ORDER MO-4543

Appeal MA22-00503

City of Kawartha Lakes

July 10, 2024

Summary: The City of Kawartha Lakes (the city) received a request under the Act  for all city expenses over $1,000 over three and a half years. The city determined that it had reasonable grounds to consider the request as frivolous or vexatious under section 4(1) (b) of the Act . In this order, the adjudicator upholds the city’s decision, and dismisses the appeal.

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. M.56 , as amended, section 4(1)(b); Regulation 823, section 5.1(a).

Orders Considered: Orders 38, PO-3204, MO-2488, and MO-3512.

OVERVIEW:

[1] This order resolves an appeal of an institution’s decision to deny access to records on the basis that the request is frivolous or vexatious.

[2] The City of Kawartha Lakes (the city) received a request under the Municipal Freedom of Information and Protection of Privacy Act  (the Act ) that was later clarified to be for:

Electronic file containing all City expenses, for the period Dec 4, 2018-current date, with dollar value of greater than $1,000, including the following record fields:

Batch number, document number, G/L Date, Vendor Code (scrambled), Explanation, Invoice, Purchase Order, PO DO TY, PO Document Type, Amount, Business Unit, Business Unit Code, Bus Unit Description, Obj. Account.

[3] The city issued a decision that the request is frivolous or vexatious under section 4(1) (b) of the Act .[1]

[4] The requester (now the appellant) appealed the city’s decision to the Information and Privacy Commissioner of Ontario (IPC).

[5] I conducted an inquiry into the appeal. The parties were invited and provided representations about the issues under appeal.

[6] For the reasons that follow, I uphold the city’s decision and dismiss the appeal.

DISCUSSION:

[7] The only issue to be decided in this appeal is whether the access request is frivolous or vexatious, within the meaning of section 4(1) (b) of the Act .

Section 4(1)(b)

[8] An institution that concludes that an access request is frivolous or vexatious has the burden of proof to justify its decision.[2]

[9] Section 4(1) (b) of the Act  provides institutions with a straightforward way of dealing with frivolous or vexatious requests. However, institutions should not exercise their discretion under section 4(1)(b) lightly, as this can have serious implications for access rights under the Act .[3]

[10] Section 4(1)(b) says: “Every person has a right of access to a record or a part of a record in the custody or under the control of an institution unless, the head is of the opinion on reasonable grounds that the request for access is frivolous or vexatious.”

[11] Section 5.1 of Regulation 823 under the Act  elaborates on the meaning of the phrase “frivolous or vexatious” as follows:

A head of an institution that receives a request for access to a record or personal information shall conclude that the request is frivolous or vexatious if,

(a) the head is of the opinion on reasonable grounds that the request is part of a pattern of conduct that amounts to an abuse of the right of access or would interfere with the operations of the institution; or

(b) the head is of the opinion on reasonable grounds that the request is made in bad faith or for a purpose other than to obtain access.

[12] Reading these sections together, under the Act , there are four grounds for claiming that a request is frivolous or vexatious:

• the request is part of a pattern of conduct that amounts to an abuse of the right of access,
• the request is part of a pattern of conduct that would interfere with the operations of the institution,
• the request is made in bad faith, and/or
• the request is made for a purpose other than to obtain access.

[13] The city claims one ground in this appeal, which I discuss next.

Pattern of conduct that would interfere with the operations of the institution

[14] A pattern of conduct that would “interfere with the operations of an institution” is one that would obstruct or hinder the range of effectiveness of the institution’s activities.[4]

[15] Interference is a relative concept that must be judged on the circumstances faced by the institution in question. For example, it may take less of a pattern of conduct to interfere with the operations of a small municipality than with the operations of a large provincial government ministry.[5]

The city’s initial representations

[16] The city explains that it has not exercised its discretion under section 4(1) (b) of the Act  lightly – this is the first time it has claimed it under the current city Clerk (since 2018) and the Deputy Clerk (since 2017).

[17] The city explains that its Clerk’s office processes an average of 50 requests per year, and it “strongly contends that” section 4(1) (b) of the Act  “should only be used when significant issues are at hand.”

