INTERIM ORDER MO-4310-I

Appeal MA20-00035

York Region District School Board

December 23, 2022

Summary: A request was made to the York Region District School Board (the board) for information relating to its data management system including meeting notes that were taken when board representatives met with one of the appellants. The board issued a decision providing access in full to some of the responsive information and withholding certain information under sections 38(a) read with sections 7(1) (advice or recommendation), 8(1)(c) (law enforcement technique), 12 (solicitor-client privilege) and 38(b). In this order, the adjudicator upholds, in part, the board’s reliance on section 14(1), 38(b), 7(1), 38(a) read with 7(1). He upholds the board’s claim under section 38(a), read with section 12. He does not uphold the board’s reliance on section 38(a), read with section 8(1). Finally, the adjudicator finds that the board’s search is not reasonable and orders them provide evidence of the search they conducted for responsive records.

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act  R.S.O. 1990, c. M.56, sections 2(1)  (definition of “personal information”), 7(1), 8(1)(c), 17, 38(a), 38(b).

Orders and Investigation Reports Considered: Orders P-470 and PO-4047.

Cases Considered: John Doe v. Ontario (Finance), 2014 SCC 36.

OVERVIEW:

[1] The appellants [1] are parents of a student at one of the York Region District School Board’s (the board) schools. One of the appellants, after downloading student profile pictures, informed the board of security inadequacies in the board’s data management system. In turn, the board referred the matter to the police, resulting in a criminal investigation against the appellant which is now concluded. The other appellant, made the following request under the Municipal Freedom of Information and Protection of Privacy Act  (the Act ) to the board:

copies of all emails/documentation regarding the procurement of the student data management system (which was awarded to [named company]) and the parental concerns over the use of that system and the protection of student data.

Specifically, please include:

• A copy of the original call for tender documentation YRDSB issued in its pursuit of an online student management system (which was awarded to [named company]). Please include all bidder submissions including the unsuccessful bidders. Please include the successful bid documentation by [named company] and all documentation submitted as part of that tender process. Please also include where the call for tender was posted and for how long.

• On [a specified date,] [requester’s name] met with [named person] and [named person at a public school] regarding the [named company] platform. At that meeting copious notes were taken by [named person]. Please provide a copy of the notes taken by [named person] at that meeting. Please also include any emails or other correspondence sent by [named person] or [named person] to any other YRDSB employee/representative/contractor regarding that meeting.

• On [a specified date,] [requester’s name] met with [named person], [named person], and [named person] at the YRDSB offices in Aurora regarding the [named company] platform. Please provide a copy of all handwritten notes taken during that meeting by [named person], [named person] or [named person] and any emails or other correspondence about that meeting sent by those individuals to and from any other YRDSB staff including [named person], [named person], and [named person].

• On [a specified date,] [requester’s name] met with [named person], [named person], and [named person] and representatives from named company] at the YRDSB office in Aurora about the [named company] platform. Please provide a copy of all handwritten notes taken during that meeting by [named person], [named person] or [named person] and any emails or other correspondence about that meeting sent by those individuals to and from any other YRDSB staff including [named person], [named person], and [named person] and any [named company] employees/representatives.

• On [a specified date,] YRDSB issued a 'Cease and Desist' letter to [respondent’ name] through the [named law firm] law firm. Please include copies of all email/correspondence from any YRDSB employee to/from any [named law firm] employees regarding [requester’s name] and this matter.

• On [a specified date,] [requester’s name] sent an email to all YRDSB school trustees (and others) regarding the Board's handling of the [named company] privacy breach. Please provide copies of all emails or other correspondence between [named person], [named person], [named person], [named person], [named person], [named person], and/or [named person], to and from the YRDSB school trustees regarding that email from [appellant’s name]. Please ensure to include the emails/correspondence directing the trustees how to respond to that email and to the matter in general.

• On [a specified date,] York Region Police contacted [appellant’s name] at the request of [named person] of YRDSB. Please include copies of all emails/correspondence and/or hand written notes taken by named person] or any other YRDSB employee to/from any York Region Police staff regarding this request and the ensuing investigation.

[2] In its initial decision [2] , the board denied access to the records on the basis of sections 7(1) (advice or recommendation), 8(1) (law enforcement), 10(1) (third party information), 11 (economic and other interests) and 12 (solicitor-client privilege) of the Act .

[3] The appellant appealed the board’s decision to the Information and Privacy Commissioner of Ontario (the IPC) and a mediator was assigned to explore possible resolution with the parties. During mediation, the mediator had discussions with both the board’s representative and the appellant about the records and issues on appeal.

[4] During mediation, several discussions occurred between the parties with the following result:

• The board confirmed that there was no longer an ongoing police investigation
• Information withheld under sections 10(1), 11 and not responsive information are no longer at issue
• The application of sections 38(a) and 38(b) were added to the scope of the appeal
• Reasonable search was added to the scope of the appeal.

[5] Mediation did not resolve the appeal and the file was moved to the adjudication stage of the appeal process.

[6] The original adjudicator commenced an inquiry and invited representations from the board and individuals whose interests may be affected by disclosure of the records (the affected parties). The adjudicator provided a copy of the non-confidential portions of the board’s representations to the appellants and invited them to provide representations. While several affected parties contacted the IPC after being notified, only two provided representations, each indicating that they consent to the disclosure of their personal information contained in certain records. I was then assigned to the file to continue with the adjudication. The board was asked to provide reply representations which it did. While I sought additional representations from the appellants, they chose to rely on their earlier submissions.

[7] In this order, I uphold the board’s reliance on section 38(b), in part. I find that section 38(a), read with section 12, applies to the information claimed in record 4. I also find that section 38(a), read with section 7(1), and section 7(1) alone applies to part of information the board claimed was exempt. I do not uphold the board’s reliance on section 38(a), read with 8(1)(c). Finally, I find that the board’s search for responsive information is not reasonable and order the board to provide evidence of the search it conducted for responsive records.

RECORDS:

[8] There are 26 records at issue including meeting minute notes and emails which were fully withheld. The board provided an index that was shared with the appellants and is attached at the appendix of this order.

[9] During the course of the inquiry the board issued a supplementary decision in which it disclosed parts of record/tab 173 and part of record 4. The information that was disclosed is no longer in dispute.

