ORDER MO-4304

Appeal MA21-00587

Niagara Peninsula Conservation Authority

December 20, 2022

Summary: The Niagara Peninsula Conservation Authority (the NPCA) received a request under the Municipal Freedom of Information and Protection of Privacy Act  (the Act ) for records related to a decision by the NPCA to permit the installation of a fence on a particular property. This appeal involves access to one record, an email chain. The NPCA decided that the email chain could be disclosed. A third party objected and appealed to the IPC, claiming that the mandatory exemptions at sections 10(1) (third party information) and 14(1) (personal privacy) apply to exempt the information from disclosure. In this order, the adjudicator upholds the NPCA, in part. She finds that portions of the email chain are exempt under the discretionary exemption at section 38(b) (personal privacy) and orders the NPCA to withhold that information from disclosure. However, she finds that the remaining portions of the email chain are not exempt under the Act , and upholds the NPCA’s decision to disclose those portions of the record to the requester.

Statute Considered: Municipal Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c.M.56 , as amended, sections 2(1)  (definition of “personal information”), 10(1), and 38(b).

OVERVIEW:

[1] The Niagara Peninsula Conservation Authority (the NPCA) received a request under the Act  for records related to a decision by the NPCA to permit the installation of a fence on a particular property.

[2] After the NPCA notified an affected party about the request, the NPCA issued a decision granting access in full to the requester.

[3] The affected party (now the appellant) appealed the NPCA’s decision to the Information and Privacy Commissioner of Ontario (IPC).

[4] During mediation, the mediator spoke to the requester, the appellant and the NPCA. The NPCA confirmed its access decision to disclose the record at issue in full. The requester advised of their continued interest in pursuing the record at issue. The appellant objected to disclosure on the basis of the mandatory exemption at section 10(1) (third party information) as well as the mandatory exemption at section 14 (personal privacy) and/or the discretionary exemption at section 38(b) (personal privacy) of the Act .

[5] No mediation was possible and the appeal was transferred to the adjudication stage of the appeal process, where an adjudicator may conduct an inquiry.

[6] I began a written inquiry under the Act  by sending a Notice of Inquiry, setting out the facts and issues on appeal, first to the appellant, then to the NPCA and the original requester, seeking written representations on the issues set out in the Notice of Inquiry. The appellant and the NPCA did not provide representations in response, but the original requester did (though confidentially). [1]

[7] For the reasons that follow, I uphold the NPCA’s decision, in part. I find that portions of the email chain contain the personal information of the original requester (as well as personal information of other identifiable individuals), and as such, the appropriate personal privacy exemption to consider is section 38(b), not section 14(1). I find that the personal information in the email chain is all exempt under section 38(b), and I order the NPCA not to disclose it to the original requester. However, I find that the remaining portions of the record do not contain personal information and, therefore, cannot be exempt under a personal privacy exemption; I find that these portions of the record are also not exempt under section 10(1), and I dismiss those aspects of the appeal.

RECORD:

The record at issue is a 7-page email chain.

ISSUES:

1. Does the record contain “personal information” as defined in section 2(1) and, if so, whose personal information is it?
2. Does the discretionary personal privacy exemption at section 38(b) apply to the information at issue?
3. Does the mandatory exemption at section 10(1) for third party information apply to the records?

DISCUSSION:

Issue A: Does the record contain “personal information” as defined in section 2(1) and, if so, whose personal information is it?

[8] In order to decide which sections of the Act  may apply to a specific case, the IPC must first decide whether the record contains “personal information,” and if so, to whom the personal information relates.

What is “personal information”?

[9] Section 2(1)  of the Act  defines “personal information” as “recorded information about an identifiable individual.”

Recorded information

[10] “Recorded information” is information recorded in any format, such as paper records, electronic records, digital photographs, videos, or maps. [2]

About

[11] Information is “about” the individual when it refers to them in their personal capacity, which means that it reveals something of a personal nature about the individual. Generally, information about an individual in their professional, official or business capacity is not considered to be “about” the individual. [3] See also sections 2(2.1) and (2.2), which state:

(2.1) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

(2.2) For greater certainty, subsection (2.1) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling.