[18] For further context, the city explains that it is a single-tier municipality and has a population of 79,247 (2021 Census) and serves an area of 3,059 kilometres. (Being a “single-tier municipality” means that “a municipality that does not form part of an upper-tier municipality for municipal purposes and assumes all municipal responsibilities set out under the Municipal Act and other Provincial legislation.”)[6]

[19] The Office of the City Clerk is staffed by the City Clerk, two Deputy Clerks, and three administrative staff. The city employs 1 full-time equivalent staff person to carry out the roles required by the Act  – a function that is spread between the City Clerk (0.25), Deputy Clerk (0.5), and administrative staff (0.25).

[20] The city states that, at this time, it does not have reason to believe that the request was made in bad faith.

[21] The city explains that the pattern of conduct includes:

• access requests
• unquantified phone calls and “clarification emails” (though numbers may be provided on request), and
• voluminous emails (which “very conservative[ly]” have needed 20 hours of staff time, or more realistically over 100 hours).[7]

[22] The city submits that a significant portion of the information that is requested by the appellant is already provided to the public on the city’s website (through agendas, minutes, the city's operating budget, procurement policy, management directive, and annual report). However, the city explains that the office of the city clerk will advise when a request needs to be made under the Act , especially when it relates to records and data that may contain personal information or third party information.

[23] The city notes that the request required extensive clarification (including a 19-part email exchange with the appellant, which it enclosed with its representations). This occurred at a time when the city Clerk’s office was at the height of its responsibilities under the Municipal Elections Act.

[24] In addition, during the clarification process, the city explains that it advised the appellant about reformulating the wording of the request to avoid what it describes as “problematic fields” that would require extra scrutiny to facilitate the release of the records. Despite this, the city states that the appellant continued to request these problematic fields, which made the broad nature of the request even more challenging.

[25] The city submits that the request is frivolous and vexatious for being overly broad, under section 4(1) (b) of the Act . In support of this, it relies on Orders 38 and MO-3512.

[26] In Order 38, the Commissioner noted three options that an institution has in the face of broadly worded requests:

• respond literally to the request, which may involve an institution wide search for the records requested,
• request further information from the requester so that it may narrow its area of search, or
• narrow a records search unilaterally, but if it does so, it must outline the limits of the search to the appellant.

[27] Order MO-3512, involved a fee estimate of $169,502 and evidence that the institution’s electronic management system could not do a keyword search to review the text of hundreds of thousand files to quickly locate responsive records.[8] The IPC found that the request was too broad to allow for a search apart from the institution’s email servers and held that until the appellant narrowed his request or more specifically identified what type of record he was seeking, the institution did not need to process his request apart from email records.

[28] The city submits that it took sufficient and appropriate steps to help the appellant narrow the scope of the broadly worded request through the clarification process.

[29] The city generated the record, which turned out to be 38,692 lines long. It submits that any reasonable review of the 38,692-line record would result in a fee estimate so high that a reasonable person without vexatious intent would not be willing to pay. More specifically, it explains that if the “problematic fields” of “Vendor Code,” “Explanation – Remark,” “Invoice Number,” “Amount,” and “Bus Unit Description” remain, the city would have to either “blanket redact” the fields without proper due consideration or take a comprehensive line-by-line review. It calculates that if it takes two minutes per line to review 38,692 lines of data, it may need over 1,200 hours to review the data – the equivalent of a full time employee spending 34 working weeks dedicated to the appellant’s request. The city submits that this is unreasonable. It states that there is no way to sort the data lines to easily identify personal and/or third party information protected under the Act  to redact that information.

[30] In addition, the city notes that this estimate does not include time and expense for third party notifications (as required by the Act ) to the over 2,100 vendors in the requested database. Since so many vendors may require notice, the city submits that the time and expense to issue those notices would be extremely burdensome to it.

[31] The city notes that in Orders MO-3512 and MO-2488, the appellant was required to narrow the scope of the request and asks that the same be required of the appellant here.

The appellant’s initial representations

[32] The appellant does not believe that the request clarification process was exhausted “before the city abruptly stopped communicating,” which led to his appeal. He submits the city has unfairly characterized his communications as excessive and interfering with its operations, and notes that he has had three requests in three years (one of them unrelated to this one). He states that the timing of his requests was not tied to any other events. The appellant does not agree that most of the information he has requested is available on the city’s website through meeting minutes and other sources. He submits that the request “could take minutes to satisfy,” and his view that the city is incorrectly interpreting the sensitivity of certain fields. He says that he does not understand why the city says that his request is both unusually specific and overly broad (and what that means).