ISSUES:

1. Do the records contain “personal information” as defined in section 2(1) and, if so, whose personal information is it?
2. Does the mandatory personal privacy exemption at section 14(1) or the discretionary personal privacy exemption at section 38(b) apply to the information at issue?
3. Does the discretionary exemption at section 38(a), read with the section 7(1) exemption for advice or recommendations, apply to the information at issue?
4. Does the discretionary exemption at section 38(a), read with the section 8(1)(c) exemption for law enforcement techniques, apply to the information at issue?
5. Does the discretionary exemption at section 38(a), read with the section 12 exemption for solicitor-client privilege, apply to the information at issue?
6. Did the institution exercise its discretion under sections 38(a), 38(b), 7(1), 8(1)(c) or 12, as the case may be? If so, should the IPC uphold the exercise of discretion?
7. Did the institution conduct a reasonable search for records?

DISCUSSION:

Issue A: Do the records contain “personal information” as defined in section 2(1) and, if so, whose personal information is it?

[10] Under the Act, different exemptions may apply depending on whether a record at issue contains or does not contain the personal information of the requester. [3] Where the records contain the requester’s own personal information, access to the records is addressed under Part II of the Act and the discretionary exemptions at section 38(b) may apply. Where the records contain the personal information of individuals other than the requester but do not contain the personal information of the requester, access to the records is addressed under Part I of the Act and the mandatory exemption at section 14(1) may apply.

[11] Accordingly, in order to determine which sections of the Act  may apply, it is necessary to decide whether the record contains “personal information” and, if so, to whom it relates. That term is defined in section 2(1) as follows:

“personal information” means recorded information about an identifiable individual, including,

(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

(c) any identifying number, symbol or other particular assigned to the individual,

(d) the address, telephone number, fingerprints or blood type of the individual,

(e) the personal opinions or views of the individual except if they relate to another individual,

(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

(g) the views or opinions of another individual about the individual, and

(h) the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

[12] The list of examples of personal information under section 2(1) is not exhaustive. Therefore, information that does not fall under paragraphs (a) to (h) may still qualify as personal information. [4]

[13] Section 2(2) also relates to the definition of personal information. These sections state:

(2.1) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

(2.2) For greater certainty, subsection (3) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling.

[14] To qualify as personal information, the information must be about the individual in a personal capacity. As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be “about” the individual. [5]

[15] Even if information relates to an individual in a professional, official or business capacity, it may still qualify as personal information if the information reveals something of a personal nature about the individual. [6]

[16] To qualify as personal information, it must be reasonable to expect that an individual may be identified if the information is disclosed. [7]

Representations [8]

[17] The board submits that the records found at tabs (records) 171 to 195 contain communications between it and parents of students of the board. It submits that the records were created and received after the board advised the community of a data breach involving its student data management system.

[18] The board notes that the appellants have indicated that they are not interested in obtaining access to the personal information contained within the records at tab 171 to 195. However, it submits that as most of the information contained within these records is personal information, it would be impractical and futile to attempt to sever the personal information and disclose the records.

[19] The board submits that the records contain “personal information”, as defined in section 2(1)  of the Act . It refers to Order M-486 and submits that the IPC has previously recognized that correspondence from parents to a school board contains personal information.

[20] The board submits that these records contain the names, contact information, personal opinions and views of the parents, in their personal capacities, and information relating to the marital status and family status of the parents. Furthermore, it submits that as the correspondence sent to the board by the parents discussed a data breach involving their children, the correspondence was implicitly and explicitly private in nature and the replies to the correspondence would reveal the contents of the original correspondence.

[21] The board submits that some records contain one of the appellant’s personal information. However, it submits that disclosure of these records is not permitted under section 38(b) as the disclosure would constitute an unjustified invasion of another individual’s personal privacy (i.e. the other parents), and by virtue of the operation of sections 7 and 8.

The appellants’ representations

[22] The appellants were provided with a severed version of the board’s representations and provided their own representations. They submit that at no time did they request the personal information of any parents or children. The appellant submits that parents were given the opportunity to speak to the board’s records manager and privacy office during the time the board and its Director made false allegations about the nature and intent of the appellants’ alleged access to their children’s data. The appellant submits that they are seeking to these recorded discussions between the board and the parents and they are not seeking the names or any other personal information related to them.

[23] The appellants submit that since they are not looking for identifying personal information, they reject the notion that personal opinions constitute personally identifiable information, and this information should not be redacted.

Analysis and finding

[24] Based on my review of the withheld information, I find that some of it qualifies as the personal information of the identifiable individuals. Some of the information of identifiable individuals is mixed with information that qualifies as the personal information of one of the appellants within the meaning of paragraphs (a), (d), (e), (g) of the definition that term in section 2(1)  of the Act .

[25] The board fully withheld the emails sent by parents as they contained the personal information of both an identifiable individual and the appellant and could not be severed in a way that it could disclose only the appellant’s personal information. The appellants take issue with the claim that the parents’ emails exclusively contain personal information noting that they are not seeking the names or other personal information relating to the affected parties.

[26] Although the appellants have indicated that they do not want the personal information of the parents who communicated with the board, the views and opinions of the parents still constitute personal information for the purposes of section 2(1). After reviewing the withheld information in the records 175, 177, 179, 180, 181, 182, 183, 184, 185, 187, 188, 189, 190 and 194, I find the withheld information is the personal information of identifiable individuals. Similarly, records 171, 172, 173, 174, 178, 186, 191 and 192 contain information that qualifies as the personal information of identifiable individuals but they also contain the personal information of one of the appellants. I find that this information cannot be severed to disclose the appellant’s personal information to her/him and I will consider the appellant’s access to it in section 38(b) below.

[27] As noted by the board, record 4 contains the appellant’s personal information and I will consider the appellant’s access to this information under section 38(a) read with section 8(1)(c) below.

[28] After reviewing record 195, I find that it contains the personal information of the appellant and any remaining identifying information pertains to an affected party in their professional capacity and is not personal information. I will order the board to disclose the information in this record on the highlighted copy of the record that accompanies this order. I will consider whether the remaining information in this record is exempt under section 38(a), read with section 7(1).