[12] In some situations, even if information relates to an individual in a professional, official or business capacity, it may still be “personal information” if it reveals something of a personal nature about the individual. [4]

Identifiable individual

[13] Information is about an “identifiable individual” if it is reasonable to expect that an individual can be identified from the information either by itself or if combined with other information. [5]

What are some examples of “personal information”?

[14] Section 2(1)  of the Act  gives a list of examples of personal information. Examples of personal information that are listed in the Act  include information relating to family status, address, and views or opinions. [6] If a person’s name appears in a record with other personal information, their name is also personal information. [7]

[15] The list of examples of personal information under section 2(1) is not a complete list. This means that other kinds of information could also be “personal information.” [8]

Whose personal information is in the record?

[16] It is important to know whose personal information is in the record. If the record contains the requester’s own personal information, their access rights are greater than if it does not. [9] Also, if the record contains the personal information of other individuals, one of the personal privacy exemptions might apply. [10]

[17] Order M-352 establishes that I need to determine whether the record as a whole contains the requester’s personal information, using a “record-by-record approach”, where “the unit of analysis is the record, rather than individual paragraphs, sentences or words contained in a record.”

Portions of the email chain contain personal information of the requester and other identifiable individuals

[18] Based on my review of the email chain at issue, I find that it contains the personal information of the original requester and several identifiable individuals whose interests may be affected by disclosure (affected parties). In the circumstances, I find it reasonable to conclude that all of these individuals may be identified from the information that pertains to them, though the names of most of these individuals do not appear in the email chain.

[19] Rather, the personal information relating to these individuals includes information relating to address, family status, and/or personal views or opinions (which are listed examples of personal information found in the Act ).

[20] In addition, the email chain also contains information that qualifies as the personal information of the original requester, the appellant, and the affected parties under the introductory wording of the definition of “personal information” (that is, “recorded information about an identifiable individual”). The fact that one or more of these parties is discussed in the type of email communications at issue is itself “personal information” under the introductory wording of that term, as is the nature of the relationships that exist between some of these parties amongst each other and the contents of the email chain itself.

[21] I find that some of the personal information in the email chain is the inextricably mixed personal information of more than one identifiable individual, and some is not. For the purpose of this order, it is noteworthy that the personal information of the original requester is highly intermingled with some personal information belonging to an affected party, and cannot be severed from that affected party’s personal information.

The remaining portions of the email chain do not contain personal information

[22] Based on my review of the email chain, I find that the remaining information is correspondence between with the NPCA that is not information about an individual in a personal capacity. Rather, it consists of the questions and answers to and from the NPCA and an affected party regarding the installation of a fence, using the business email address of one of the parties involved. In the circumstances, I find that disclosure of this information would not reveal something of a personal nature about the individual corresponding with the NPCA.

[23] Since the remaining information is not personal information, it cannot be exempt under the personal privacy exemption at section 38(b) and must be disclosed, unless it is subject to another exemption. Here, the appellant has claimed that the email chain is also exempt under section 10(1), which I consider under Issue C.

Conclusion

[24] Since the email chain contains the personal information of the original requester, the relevant personal privacy exemption to consider is the section 38(b) exemption. That is, access to the personal information of individuals (other than the original requester) in this email chain must be considered under section 38(b), which I will do next.

Issue B: Does the discretionary personal privacy exemption at section 38(b) apply to the information at issue?

[25] For the following reasons, I find that the personal information at issue in the email chain is exempt from disclosure under section 38(b), and I will order the NPCA not to disclose it.

[26] Section 36(1)  of the Act  gives individuals a general right of access to their own personal information held by an institution. Section 38 provides some exemptions from this right.