[33] With regard to the city’s estimate of the effort required to process his request, he submits that no one would pay for 1,200 hours of effort, but he was not made aware of that before.

[34] The appellant asserts that manual scrutiny of records is not required, and repeats that it would take only a few minutes of computer time to process his request. He submits that processing his request “is far less complicated and effort less [sic]” than the city says it would be. He says he “simply want[s] procurement activity contained in a single database.” He states that his request “can be satisfied with a single data extract from a single data source with no (or very little) manual scrutiny.”

[35] More specifically, the appellant submits that there is no way to identify a vendor from the “Vendor number” field without assistance from the city, so that information should be disclosed. In the alternative, he submits that the number should be scrambled and released.

[36] Similarly, he submits that there is nothing proprietary about certain other fields flagged by the city as problematic (“Invoice Number,” “Amount,” and “Bus unit description”).

[37] The appellant submits that the “Explanation” field “could potentially be seen to contain prohibited data,” flagging this field as the only one with “some complexity.” He submits that there are various ways to treat this information, dividing it up into three groups.

[38] The first group would cover procurements that have been reviewed by council will be on the public record and should be disclosed. He anticipates that this will not cover all of the records but says that retrieving records of a specified procurement type will pull many.

[39] The second group is for “low value procurement.” While he does not initially explain what this means (given the threshold in his request is $1,000), he later designates a group as being for under $50,000. He sees the city as speculating[9] that this field might contain personal details (specifically name and address). He characterizes this as “misuse of the field,” that “makes transparency of records very difficult and should not be done in the future if Openness is valued,” [sic]. The appellant states that he would forgo this field “for these lower value records in an effort to resolve this appeal.”

[40] The third group is for “higher value” procurement – more than $50,000. The appellant states that the “Explanation” field will briefly describe “the procurement item.” Again, he sees the city as speculating that this field may contain proprietary third party information that cannot be released without consent. In turn, he submits that it is “HIGHLY unlikely” that it would (capitals in his representations). He also submits that with no ability to identify the vendor, the city’s concern “is even less of a consideration.”[10]

The city’s reply

The scope is all city expenses over $1,000

[41] Given the circumstances in the appeal, I asked the parties to comment on the possible application of Order PO-3204.[11]

[42] In reply, the city acknowledges that the record in Order PO-3204 has some similarity in description to the record at issue, with detailed headings specified for a spreadsheet. However, it distinguishes Order PO-3204 from this appeal due to the scope and volume here, and the fact that Order PO-3204 did not deal with a frivolous or vexatious claim.

[43] Here, there are 16,629 lines of the record associated with a purchase order (where a more formalized procurement process was followed to issue the payments). The city “emphasizes that this spreadsheet includes ‘All City Expenses...greater than $1000,’” not just procurement expenses.

[44] The city reiterates that during the clarification process, it specifically asked the appellant by email whether he wanted data to include cheque requisitions payments including but not limited to refunds to individuals (for unused permits, etc.), payments to farmers for livestock losses, charity rebates, employee expenses (mileage), human resource benefit payments, etc. The appellant said yes. As such, the city submits that he clearly indicated that he was not just seeing procurement information, but all city expenses over $1,000.

[45] The city submits that the appellant’s characterization of his request (as “far simpler” than the city describes) is incorrect. It agrees that obtaining the data is not difficult, involving a single extract from a specified software program. However, it submits that what is “extremely complex is the redaction of the sensitive information contained within the extract.” The city reiterates that it can take two approaches, in the circumstances:

• completely redacting entire fields of data for the chase that personal or third party information may be contained in them (which it says may leave the appellant with “an extremely sterile listing of dates and dollar amounts, which would not fulfil the intent of the access provisions of the [Act ]”), or
• individually redacting specific fields with sensitive information following a line by line review of each entry. The city states that this would burden the city excessively such that it interfere with the operations of the municipality, and frustrate the right of access by requesting information that is too broad.

Entries with personal information

[46] The city rejects the appellant’s view that it is being “unreasonably protective” about certain fields that should not contain sensitive information. The city says it has “significant concern, especially when it comes to personal information contained in” three fields (Vendor Number, Invoice Number, and Explanation).