[29] However, I do not find that all of the withheld information is personal information as defined under the Act . Based on my review, I find that record 176, including the document attached to it, does not contain information that would qualify as the personal information of an identifiable individual, including the appellants. Further, the board’s representations do not explain why certain information was withheld under section 38(b) and certain information withheld under section 14(1). I note that the attachment to record 176 contains thumbnail photos of students that have been fully redacted. As the appellants have indicated that they are not pursuing the personal information of identifiable individuals, I find the remaining information on this page does not include the personal information of any individual. As the board has not claimed any discretionary exemptions for this information and no other mandatory exemptions apply, I will order this information disclosed to the appellants. However, since it also claims that some information in this record is exempt under section 38(a), read with section 7(1), I will analyze that information below. [9]

[30] After reviewing record 193, it is clear that it contains no personal information and the board is claiming section 7(1) for the severed information. I will review this record below

[31] Also, in addition to claiming the parent’s correspondence is personal information, the board has severed information in records 175, 178, 183 and 184 which includes its responses to parents. After my review of the content of the board’s responses, I find that only the affected parties’ names and contact information would qualify as personal information and this information is not at issue in this appeal. The remainder of the information does not contain the personal information of affected parties. In my view, the board’s responses are informational and I find that nothing personal would be revealed by their disclosure. As only personal information can be withheld under section 14(1) and the board has not claimed any discretionary exemptions for this information and no other mandatory exemptions apply, I will order it disclosed to the appellant.

[32] Regarding record 186, the board has not provided severances to the emails that are attached to this email chain. After reviewing the six email attachments, it is clear they contain a parent’s correspondence and the board’s response to same. Given my findings above, I find that the parent correspondence is considered personal information but the board responses do not contain any personal information other than the name and/or contact information of the parent which is not in dispute in this appeal. I will order the board to provide to the appellants its responses to the parents in these six attachments, after it has redacted the name of the parent and any contact information, if it appears.

Issue B: Does the mandatory personal privacy exemption at section 14(1) or the discretionary personal privacy exemption at section 38(b) apply to the information at issue?

[33] Section 36(1)  of the Act  gives individuals a general right of access to their own personal information held by an institution. Section 38 provides some exemptions from this right.

[34] Under the section 38(b) exemption, if a record contains the personal information of both the requester and another individual, the institution may refuse to disclose the other individual’s personal information to the requester if disclosing that information would be an “unjustified invasion” of the other individual’s personal privacy.

[35] The section 38(b) exemption is discretionary. This means that the institution can decide to disclose another individual’s personal information to a requester even if doing so would result in an unjustified invasion of the other individual’s personal privacy. [10]

[36] In contrast, under section 14(1), where a record contains personal information of another individual but not the requester, the institution cannot disclose that information unless one of the exceptions in sections 14(1)(a) to (e) applies, or the section 14(1)(f) exception applies, because disclosure would not be an “unjustified invasion” of the other individual’s personal privacy.

[37] Also, the requester’s own personal information, standing alone, cannot be exempt under section 38(b) as its disclosure could not, by definition, be an unjustified invasion of another individual’s personal privacy. [11]

[38] Sections 14(1) to (4) provide guidance in deciding whether the information is exempt under section 14(1) or 38(b), as the case may be.

[39] Since I have found that records 175, 177, 179, 180, 181, 182, 183, 184, 185, 187, 188, 189, 190, 193 and 194 contain the personal information of affected parties, I must consider whether section 14(1) applies to this information. Since I have found that records 171, 172, 173, 174, 178, 186, 191, 192 contain the personal information of an affected party as well as the personal information of the appellant, I must consider whether section 38(b) applies to this information.

Representations

[40] The board submits that the withheld information in records 171 to 195 should be exempt under section 14(1). It submits that these records contain communications between it and parents and were received after the board advised the community of the data breach.

[41] The board submits that the disclosure of the parent’s commentary on the data breach is presumed to be an unjustified invasion of personal privacy under section 14(3)(g) as all of the records contain personal recommendations and/or evaluations.

[42] The board submits that the correspondence from the parents contains information that is highly sensitive and was sent in confidence as it contains discussions between the board and parents about a data breach involving student information. It submits that the correspondence was sent directly to the board. The board submits that if the parents intended for their correspondence to be public, they could have copied other individuals, posted it on an online forum or social media. The board submits that since they did not do this, they wanted to keep their communication confidential. It submits that sections 14(2)(f) and (h) weigh in favour of privacy protection.

[43] The board submits that as the information contains the personal opinions of parents regarding the data breach and the student data management system, much of it is unlikely to be reliable or accurate. Therefore, it submits that section 14(2)(g) applies and weighs in favour of privacy protection.

[44] The appellants submit that sections 14(2)(f) (highly sensitive) and (h) (supplied in confidence) should not apply in this appeal to withhold information. They submit that the board made the direct allegation that one of the appellants caused the data breach, for which, by their own admission, the board was actually responsible. The appellants submit that sections 14(2)(f) and (h) are no more than tangentially relevant to privacy as they expressly insist that no personal information be exchanged. The appellants refer to the importance of the information collected and the manner by which it was collected, under presumption of guilt of the reporting party and for the specific purpose of finding any incriminating evidence that could be used to further persecute the appellant. The appellants submit this is a factor favouring disclosure of the withheld personal information.

[45] In response to the board’s claim that section 14(2)(g) (unlikely to be reliable) applies, the appellant submit that the information is of crucial importance in determining the appropriateness of the board’s actions and should be provided with the personal information redacted.

Analysis and finding

Section 14(1)(a) – consent

[46] As noted, during the inquiry, affected parties were invited to provide representations concerning disclosure of their personal information. While most of the affected parties contacted the IPC for more information, only two affected parties actually provided representations, each consenting to the release of some information. As a result, section 14(1) (a) of the Act  is relevant to this personal information, and states:

A head shall refuse to disclose personal information to any person other than the individual to whom the information relates except,

(a) upon the prior written request or consent of the individual, if the record is one to which the individual is entitled to have access;

[47] Consequently, I find that section 14(1)(a) applies to these affected parties’ personal information, and that because they have provided consent to disclose their personal information to the appellant, this information is not exempt from disclosure under section 14(1). This personal information is contained in records 171, 174, 183, 191 and 192 and will be ordered disclosed. I will order the board to disclose the parents’ correspondence in records 171 and 174 (without names or contact information which are not in dispute in this appeal) and I will highlight the personal information at issue in records 183, 191 and 192 and order the board to disclose this information to the appellants.

