition of a record, the Police have a duty to provide it in the requested format (e.g., a list) if it can be produced from an existing machine readable record (e.g., a database) by means of computer hardware and software or any other information storage equipment and technical expertise normally used by the institution, and doing so will not unreasonably interfere with the operations of the Police. In such circumstances, the Police have a duty to create a record in the format asked for by the requester.

In my view, a reasonable search for records responsive to an access request would include taking steps to comply with these two obligations. …

[42] In Toronto Police Services Board v. (Ontario) Information and Privacy Commissioner [15] the Ontario Court of Appeal was dealing with a journalist’s request for information relating to racial profiling. The information he sought was stored in two electronic databases maintained by the Toronto Police Services Board (the police), but contained personal identifiers. In order to avoid infringing on the privacy rights of the individuals in question, the journalist asked that the unique identifiers for each individual be replaced with randomly generated, unique numbers, and that only one unique number be used for each individual. The police had the technical expertise needed to retrieve the information in question in the format requested, but to do so, they would have to design an algorithm that was capable of extracting and manipulating the information that presently existed in the two electronic databases and reformatting it. The IPC [16] had found that the information being sought by the journalist constituted a “record” under the Act and ordered the police to respond to the requests by issuing access decisions in accordance with the notice provisions of the Act . The police applied to the Divisional Court for judicial review of that decision and explicitly raised for the first time the argument that the information requested did not constitute a “record” within the meaning of section 2(1) (b) of the Act  because it could only be produced by means of software that the Police did not normally use. The Divisional Court found that the adjudicator's interpretation of section 2(1)(b) was unreasonable and allowed the application. In allowing an appeal of the judicial review and upholding the adjudicator’s decision, the Court of Appeal discussed the application of a contextual and purposive analysis of section 2(1) (b) of the Act :

A contextual and purposive analysis of s. 2(1)(b) must also take into account the prevalence of computers in our society and their use by government institutions as the primary means by which records are kept and information is stored. This technological reality tells against an interpretation of s. 2(1)(b) that would minimize rather than maximize the public’s right of access to electronically recorded information.

The Divisional Court made no mention of these principles of interpretation in constructing s. 2(1)(b) of the Act and in concluding that the Adjudicator’s interpretation was unreasonable. This omission led the court to gives. 2(1)(b) a narrow construction – one which, in my respectful view, fails to reflect the purpose and spirit of the Act and the generous approach to access contemplated by it.

The Divisional Court’s interpretation of s. 2(1)(b) would eliminate all access to electronically recorded information stored in an institution’s existing computer software where its production would require the development of an algorithm or software within its available technical expertise to create and using software it currently has. In my view, other provisions in the Act and the regulations tell against this interpretation.

Sections 45(1) (b) and (c) of the Act  require the requester to bear the “costs of preparing the record for disclosure” and “computer and other costs incurred in locating, retrieving, processing and copying a record,” in accordance with the fees prescribed by the regulations. Subsections 6(5) and (6) of Reg. 823 were enacted pursuant to s. 45(1)  of the Act . These provisions state:

6. The following are the fees that shall be charged for the purposes of subsection 45(1)  of the Act  for access to a record:

…

5. For developing a computer program or other method of producing a record from machine readable record, $15 for each 15 minutes spent by any person.

6. The costs, including computer costs, that the institution incurs in locating, retrieving, processing and copying the record if those costs are specified in an invoice that the institution has received.

In my view, a liberal and purposive interpretation of those regulations when read in conjunction with s. 2(1)(b), which opens with the phrase “subject to the regulations,” and in conjunction with s. 45(1), strongly supports the contention that the legislature contemplated precisely the situation that has arisen in this case. In some circumstances, new computer programs will have to be developed, using the institution’s available technical expertise and existing software, to produce a record from a machine readable record, with the requester being held accountable for the costs incurred in developing it. [reference omitted]

[43] I found above that Word documents with associated metadata fall within the definition of a record. That said, in keeping with the purposes of the Act and the evolution of data creation, a record that is responsive to the appellant’s request would be a record that includes its associated metadata. An institution faced with such a request would be governed by the various provisions of the Act , including the possible application of exemptions, exclusions and fees [17] .

[44] The city’s position has been somewhat inconsistent with respect to whether version of records responsive to the appellant’s request exist, and/or whether any other versions would contain information that is responsive to the request. In any case, it is evident that the city has not searched for such records.

[45] In all the circumstances, I am not satisfied that the city conducted a reasonable search for responsive records in accordance with its obligations under the Act .

[46] I will, therefore, require the city to respond to the appellant’s request for Word versions of the responsive records, along with associated metadata.

ORDER:

1. The two records with associated metadata, if they exist, are responsive records that are subject to the Act .
2. The city is ordered to conduct a further search for these responsive records, in compliance with its obligations under the Act , and to issue a decision letter to the appellant on or before setting out the manner in which it conducted the search and the results along with an access decision, if responsive records are found.
3. The city is to also to provide the IPC with a copy of the decision letter set out in provision 2.

Original signed by		July 29, 2021
Steven Faughnan
Adjudicator