ORDER PO-4421

Appeal PA21-00640

McMaster University

July 19, 2023

Summary: The appellant made a request for all letters about him sent by a specific individual at McMaster University to security services or university administration during a five-week period. The university located a security report and emails. The university granted partial access to the security report by withholding information about incidents not involving the appellant as non- responsive to the request. The university granted full access to the emails, but in a manner not acceptable to the appellant. The adjudicator finds that the university properly interpreted the scope of the appellant’s request and that the information withheld from the security report is not responsive to the request. The adjudicator also finds that the university disclosed the emails in a comprehensible form and dismisses the appeal

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O 1990, c. F.31 , as amended, sections 24, 48(3) and 48(4).

OVERVIEW:

[1] Following a number of security and other incidents, McMaster University (the university) imposed persona non grata (PNG) status on the appellant, a former student. This designation prohibited the appellant from entering university property, and included a ban on all communications with members of the university community, except in certain limited circumstances. Security incidents continued despite the ban, and resulted in the appellant’s arrest and legal proceedings. Eventually, a peace bond was put in place that prevented the appellant from attending campus or approaching certain faculty members and staff.

[2] The appellant made a request to the university for access under the Freedom of Information and Protection of Privacy Act  (the Act ) to the following:

For January 1, 2019 to February 5, 2019:

All of the letters sent against [the appellant] from [a named individual] to McMaster security services, and McMaster university administration.

[3] The university conducted a search and located what it said were responsive records. The university issued a decision in which it granted full access to one record, a screenshot of an email chain converted to a .pdf file (record 2), and partial access to another record, a 67-page report called a Security Incident Report: Persona non Grata Status (the PNG report or record 1). The university withheld most of the PNG report, as well as portions of the five pages of the PNG report that it disclosed. The university cited the personal privacy exemptions in sections 21  and 49 (b) of the Act , claiming that the withheld portions contained information about individuals other than the appellant and did not contain any information relating to him.

[4] The appellant appealed the university’s decision to the Office of the Information and Privacy Commissioner of Ontario (IPC). The parties participated in mediation to explore resolution.

[5] During mediation, the university issued a revised decision. In it, the university wrote that it had located four responsive records[1] to which it was granting partial access.

[6] The university also indicated in its revised decision that only five pages of the PNG report are responsive to the request (as opposed to the entire report according to its initial decision). The university wrote that, from the five pages to which partial access was granted, portions were withheld under sections 21 and 49(b) (personal privacy).[2]

[7] The appellant maintained that the entire PNG report should be disclosed to him. The appellant also took the position that the emails to which the university granted full access in the form of a screenshot were subject to manipulation and should be provided as .eml[3] files converted directly from the original device from which the emails were generated. The university refused. As a result, section 48(3) (manner of access) was added as an issue.

[8] At the conclusion of mediation, the mediator issued a mediator’s report that identified the issues remaining in dispute. The mediator’s report states that the appellant wished to proceed to adjudication on the basis of the university’s claim that it had denied access to the information withheld from the records because that information is not responsive to the request. Both parties were therefore given the opportunity to address this issue, which was included in the Notice of Inquiry. In its representations, the university explained that its position is that all withheld portions of the PNG report – including those portions withheld from the five disclosed pages – are non-responsive, and that it raised the personal privacy exemptions in sections 21 or 49(b) over the withheld information as alternative arguments.[4]

[9] In this order, I find that the withheld portions of record 1 are not responsive to the request. I also find that the university is not required to provide a copy of record 2 in .eml format and I dismiss this appeal.

RECORDS:

[10] There are two records at issue in this appeal, over which the university claims different exemptions. They are:

Records at Issue

Records at Issue

Record 1	A 67-page security incident report for individuals identified as persona non grata	The university claims that it denied access to portions of record 1 because they are non-responsive to the request. In the alternative, the university claims that the withheld information is exempt under the personal privacy exemptions in sections 21 or 49(b). At issue is access to the information withheld from record 1.
Record 2	One-page screenshot of five emails (contained in two email chains)	Manner of access (section 48) is raised with respect to record 2 only.

ISSUES:

1. What is the scope of the request and which records are responsive to it?
2. Is the university required to provide the appellant with a copy of record 2 in another format?

DISCUSSION:

Issue A: What is the scope of the request and which records are responsive to it?

[11] Because the university granted full access to the emails (record 2), this issue relates only to those portions of the PNG report (record 1) to which the university denied access. These are the 62 pages to which access was denied in full, and the information that was withheld from the five pages that were partially disclosed to the appellant. The university says it denied access to this information on the basis that it is non-responsive, meaning that the university believes the information is not reasonably related to the request. Although the university did not expressly articulate in its revised decision that it withheld 62 pages of the PNG report as non-responsive, the university explains in its representations that, by identifying only five pages in its revised decision as responsive, it was taking the position that the remaining 62 pages are not. The university went on to explain that it also withheld portions of the five pages that it disclosed to the appellant as also non-responsive to the request, but that, in the alternative, all withheld portions of the PNG report are exempt under the mandatory and discretionary personal privacy exemptions in sections 21 or 49(b), respectively.