Section 14(3) presumptions

[48] The board claims that section 14(3)(g) applies to the withheld personal information. If this presumption applies to the information, then disclosure is presumed to be an unjustified invasion of personal privacy. This section states:

A disclosure of personal information is presumed to constitute an unjustified invasion of personal privacy if the personal information,

(g) consists of personal recommendations or evaluations, character references or personnel evaluations.

[49] The university submits that this presumption applies because all of the records contain personal recommendations and/or evaluations.

[50] In Order P-470 when examining if the presumption at section 21(3)(g) (the provincial equivalent to section 14(3)(g)) applied, the adjudicator held that the information at issue was “not sufficiently detailed to attract the application of the presumption,” because it consists of “very general comments” made by the panelists about the candidates and their performance during a competition. In Order PO-4047 the adjudicator found that information that describes views about an identifiable individual, their performance and their ability to fulfill certain positions within an organization fell within the scope of the section 21(3)(g) presumption and weighed in favour of a finding that disclosure would be an unjustified invasion of an identifiable individual’s personal information. I accept the approach in these two orders.

[51] After reviewing the personal information at issue in this appeal, I find that the presumption at section 14(3)(g) does not apply to the information. While I find that the information consists of personal views or opinions of an affected party, it is not an assessment made according to measurable standards, implying an evaluation in a more formal way. As a result, I find that the presumption at section 14(3)(g) does not apply.

[52] I will now turn to the section 14(2) factors weighing for and against disclosure.

Section 14(2) factors

[53] Section 14(2) lists various factors that may be relevant in determining whether disclosure of personal information would constitute an unjustified invasion of personal privacy. [12] Some of the factors listed in section 14(2), if present, weigh in favour of disclosure, while others weigh in favour of non-disclosure. The list of factors under section 14(2) is not exhaustive. The institution must also consider any circumstances that are relevant, even if they are not listed under section 14(2). [13]

[54] While the board pointed to specific factors in its representations that might apply, the appellants do not refer specifically to section 14(2) for factors in favour of disclosure. The appellants submit they should know what others said about them to the board or what the board may have alleged about them to other parents. I accept that this is an unlisted factor favouring disclosure of the withheld personal information. However, after reviewing the limited personal information of the appellant that is mixed with the personal information of an affected party and given my findings concerning the board responses, I do not give this unlisted factor significant weight.

[55] Besides considering the unlisted factor raised by the appellants, I also consider the factors favouring non-disclosure in sections 14(2)(f), (g) and (h). These sections state:

(2) A head, in determining whether a disclosure of personal information constitutes an unjustified invasion of personal privacy, shall consider all the relevant circumstances, including whether,

(f) the personal information is highly sensitive;

(g) the personal information is unlikely to be accurate or reliable;

(h) the personal information has been supplied by the individual to whom the information relates in confidence.

[56] Given my review of the circumstances in this appeal, I accept that the factor favouring non-disclosure of the withheld information in section 14(2)(h) applies and should be given significant weight given the circumstances. I find that the unlisted factor favouring disclosure of the withheld information while relevant to the appellants is not significant enough to outweigh the factor favouring non-disclosure.

[57] Accordingly, I find the information withheld under sections 14(1) and 38(b) are exempt. I have also considered whether the appellant’s own information could be severed from the records but I find that the personal information is inextricably linked to the affected parties’ personal information and severing would only result in meaningless snippets.

Issue C: Does the discretionary exemption at section 7(1) or the discretionary exemption at section 38(a), allowing an institution to refuse access to a requester’s own personal information, read with the section 7(1) exemption for advice or recommendations, apply to the information at issue?

[58] The board submits that section 7(1) applies with regard to some of the withheld information in records 179, 183, 188 and 193, and also submits that 38(a) in conjunction with section 7(1) applies to records 173-178, 182, 184-187, 191, 192 and 195. As noted, after my review of the withheld information, I find that records 175, 177, 182, 184 and 185 do not contain the personal information of the appellant and will be analysed under section 7(1).

[59] Section 36(1) gives individuals a general right of access to their own personal information held by an institution. Section 38 provides a number of exemptions from this right.

[60] Section 38 (a) of the Act  reads:

A head may refuse to disclose to the individual to whom the information relates personal information,

if section 6, 7, 8, 8.1, 9, 9.1, 10, 11, 12, 13 or 15 would apply to the disclosure of that personal information.

[61] Section 7(1)  of the Act , states:

7(1) A head may refuse to disclose a record if the disclosure would reveal advice or recommendations of an officer or employee of an institution or a consultant retained by an institution.

[62] Section 38(a) (“may” refuse to disclose) recognizes the special nature of requests for one’s own personal information and the desire of the Legislature to give institutions the power to grant requesters access to their own personal information. [14]

[63] The purpose of section 7(1) is to preserve an effective and neutral public service by ensuring that people employed or retained by institutions are able to freely and frankly advise and make recommendations within the deliberative process of government decision-making and policy-making. [15] “Advice” and “recommendations” have distinct meanings. “Recommendations” refers to material that relates to a suggested course of action that will ultimately be accepted or rejected by the person being advised, and can be express or inferred. “Advice” has a broader meaning than “recommendations”. It includes “policy options”, which are lists of alternative courses of action to be accepted or rejected in relation to a decision that is to be made, and the public servant’s identification and consideration of alternative decisions that could be made.

Representations

[64] The board submits that records 171 to 195 contain communications between it and parents of students of the board. It submits that the records were created and received after the board advised the community of a data breach involving the student data management system used by it.

[65] The board submits that it refused to disclose various records pursuant to section 7(1)  of Act , as they contained advice and recommendations from board employees. It submits that after advising the community of the data breach and receiving communications from parents regarding same, the board employees exchanged advice and recommendations. It submits that its employees discussed the parent communications, shared their opinions and discussed how to respond. The board submits that such communications are exactly what section 7(1)  operates to protect.