[27] Under the section 38(b) exemption, if a record contains the personal information of both the requester and another individual, the institution may refuse to disclose the other individual’s personal information to the requester if disclosing that information would be an “unjustified invasion” of the other individual’s personal privacy. [11]

[28] The section 38(b) exemption is discretionary. This means that the institution can decide to disclose another individual’s personal information to a requester even if doing so would result in an unjustified invasion of other individual’s personal privacy.

[29] Sections 14(1) to (4) provide guidance in deciding whether the information is exempt under 38(b). In this appeal, I find that sections 14(1) and 14(4) are not relevant. [12]

Unjustified invasion of personal privacy: sections 14(2) and 14(3)

[30] Sections 14(2) and 14(3) also help in deciding whether disclosure would or would not be an unjustified invasion of personal privacy under section 38(b). [13] In deciding whether the disclosure of the personal information in the records would be an unjustified invasion of personal privacy under section 38(b), the decision-maker [14] must consider and weigh the factors and presumptions in sections 14(2) and (3) and balance the interests of the parties. [15]

Section 14(3) – is disclosure presumed to be an unjustified invasion of personal privacy?

[31] The presumption at section 14(3)(f) covers information related to an individual’s finances, income, assets, liabilities, net worth, bank balances, financial history or activities, or creditworthiness. For this presumption to apply, information about an asset must be specific and must reveal, for example, its dollar value or size. [16]

[32] Based on my review of the email chain, I find that a small portion of it contains personal information that falls within the presumption at section 14(3)(f) because it reflects the finances and/or financial activities of one of the affected parties. This weighs against disclosure of the personal information.

[33] I find that no presumption applies to any of the other personal information in the email chain. The analysis below considers this remaining personal information.

Section 14(2): Do any factors in section 14(2) help in deciding if disclosure would be an unjustified invasion of personal privacy?

[34] Section 14(2) lists several factors that may be relevant to determining whether disclosure of personal information would be an unjustified invasion of personal privacy. [17] Some of the factors weigh in favour of disclosure, while others weigh against disclosure.

[35] The list of factors under section 14(2) is not a complete list. The institution must also consider any other circumstances that are relevant, even if these circumstances are not listed under section 14(2). [18]

[36] Each of the first four factors, found in sections 14(2)(a) to (d), if established, would tend to support disclosure of the personal information in question, while the remaining five factors found in sections 14(2)(e) to (i), if established, would tend to support non- disclosure of that information.

[37] Here, none of the parties established that any factors for or against disclosure apply. In the circumstances, I see no basis for finding that any factors favouring disclosure are relevant.

[38] However, from my review of the email chain, in the circumstances, I find that the factor at section 14(2)(f) (the personal information is highly sensitive) applies. Section 14(2)(f) is intended to weigh against disclosure when the evidence shows that the personal information is highly sensitive. To be considered “highly sensitive,” there must be a reasonable expectation of significant personal distress if the information is disclosed. [19] For example, personal information about witnesses, complainants or suspects in a police investigation may be considered highly sensitive. [20] In this appeal, considering the original requester’s confidential representations, and the sensitive nature of the personal information in the email chain itself, in the circumstances, I have no difficulty finding that there is a reasonable expectation of significant personal distress if the personal information in the email chain would be disclosed to the original requester. This weighs against disclosure of the personal information.

Balancing the factors for and against disclosure

[39] In determining whether disclosure of the affected parties’ personal information would constitute an unjustified invasion of personal privacy, I have considered the factors and presumptions at sections 14(2)  and 14(3)  of the Act  in the circumstances of this appeal.

[40] I found that the presumption at section 14(3)(f) applies to some of the personal information at issue.

[41] I also found that there are no factors favouring disclosure to the remaining personal information at issue, and that the factor weighing against disclosure at section 14(2)(f) applies to it.