[12] To determine whether the withheld portions of record 1 have been properly withheld as non-responsive requires consideration of section 24  of the Act . Section 24 imposes certain obligations on requesters and institutions when submitting and responding to access requests. It states, in part, that:

(1) A person seeking access to a record shall,

(a) make a request in writing to the institution that the person believes has custody or under the control of the record;

(b) provide sufficient detail to enable an experienced employee of the institution, upon a reasonable effort, to identify the record;

(2) If the request does not sufficiently describe the record sought, the institution shall inform the applicant of the defect and shall offer assistance in reformulating the request so as to comply with subsection (1).

[13] To be considered responsive to the request, records must “reasonably relate” to it.[5] Institutions should interpret requests liberally, in order to best serve the purpose and spirit of the Act . Generally, ambiguity in a request should be resolved in the requester’s favour.[6]

Representations

[14] The university says that the PNG report consists of 67 pages and is a consolidated summary identifying all individuals whom the university declared persona non grata in 2019. The university submits that the PNG report identifies individuals other than the appellant and contains narratives about them, including letters sent to them in relation to their PNG status. The university says that, of the 67 pages comprising record 1:

• 62 withheld pages contain only personal information of individuals other than the appellant (but not the appellant), and include copies of the corresponding PNG letters delivered to those individuals.
• 3 pages (pages 18, 19 and 32) include the appellant’s personal information only. The university says it identified these pages as responsive and disclosed them to the appellant in full.
• The remaining 2 pages (pages 1 and 11) include the appellant’s name and identify him as PNG. The university says that, except for the portions where the appellant is identified and which were disclosed to him, the remaining withheld portions are non-responsive to the request for the appellant’s own personal information and contain information about other individuals.

[15] The university submits that the withheld portions of the PNG report contain the names, home addresses, dates of birth, descriptions of physical characteristics (including race and sex), education or employment status and descriptions of mental health matters relating to people other than the appellant. The university says that while this personal information of individuals other than the appellant was not disclosed, the appellant was not denied access to any of his own personal information contained in the PNG report.

[16] The university submits that, in the alternative, it relies on either the mandatory personal privacy exemption in section 21  of the Act , or the discretionary personal privacy exemption in section 49(b). The university says that, if the withheld portions of the PNG report are found to be responsive to the request, then they are exempt either under section 21(1) or, should the PNG report be considered as a whole to be a record containing the appellant’s personal information, then the withheld portions are exempt under section 49(b).

[17] The appellant maintains that he should be given access to the entire PNG report.

Analysis and findings

[18] Section 24(1)(b) requires a person seeking access to a record to give enough detail to enable an experienced employee, upon a reasonable effort, to identify the record. If the request does not sufficiently describe the record to which access is sought, section 24(2) requires the institution to inform the appellant of the defect and help with reformulating the request. Where the request is ambiguous, the institution should also resolve any ambiguity in the appellant’s favour.

[19] The appellant’s request is confined to all letters sent “against him” by a specific individual to the university’s security services and administration within the five-week period from January 1, 2019 and February 5, 2019. I find the appellant’s request to be clear and concise; the request was for specific information about him during a specific timeframe, and he received access to this information.

[20] I have reviewed the entire PNG report and the information withheld, including from the portions of the report that were partially disclosed to the appellant. Based on my review, I find that the report contains information for numerous other PNG incidents that occurred before and after February 5, 2019 (the end date in the request). The PNG report also contains PNG letters sent in 2019 to individuals other than the appellant. As the university has pointed out, the report consolidates all PNG reports for the 2019 calendar year. I find this information, namely information about security incidents and PNG letters relating to individuals other than the appellant, during the period of the request and including after February 5, 2019, to be outside the scope of the appellant’s request. I find that information about security incidents and the PNG status of individuals other than the appellant does not reasonably relate to the appellant’s request and is therefore outside its scope. I find that this includes incidents involving individuals other than the appellant and PNG letters to other individuals, even if they occurred within the five-week period identified in the request.

[21] Accordingly, I accept the university’s position that the withheld information is not responsive to the appellant’s request, but that the information partially disclosed to the appellant is.

[22] I also find that the request was sufficiently clear that the university was not obliged to contact the appellant to seek clarification, or to help reformulate the request pursuant to section 24(2). While the university has not explained why it included the whole of 2019 in its search for responsive records, I am still satisfied, for the above reasons, that the withheld information does not reasonably relate to the appellant’s request. As a result, the university is not required to disclose the withheld information to the appellant.