[66] The appellants refer to the purpose of the section 7(1) exemption and submit that there is no way the exemption could apply to the withheld information which they submit is merely a way for the board to withhold information that was used to wrongly initiate a criminal investigation by law enforcement to simultaneously intimidate him into silence.

[67] The appellants submit that the board maintaining the confidentiality of these records is not only a suggestion as to the potential for embarrassment posed by the exposure of the institution’s disastrous mishandling of this breach, but to the actions taken by its sole employee charged with finding incriminating evidence on the appellant. The appellants submit that section 7(1) is not intended to obscure the misdeeds of a group of administrators in the wake of an incident they were neither prepared for, nor took adequate steps to responsibly address.

Analysis and finding

[68] As stated in John Doe v. Ontario (Finance) [16] , the section 7(1) exemption aims to preserve a neutral public service by ensuring that people employed or retained by the institution are able to freely and frankly advise and make recommendations within the deliberative process of government decision-making and policy-making. As noted, advice involves an evaluative analysis of information and is broader than recommendations which refers to material that relates to a suggested course of action that will ultimately be accepted or rejected by the person being advised, and can be expressed or inferred. Neither “advice” nor “recommendations” include “objective information” or factual material.

Record 173

[69] After reviewing the information that was severed in this record under section 38(a) read with section 7(1), I find that the first severance contains a course of action that can be either accepted or rejected and constitutes a recommendation However, the second severance does not contain advice or recommendations. Therefore, I uphold the board’s exemption claim for the first severance in this record.

Records 174, 175, 176, 179,

[70] After reviewing the information that was severed in these records under section 38(a) read with section 7(1), I find that the information does not include advice or recommendations and should be disclosed to the appellants. I find that there is no evaluative analysis to the information, nor is there a suggested course of action that will ultimately be accepted or rejected.

Record 177, 185, 188

[71] After reviewing these records, I find that they contain the advice and recommendations of a board employee concerning how to respond to a parent’s correspondence. As a result, I uphold the board’s reliance on section 7(1) in this instance.

Record 182

[72] There are three excerpts that the board submits consist of advice or recommendations in this record. After reviewing this information, I find that only the second excerpt contains a recommendation because it suggests course of action that will ultimately be accepted or rejected. I find that this information is exempt under section 7(1). However, I find the remaining information is not advice or recommendation and disclosure of this information would not reveal the substance of the recommendation that I have found exempt. As the board has not claimed any other discretionary exemptions for this information and no mandatory exemptions apply to it, I will highlight this information and order the board to disclose it.

Record 183

[73] Similar to record 182, the board has severed three excerpts in this record as advice or recommendations. I find that only the second excerpt contains advice and recommendations because it suggests course of action that will ultimately be accepted or rejected. I find that this information is exempt under section 7(1). I find the remaining information is not advice or recommendation and disclosure of this information would not reveal the substance of the recommendation that I have found exempt. As the board has not claimed any discretionary exemptions for this information and no mandatory exemptions apply to it, I will order the board to disclose it.

Record 184

[74] After reviewing the information withheld under section 7(1) in this record, I find that the first and second excerpts contain a recommendation that can ultimately be accepted or rejected. The third excerpt does not suggest a course of action that will be accepted or rejected. Therefore, I uphold the board’s exemption claim for the first and second severance in this record.

Record 186

[75] After reviewing the information the board severed under section 38(a), read with section 7(1), I find that it contains advice and recommendations concerning how to respond to parent correspondence. I uphold the board’s claim that this information is exempt under section 38(a), read with section 7(1). As a result, I uphold the board’s reliance on section 38(a), read with 7(1) in this instance.

Record 191

[76] After reviewing the information the board severed under section 38(a), read with section 7(1), I find that it contains advice and recommendations concerning how to respond to parent correspondence. I uphold the board’s claim that this information is exempt under section 38(a), read with section 7(1). As a result, I uphold the board’s reliance on section 38(a), read with 7(1) in this instance. [17]

Record 192

[77] The board has severed two excerpts in this record under section 38(a), read with section 7(1). After reviewing this information, I agree that the second excerpt contains advice relating to responding to a parent and is properly withheld. However, the first excerpt does not contain any suggested course of action that will be accepted or rejected. Further, I find that disclosing the first excerpt would not permit the accurate inference of any advice or recommendation. I do not uphold the exemption claim for this information and will highlight the information I will order the board to disclose.

Record 193

[78] After reviewing the two excerpts the board claims are exempt under section 7(1), I find that neither excerpt contains a suggested course of action that will be accepted or rejected. Furthermore, disclosure of the withheld information would not permit the accurate inference of any advice or recommendations. I do not uphold the exemption claim for this information, and will order the board to disclose all information, except the severed personal information of an affected party.

Record 195

[79] After reviewing this record, I find that it contains advice and recommendations concerning how a board employee should respond to a journalist’s inquiry. As a result, I uphold the board’s reliance on section 38(b), read with 7(1) in this instance.

Conclusion

[80] I uphold the board’s claim that the discretionary exemption at section 38(a), read with section 7(1) applies to the all of information where this is claimed in records 186, 191 and 195, and applies in part, to record 192. I will highlight the information that should be disclosed in record 192 and order the board to disclose it to the appellant.

[81] I uphold the board’s claim that the discretionary exemption at section 7(1) applies, to records 173, 177, 184, 185, 188, and applies, in part, to records 182 and 183, subject to my findings concerning the board’s discretion, below. I will highlight the information that should be disclosed in records 182 and 183, and order the board to disclose it to the appellant. I find that neither the discretionary exemption at section 38(a), read with section 7(1) nor section 7(1) apply to records 174-176, 179 and 193 and I will order the board to disclose this information to the appellant.

[82] I have also considered whether any of the mandatory exceptions to the section 7(1) exemption in section 7(2) apply to the information I have found exempt. Based on my review, I find that none of the exceptions in section 7(2) apply to the information I have found to be exempt.