[42] Weighing the factors and presumptions, and taking into account the interests of the parties, I find that disclosure of any of the personal information at issue in the email chain issue would be an unjustified invasion of personal privacy of the identifiable individuals whose personal information is contained in the record. Since I found that the personal information relating to the original requester is inextricably intermingled with that of an affected party, that means that the personal information of the original requester cannot be disclosed without disclosing the exempt personal information of an affected party.

[43] Therefore, I find that the personal information that I have identified in the email chain is all exempt from disclosure under the personal privacy exemption at section 38(b). Given the NPCA’s decision and the information I have found exempt under section 38(b), I am prepared to accept the NPCA did not exercise its discretion in bad faith or taking into account irrelevant considerations.

[44] I will now consider whether the remaining portions of the email chain, which do not contain personal information, are exempt under section 10(1)  of the Act .

Issue C: Does the mandatory exemption at section 10(1) for third party information apply to the records?

[45] The purpose of section 10(1) is to protect certain confidential information that businesses or other organizations provide to government institutions, [21] where specific harms can reasonably be expected to result from its disclosure. [22]

[46] Section 10(1) states, in part:

A head shall refuse to disclose a record that reveals a trade secret or scientific, technical, commercial, financial or labour relations information, supplied in confidence implicitly or explicitly, if the disclosure could reasonably be expected to,

[list of harms specified in paragraphs (a) – (d)].

[47] For section 10(1) to apply, the party opposing disclosure (in this appeal, that is the appellant) must satisfy each part of the following three-part test:

1. the record must reveal information that is a trade secret or scientific, technical, commercial, financial or labour relations information;
2. the information must have been supplied to the institution in confidence, either implicitly or explicitly; and
3. the prospect of disclosure of the record must give rise to a reasonable expectation that one of the harms specified in paragraph (a), (b), (c) and/or (d) of section 10(1) will occur.

[48] Without representations from the appellant, it cannot be said that their onus of proof has been satisfied.

[49] However, since section 10(1) is a mandatory exemption, I must also examine the record itself to determine whether I can discern that section 10(1) applies to it, in the circumstances. Given my finding about part two of the test, it is not necessary to discuss parts one and three, since all three parts of the test must be met for section 10(1) to apply.

Part 2: supplied in confidence

Supplied

[50] The requirement that the information have been “supplied” to the institution reflects the purpose in section 10(1) of protecting the informational assets of third parties. [23] Information may qualify as “supplied” if it was directly supplied to an institution by a third party, or where its disclosure would reveal or permit the drawing of accurate inferences with respect to information supplied by a third party. [24]

[51] In the circumstances, I find that portions of information in the email chain were supplied to the NPCA by a third party. It is clear on the face of the information that this was the case.

In confidence

[52] The party arguing against disclosure must show that both the individual supplying the information expected the information to be treated confidentially, and that their expectation is reasonable in the circumstances. This expectation must have an objective basis. [25]

[53] Without representations from the appellant or the NPCA, and based on my review of the email chain, I find that there is insufficient evidence before to me to conclude that the third party supplied the relevant portions of information to the NPCA in confidence (either explicitly or implicitly). As a result, this information does not meet part two of the test, and is, therefore, not exempt under section 10(1)  of the Act .

[54] In conclusion, I allow the appeal, in part. I find that portions of the email chain are exempt under section 38(b), and I will order that the NPCA withhold that information from the original requester. However, I uphold the NPCA’s determination that the remainder of the email chain should be disclosed, and I dismiss those aspects of the appellant’s appeal.

ORDER:

1. I allow the appeal, in part.
2. I order the NPCA not to disclose the personal information that is exempt under section 38(b) in the record. To be clear, I have identified the portions of the record that the NPCA must not disclose to the original requester by highlighting them in yellow on the copy of the record provided to the NPCA with this order.
3. I order the NPCA to disclose the remaining portions of the record to the original requester by February 1, 2023, but not before January 27, 2023.
4. In order to verify compliance with this order, I reserve the right to require the NPCA to send me a copy of the record as disclosed to the requester.

Original Signed By:		December 20, 2022
Marian Sami
Adjudicator