[23] Because of my finding that the withheld information – including portions of the pages partially disclosed to the appellant – is not responsive to the appellant’s request, it is not necessary for me to consider whether that information is also exempt because it is the personal information of individuals other than the appellant.[7] Accordingly, I will next consider the appellant’s argument that record 2 should be disclosed to him in a different format.

Issue B: Is the university required to provide the appellant with a copy of record 2 in another format?

[24] As noted above, record 2 is a screenshot of emails that the university disclosed to the appellant in full, converted to a .pdf document. The appellant challenges the manner in which access to record 2 was granted, claiming that it can be photoshopped or otherwise manipulated.

[25] Once it has been determined that a requester is to be given access to his or her own personal information, section 48(3) and (4) prescribe the manner and form in which the institution must provide access.

[26] Section 48(3) states that, where an individual is to be given access to personal information about themselves, the head[8] shall:

1. permit the individual to examine the personal information; or
2. provide the individual with a copy thereof.

[27] Section 48(4) states that:

Where access to personal information is to be given, the head shall ensure that the personal information is provided to the individual in a comprehensible form and in a manner which indicates the general terms and conditions under which the personal information is stored and used.

[28] Section 2(1)  of the Act  defines “record” as follows:

“record” means any record of information however recorded, whether in printed form, on film, by electronic means or otherwise, and includes,

(a) correspondence, a memorandum, a book, a plan, a map, a drawing, a diagram, a pictorial or graphic work, a photograph, a film, a microfilm, a sound recording, a videotape, a machine readable record, and any other documentary material, regardless of physical form or characteristics, and any copy thereof, and

(b) subject to the regulations, any record that is capable of being produced from a machine readable record under the control of an institution by means of computer hardware and software or any other information storage equipment and technical expertise normally used by the institution.[9]

Representations

[29] The appellant initially sought access to the emails in .pdf format, but now says that the emails in record 2 are to be provided to him in an email extension format (.eml). The appellant maintains that the university is involved in a conspiracy against him, that it “photoshopped the evidence” (i.e., record 2), imported it into Word, and then printed it. Pointing to parts of record 2, the appellant says that it contains evidence of discontinuity, debris, and misalignment between replies. The appellant says that the original emails will reveal hidden messages and tell the whole story.

[30] The university says that the emails captured in record 2 were disclosed in full as screen captures. The university submits that it does not have the technical means to convert the emails to the format proposed by the appellant.

[31] The university says that the responsive emails were in a format that is no longer supported. It says that the emails captured in record 2 predate the migration of the university’s email system to its current platform. The university says that not all emails were migrated to the new system upon transitioning platforms and that the emails in record 2 are part of the non-migrated emails. The university says they are only accessible through the prior email platform, which does not have the means by which to convert messages even to .pdf documents like the new platform does. The university says that the email is on a legacy version of Outlook that was transitioned to the current version after 2018, when the appellant stopped being an active student. The university says that it first had to take a screenshot in order to provide the emails to the appellant in .pdf format.

[32] The university also says that it is not willing to provide the emails in a raw format because they could easily be edited after disclosure to look like something else was written in them. In response to the appellant’s concerns about manipulation, the university provided an affidavit sworn by the individual named in the request – a professor and chair who searched for responsive records. This individual swore that he conducted a search, submitted a search tracking form with the responsive records to the university’s privacy office, and that the records were disclosed through a secure link as .pdfs. According to his affidavit, the information he provided was not in any way altered or edited.

Analysis and findings

[33] One of the purposes of the Act , set out in section 1(a), is to provide individuals with a right of access to information about them under an institution’s control. Where a requester seeks access to records in a format different from that in which the records now exist, and it is reasonably practicable for the institution to effect the change in format, the institution is required to do so.

[34] Previous IPC orders have addressed the meaning of the term “comprehensible form” and have found that this section creates a duty to ensure that the average person can comprehend the records, without further creating a duty on the institution to assess a specific requester’s ability to comprehend a record.[10]

[35] In this case, the appellant has not stated that he is unable to comprehend or read record 2. The only reasons he gives for challenging the manner of access is that he says that the .pdf’d screenshot has been manipulated and contains evidence of malfeasance by the university that he says can be proven with access to the record in .eml form.

[36] The university has provided an explanation for why it cannot provide the emails in the specific format requested by the appellant and I accept the university’s explanation. The university has also provided evidence in the form of an affidavit sworn by the individual whose communications were requested, attesting that the record was not altered or edited in any way. In the circumstances, I am satisfied that the university has complied with its obligation in section 48(3)(b) to provide the appellant with a copy of responsive emails, and with section 48(4) by delivering it in a comprehensible form.

[37] For the above reasons, I dismiss this appeal.

ORDER:

The appeal is dismissed.

Original Signed By:		July 19, 2023
Jessica Kowalski
Adjudicator