[47] The city explains that the “Vendor Number” is a number that is uniquely assigned to individuals and third party organizations. It explains that there is no way to differentiate whether a vendor number is associated with an individual or an organization; the numbers are assigned sequentially. The city states that for individuals, their vendor number would be their personal information within the meaning of paragraph (c) of the definition of “personal information,” the Act  which says, “any identifying number, symbol or other particular assigned to the individual.” The city explains that even if this number were scrambled, it would still be a unique number assigned to an individual, which the appellant would not have a right of access to under the Act .

[48] For the “Invoice Number” field, the city explains that this number is typically assigned by the vendor being paid and may be included as part of the entries relating to individuals. It says there is a wide variety of styles of Invoice Numbers in the data sheets, and sometimes vendors who supplied the invoices to the city may include personal information cues in the Invoice Number (such as initials with a set of sequential numbers). For example, an invoice related to John Smith may have an Invoice Number such as “JS1234.” The city explains that it may need to redact Invoice Numbers as personal information given this possibility of identifying cues.

[49] The city explains that the “Explanation” field is “a completely varied text field.” More specifically, it gives basic details of the expense, and sometimes it contains explicitly personal information (including names, identifying numbers, or personal addresses). The city states that this field is “of greatest, and most obvious concern for required redactions, as the information contained can be very explicit.” It submits that these fields examples of where personal information may be contained, and in a data set of 38,692, the city must adhere to its mandatory obligations under the Act  to redact personal information. It notes that failure to do so would result in a significant number of privacy breaches.

[50] The city explains that of the 38,692 entries, it is unquantifiable how many of these entries would include personal information relating to payments made to individuals, which is information that is exempt from disclosure under the mandatory exemption at section 14(1)  of the Act .

[51] However, the city conducted a preliminary review of about 500 lines in the spreadsheet and identified entries relating to the following a non-exhaustive list of personal information payments/expenses. As this list was shared with the appellant, I will not set it all out here, but examples of personal information identified include:

• refund payments for camp registrations,
• social housing rent,
• payments made to motels/hotels naming individuals for shelter accommodation (where short term shelter was not available elsewhere),
• legal disbursements following settlements/lawsuits, and
• refunds of RRSP payments and/or retirement benefits made to employees who left the organization prior to retirement.

[52] The city submits that the “overly broad scope and nature of the request is unreasonable and an infringement on privacy and personal information protected under the [Act ].” It explains that it does not have a reasonable way to sort these types of payments for the existence of personal information, and that a fulsome review would be required. The city further explains that although the 16,629 payments made with a purchase order would generally have a significantly lower likelihood of containing personal information, these entries will still require review in order to protect personal information.

Entries with third party information

[53] The city says that even if the appellant was ordered to reduce the scope of his request to include only entries with a purchase order, the city would still need to consider its contractual obligations to almost 2,200 vendors.

[54] In support of its position, the city provided this standard wording on procurement documents:

Contractors are advised that the City is required to adhere to the requirements of the Municipal Freedom of information and Protection of Privacy Act , as amended. The fees, disbursements, unit costs and a listing of the services to be provided, shall not be considered confidential, subject to the rights of the Contractor under the Municipal Freedom of information and Protection of Privacy Act , including, but not limited to, the right to request a Third Party Exemption. The Contractor shall maintain confidentiality of materials/outcomes as a result of this project. Release of any information shall be only with the written consent of the City. [Emphasis in the city’s representations.]

[55] The city submits that any third party information that can be identified in the data would require fair notice to any and all third parties to allow them to make representations as to disclosure and economic harm.

[56] This, in turn, would require the city to review about 2,581 procurement contracts to determine whether the contract language would require a third party review and notice or not.

[57] The city submits this is substantively different than the spreadsheet data mentioned above, in Order PO-3204 that dealt with three procurement contracts with similar contracts and similar data. Instead, the city submits that the circumstances in Order MO-3512 may be more factually similar, as it relates to the issue of the request being overly broad. The city submits that the request as worded (and confirmed after significant clarification) is overly broad and, in effect, frustrates the right of access under the Act  by requiring a disproportionate and enormous expenditure of time and effort to effectively and legally release the records (as explained in its representations). The city describes this frustration as “fundamental to how a request may be determined to be frivolous and vexatious.” The city offered to show me the dataset confidentially to demonstrate the enormity and complexity of the request.

[58] The city submits that if it fails to notify third parties and consider the (mandatory) exemption at section 10(1)  of the Act  for third party information, it would result in serious legal ramifications for the city, for breach of contract by not giving the vendors fair and equal notice.