Severance

[83] Section 4(2)  of the Act  obliges the institution to disclose as much of any responsive record as can reasonably be severed without disclosing material which is exempt. I have considered whether the remaining information I have found not exempt under section 7(1) should be disclosed to the appellants. The information in records 173, 177, 184, 185, 186, 188 and 191 largely consists of a general request for assistance, dates, email addresses and other administrative information. After a review of the records and given the findings made, I find that this information, if disclosed, would be meaningless snippets. [18]

Issue D: Does the discretionary exemption at section 38(a), allowing an institution to refuse access to a requester’s own personal information, read with the section 8(1)(c) exemption for law enforcement, apply to the information at issue?

[84] The board withheld portions of records 4 and 191 on the basis that although these records contain the personal information of the appellant, they also contain information that is exempt from disclosure under section 8(1)(c) and this information is therefore exempt from disclosure under section 38(a), read with section 8(1)(c).

[85] As noted, section 36(1) gives individuals a general right of access to their own personal information held by an institution. Section 38 provides a number of exemptions from this right.

[86] Section 8(1) (c) of the Act , states:

8(1) A head may refuse to disclose a record if the disclosure could reasonably be expected to,

(c) reveal investigative techniques and procedures currently in use or likely to be used in law enforcement.

[87] Section 38 (a) of the Act  recognizes the special nature of requests for one’s own personal information and the desire of the legislature to give institutions the power to grant requesters access to their personal information. [19]

[88] For section 8(1)(c) to apply, the institution must show that disclosing the investigative technique or procedure to the public could reasonably be expected to interfere with its effective use. The exemption normally will not apply where the technique or procedure is generally known to the public. [20]

[89] The technique or procedure must be “investigative;” that is, it must be related to investigations. The exemption will not apply to techniques or procedures related to “enforcing” the law. [21]

[90] The board submits that the minutes in record 4 reference board communications with a detective from the York Regional Police. The board denied access pursuant to section 8(1)(c) as the record contains information related to the police’s criminal investigation into the data breach, including the police actions, procedures and developments. Additionally, for the withheld information in record 191, the board submits that it denied access to the information as it related to the criminal investigation into the data breach. The board submits that the police specifically requested that it keep information regarding their investigation of the matter confidential.

Finding

[91] The board did not refer to any investigative technique or procedure currently in use, that could reasonably be expected to interfere with its effective use by disclosure of the information in these records. Despite its submission that the police asked it to keep information confidential, the board did not elaborate on the reasons why the police made this request. After reviewing the information in these records, I am unable to find that disclosure of the withheld information in records 4 and 191 could reasonably be expected to reveal investigative techniques and procedures currently in use or likely to be used in law enforcement. Accordingly, I find that none of the information qualifies for exemption under section 38(a), read with section 8(1)(c).

Issue E: Does the discretionary exemption at section 38(a), allowing an institution to refuse access to a requester’s own personal information, read with the section 12 exemption for solicitor- client privilege, apply to the information at issue?

[92] The board claims that a portion of the withheld information in record 4 (part of page 3 and top of page 4) is exempt because it is subject to solicitor-client privilege. Having found that this information includes the personal information of the appellant, I will examine if the withheld information is exempt under section 38(a), read with the solicitor-client privilege exemption at section 12.

[93] Section 12  of the Act  states:

A head may refuse to disclose a record that is subject to solicitor-client privilege or that was prepared by or for counsel employed or retained by an institution for use in giving legal advice or in contemplation of or for use in litigation.

[94] Section 12 contains two different exemptions, referred to in previous IPC decisions as “branches.” The first branch (“subject to solicitor-client privilege”) is based on common law. The second branch (“prepared by or for counsel employed or retained by an institution…”) is a statutory privilege created by the Act . The institution must establish that at least one branch applies. In this case, the board argues that the information is subject to common law solicitor-client communication privilege.

Branch 1: common law privilege

[95] At common law, solicitor-client privilege encompasses two types of privilege:

• solicitor-client communication privilege, and
• litigation privilege.

Common law solicitor-client communication privilege

[96] The rationale for the common law solicitor-client communication privilege is to ensure that a client may freely confide in their lawyer on a legal matter. [22] This privilege protects direct communications of a confidential nature between lawyer and client, or their agents or employees, made for the purpose of obtaining or giving legal advice. [23] The privilege covers not only the legal advice itself and the request for advice, but also communications between the lawyer and client aimed at keeping both informed so that advice can be sought and given. [24]

[97] Confidentiality is an essential component of solicitor-client communication privilege. The institution must demonstrate that the communication was made in confidence, either expressly or by implication. [25] The privilege does not cover communications between a lawyer and a party on the other side of a transaction. [26]

[98] The privilege may also apply to the lawyer’s working papers directly related to seeking, formulating or giving legal advice. [27]

[99] The board did not provide a copy of the portion at record 4 that it claims is exempt from disclosure under section 12, and instead provided a confidential affidavit sworn by its legal counsel with respect to this information. The board also addressed this issue briefly in the representations that were shared with the appellants. In its representations, the board submits that the withheld information relates to meeting minutes with police and legal counsel. It submits that section 12 applies to exempt certain portions of this information as the information is solicitor-client communication privilege. It submits that these portions record the receipt of legal advice from the board’s legal counsel and communications from board employees to legal counsel, all in the context of obtaining legal advice over the data breach and the related criminal investigation.

[100] The appellants do not specifically address the information the board has withheld under section 12.

Analysis and finding

[101] Based on my review of the board’s representations, including the affidavit, sworn by its external legal counsel, I accept the claim that the discretionary exemption at section 38(a), read in conjunction with section 12, applies to the relevant withheld information in the meeting minutes in record 4.

[102] I note that because the board did not provide a copy of the withheld information, the original adjudicator requested that it provide a detailed affidavit addressing the information with sufficient detail that a determination can be made regarding the exemption claimed. This request was in keeping with the IPC guidance document, IPC protocol for appeals involving solicitor-client privilege claims where the institution does not provide the records at issue to the IPC. [28]

[103] The board provided a confidential affidavit which was not shared with the appellant because it contained information that met the IPC’s confidentiality criteria set out in Practice Direction 7. However, I have reviewed this affidavit and confirm that the board’s legal counsel attests to the type of information that was redacted under section 12, including a general description of the legal advice that was provided. The board’s counsel attests that the withheld content contains board employee requests for legal advice as well as the content of the legal advice provided in response to the requests for legal advice.

[104] The board’s legal counsel attests that the withheld information is a request for and a provision of a legal opinion and provides the dates when the advice was given.

[105] In my view, the board has provided sufficient information for a finding that the withheld minutes form part of the continuum of communications between a lawyer and their client for the purpose of seeking or obtaining legal advice over the data breach and the related police investigation.

[106] I also find that there is no evidence that the board has waived its privilege with respect to communications with its lawyer in relation to the relevant matter.

[107] I accept therefore, that the withheld information in the records falls under the solicitor-client communication privilege component of the common law solicitor-client privilege set out in section 12  of the Act .

[108] Because of my finding that the information at issue falls under the solicitor-client communication privilege component of the common law solicitor-client privilege set out in section 12  of the Act , I find that the exemption at section 38(a), read with section 12, applies to the withheld information under this section at record 4. As section 38(a) is also a discretionary exemption, this finding is subject to my review of the board’s exercise of discretion, which I consider below.

Issue F: Should the board’s exercise of discretion be upheld?

[109] The section 7(1) and 38(a) (read with sections 7(1) and 12), and 38(b) exemptions are discretionary, [29] meaning that the institution can decide to disclose information even if the information qualifies for exemption. An institution must exercise its discretion. On appeal, I may determine whether the institution failed to do so.

[110] I may also find that the institution erred in exercising its discretion where, for example,

• it does so in bad faith or for an improper purpose;
• it takes into account irrelevant considerations; or
• it fails to take into account relevant considerations.

[111] In either case, I may send the matter back to the institution for an exercise of discretion based on proper considerations. [30] I cannot, however, substitute my own discretion for that of the institution. [31]

[112] Some examples of relevant considerations are listed below. However, not all of these will necessarily be relevant, and additional considerations may be relevant: [32]

• the purposes of the Act , including the principles that:
• information should be available to the public,
• individuals should have a right of access to their own personal information,
• exemptions from the right of access should be limited and specific, and
• the privacy of individuals should be protected,
• the wording of the exemption and the interests it seeks to protect,
• whether the requester is seeking their own personal information,
• whether the requester has a sympathetic or compelling need to receive the information,
• whether the requester is an individual or an organization,
• the relationship between the requester and any affected persons,
• whether disclosure will increase public confidence in the operation of the institution,
• the nature of the information and the extent to which it is significant and/or sensitive to the institution, the requester or any affected person,
• the age of the information, and
• the historic practice of the institution with respect to similar information.

Finding

[113] Based on the information I have found exempt under the discretionary exemptions and the board’s representations, I find that the board has properly exercised its discretion. I am satisfied the board properly considered the interests sought to be protected and the wording of the exemptions claimed. I find the board also considered its historic practice with respect to similar information as well as the nature of the information and the extent to which it is sensitive to the board. I find the board has not exercised its discretion in bad faith. Accordingly, I uphold the board’s exercise of discretion.

Issue G: Did the institution conduct a reasonable search for records?

[114] The appellants believe that additional records exist that are responsive to the request.

[115] If a requester claims that additional records exist beyond those found by the institution, the issue is whether the institution has conducted a reasonable search for records as required by section 17  of the Act . [33] If I am satisfied that the search carried out was reasonable in the circumstances, I will uphold the institution’s decision. Otherwise, it may order the institution to conduct another search for records.

[116] Although a requester will rarely be in a position to indicate precisely which records the institution has not identified, they still must provide a reasonable basis for concluding that such records exist. [34]

[117] The Act  does not require the institution to prove with certainty that further records do not exist. However, the institution must provide enough evidence to show that it has made a reasonable effort to identify and locate responsive records; [35] that is, records that are “reasonably related” to the request. [36]

[118] A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request makes a reasonable effort to locate records that are reasonably related to the request. [37]

Representations

[119] In the appellants submit that board representatives took notes at three specified meetings (in early 2019) which they referred to as “all handwritten notes” in the request, however, they submit that these notes may have been recorded digitally using a laptop, so they may have been typed or even recorded. The appellants submit they witnessed board representatives taking copious notes in real time throughout each of the three meetings. The appellants suggest that the board may have destroyed evidence. They submit that a further search for such evidence would likely be fruitless and it can be assumed that the records were either lost or destroyed, in which case a forensic analysis of data backups and deleted information would be in order.

[120] The appellants submit that proving a negative – such as the non-existence of certain information – is not their objective. They submit that what is key is a record of the board employee’s responses at these meetings, and most importantly their noted acquiescence of grave mistakes made as the appellant presented evidence to them. The appellants submit that they believe that the board employee’s reactions, during these meetings, would have warranted the ultimate destruction of their notes given their potential content, particularly as the current legislation does not appear to enforce any penalties for the disposal of such information.

[121] The appellants submit that these notes would contain serious evidence of the board’s mistakes made during the selection of the vendor, deployment of the system, (lack of) testing of the platform, misuse of the data and other intentional or unintentional security concerns. The appellant submit that it is likely these notes still exist because they contain details of the reported vulnerabilities and because they are ostensibly a matter of public record pertaining to a potential data breach. They also submit that they would still exist because they were presumably used twice to make an unfounded case to law enforcement that the appellant, who reported these issues in good faith and in confidence to the board was in fact a “hacker.”

[122] The board was provided with a copy of the appellant’s representations and given an opportunity to respond. The board did not initially respond to the appellant’s claim that its search was not reasonable and instead waited to review the appellant’s representations before commenting on its search.

[123] The board submits that it has undertaken multiple searches for records responsive to the appellant’s initial request and has identified all of the responsive records. The board denies that it unlawfully destroyed records. The board submits that it has a privacy policy and procedure, and a records and information management policy and procedure, which were followed at all times, and continues to be followed.

[124] The board submits that the appellants have alleged that additional records exist by arguing that communication between one appellant and board staff was recorded digitally, which the board denies. The board also submits that the appellants allege, without evidence, that the board has withheld transcripts and/or copies of the digital records, again which it denies.

Analysis and finding

[125] For the reasons that follow, I find that the board’s search was not reasonable.

[126] As mentioned above, the board is not required to prove with certainty that further records do not exist in order to satisfy the requirements of the Act . It must only show that it made a reasonable effort to locate responsive records. Based on the evidence provided by the board during the inquiry, I find that it has not met its onus to show that the search was reasonable

[127] As noted, the board waited to respond to this issue until the appellants addressed it in their representations. However, when it did respond, it did not properly address the issues and questions set out in the Notice of Inquiry that was originally sent to it.

[128] As noted above, and in the Notice of Inquiry, a reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request makes a reasonable effort to locate records that are reasonably related to the request. [38] The Notice of Inquiry asked the board to explain the following:

Please provide details of any searches the institution carried out including: who conducted the search, the places searched, who was contacted in the course of the search, the types of files were searched, and the results of the search.

Is it possible that responsive records existed but no longer exist? If so, please provide details of when such records were destroyed including information about the institution’s record maintenance policies and practices, such as retention schedules.

[129] In its representations, the board does not address who conducted the search or who was contacted in order to search for responsive information. In my view, the board has not provided enough evidence to show that it made a reasonable effort to identify and locate all of the responsive information within its custody or control. [39]

[130] Although the board denies that records were unlawfully destroyed, and refers to its privacy policy and procedure and a records and information management policy and procedure, it did not provide a copy of same or refer to any details concerning when such records could have been destroyed. Although I am not aware of the actual date of the request, it appears that it was made in the same year the alleged notes from three meetings were taken as the decision letter dealing with the request is dated that same year. The board submits that the appellants allege that digital records exist that recorded the communication between the appellant and the board. The board denies that digital records exist. However, the appellant submits that he witnessed a board employee taking notes and that they may have been digitized. In my view, the board’s response does not appropriately address the possibility of hand-written notes existing and if they do not, it did not address if they were destroyed in accordance with its own retention policy.

[131] As a result, I find that the board has not provided an explanation of all the steps taken in response to the request as is required. I will require the board to provide an affidavit setting out the steps it took to search for responsive records as well as providing representations regarding its retention policy.

ORDER:

1. I uphold the board’s decision regarding section 14(1), in part, and order it to disclose to the appellant the information it claimed as personal information in record 176 and the highlighted information in records 175, 183 and 184 by February 1, 2023 but not before January 27, 2023.
2. I uphold the board’s decision regarding section 38(b), in part, and order it to disclose to the appellant the information it severed in record 171, the attached emails to record 174 and the information in the attachments to record 186 containing the board responses and information that is highlighted in records 178, 191, 192 and 195 by February 1, 2023 but not before January 27, 2023.
3. I uphold the board’s decision regarding section 38(a), read with section 12.
4. I uphold the board’s decision regarding section 38(a) read with section 7(1), in part, and order it to disclose to the appellant the information in record 174, 175, 176 and 179 where it claimed it, and the highlighted information in record 192 by February 1, 2023 but not before January 27, 2023.
5. I uphold the board’s decision regarding section 7(1), in part, and order it to disclose to the appellants the information it severed in record 193 and the highlighted information in records 182 and 183.
6. I do not uphold the board’s decision regarding section 38(a), read with section 8(1)(c) and order it to disclose the information where it has claimed this exemption.
7. I find that the board has not provided sufficient evidence to conclude that its search is reasonable and order it to provide an affidavit containing details of any searches it carried out including: who conducted the search, the places searched, who was contacted in the course of the search, the types of files searched, and the results of the search. In the affidavit, the board must also address if it is possible that responsive records existed but no longer exist, including reference to the meeting notes set out in the request. If it is possible that records no longer exist, the board should provide details of when such records were destroyed including information about its record maintenance policies and practices, such as retention schedules. The board should provide me with a copy of this affidavit on or before January 19, 2022.
8. In order to verify compliance with this order, I reserve the right to require the board to provide me with a copy of its correspondence to the appellant, disclosing the records in accordance with order provisions 1, 2, 4, 5 and 6.

Original signed by:		December 23, 2022
Alec Fadel
Adjudicator

APPENDIX

The following chart summarizes the records at issue with the corresponding exemption claims, based on the Index, the Mediator’s Report and the board’s representations in this inquiry.

Record number (Tab)	Description	Exemption claims
4	January 23, 2019, February 12 and 15, 2019 Notes from discussion with police and counsel	38(a), in conjunction with 12 and/or 8(1)(c) and/or 7(1). 10(1) (The board also references section 38(b).)
171	Parent complaint	38(b) and/or 14(1)
172	Parent complaint	38(b) and/or 14(1)
173	Parent complaint	38(b) and/or 14(1); 38(a) in conjunction with 7(1).
174	Parent complaint	38(b) and/or 14(1); 38(a) in conjunction with 7(1).
175	Parent complaint	38(b) and/or 14(1); 38(a) in conjunction with 7(1).
176	Parent complaint	38(b) and/or 14(1); 38(a) in conjunction with 7(1).
177	Parent complaint	38(b) and/or 14(1); 38(a) in conjunction with 7(1).
178	Parent complaint	14(1)
179	Parent complaint	14(1) and 7(1).
180	Parent complaint	14(1)
181	Parent complaint	14(1)
182	Parent complaint	38(b) and/or 14(1); 38(a) in conjunction with 7(1).
183	Parent complaint	14(1) and 7(1).
184	Parent complaint	14(1) and/or 38(b), and 38(a) in conjunction with 7(1) or 7(1)
185	Parent complaint	14(1) and/or 38(b), and 38(a) in conjunction with 7(1) or 7(1)
186	Parent complaint	14(1) and/or 38(b), and 38(a) in conjunction with 7(1) or 7(1)
187	Parent complaint	14(1)
188	Parent complaint	14(1) or 7(1)
189	Parent complaint	14(1)
190	Parent complaint	14(1)
191	Parent complaint	14(1) and/or 38(b); 38(a) in conjunction with 8(1)(c) or 7(1); or 8(1)(c) or 7(1)
192	Parent complaint	14(1) and/or 38(b), and 38(a) in conjunction with 7(1).
193	Parent complaint	14(1) and 7(1)
194	Parent complaint	14(1)
195	External inquiry	14(1) and/or 38(b), and 38(a) in conjunction with 7(1) or 7(1).