[59] Regarding the appellant’s division of spreadsheet lines regarding entries over or under $50,000, the city explains that of the 38,692 entries, only 2,098 are above $50,000. The vast majority, therefore, are entries for expenses below the $50,000. Although the city notes the appellant’s acknowledgement that he may need to “forgo” those entries, the city submits that it would still be required to conduct a significant review to notify third parties for all expenses over $50,000, in accordance with its respective contracts.

[60] As a result, the city submits that the request would require a burdensome review of the entire dataset to fulfill its mandatory obligations under the Act  to protect personal and third party information.

Summary of city’s reply

[61] The city submits that the circumstances weigh in favour of a determination that there is a pattern of conduct that amounts to an abuse and frustration of the right of access. It submits that the request continues to be overly broad, even after extensive efforts to narrow the scope, as the appellant continues to request data fields which would require a burdensome amount of processing time to sufficiently process the request.

[62] The city notes that it has dealt with the appellant on another request for very specific information, where two third parties were consulted, and records were released with due process and notification. It says that it is not opposed to continued cooperative similar requests that would not unreasonably interfere with the operations of the city or frustrate the right of access.

[63] The city asks that if its decision is upheld, the appellant should be directed to narrow his request. If the request is determined not to be frivolous and vexatious, the city says that it will prepare a fee estimate for the work to be done to respond to the request. If the appellant is unsatisfied with the fee estimate, a review by the IPC will be required.

The appellant’s sur-reply

[64] In response to the city, the appellant submits that procurement information (whether through purchasing order or not) is not exempt from disclosure, applying the reasoning of Order PO-3204. His submissions are lengthy in this regard, but they do not sufficiently address the distinction flagged by the city: the number of vendors that would need to be notified, and the time it would take to identify them.

[65] For non-procurement expense records, the appellant acknowledges that the “Explanation” field “still has the potential to disclose personal information as the parties may not be operating in a business capacity.” He says he would forgo that field and “seek more information separately for specific records of interest.”

[66] In addition, the appellant submits that if I find that Order PO-3204 does not apply, then the “Vendor Number” and “Invoice Number” fields should still be disclosed. He argues that because the city assigns the numbers, there is no direct or indirect ability to relate this number to a person (scrambled or not). He submits that no specific person, group, or organization would be identifiable without direct intervention from the city.

[67] For the “Invoice Number,” he argues that if a vendor left “identifying clues,” then they are not really concerned about confidentiality and releasing that information would not be harmful.

[68] As for the “Explanation” field for non-procurement expense records, the appellant states that he “would forgo this field entirely and request more detail separately for specific records of interest.”

[69] The appellant also states that his original request included the term “purchasing” records and that through clarifying discussions with the city, that request was changed to include “city expenses.” He says that he was not aware at the time of what the city saw as the major impact of that change in wording. He says that at no time through the clarification discussions was he advised of the number of records involved or the level of effort the city thought it might entail. As a result, he says that “frivolity or vexatiousness never entered the picture from a conscious perspective.” He repeats the city’s assertion that it does not see his request as being made in bad faith.

[70] The appellant submits that his request is “non-contentious and fairly easily satisfied with no need for redaction and manual intervention,” if the reasoning in Order PO-3204 is applied to all city procurement records and after the removal of the “Explanation” field for non-procurement expenses.

Analysis/findings

[71] For the following reasons, I find that there are reasonable grounds to conclude that the request is part of a pattern of conduct that would interfere with the operations of the city, and therefore, I uphold the city’s decision.

[72] The appellant submits that he was not made aware of level of effort described in the city’s representations until the appeal. While the specifics provided at adjudication may not have been provided, I do not accept that the appellant was unaware that what he requested would not require a significant amount of additional effort. The clarification emails (which were attached to the city’s initial representations) show that the city flagged certain fields as “problematic,” and more specifically, that these fields could be subject to the personal privacy and the third party information exemptions. The city’s access decision also referred to these efforts, and indicated that exemptions would apply and that the record would be 38,000 lines of data long.

[73] In addition, at a more basic level, the appellant was aware of the breadth of what he was requesting: all city expenses over $1,000 for about four years. I find that the $1,000 threshold is very low for a city’s expenses (even for one year). In the circumstances, I do not accept that it would be reasonable to expect the responsive record not to be thousands of lines long.

[74] I also accept the city’s explanations as to what would be involved in processing this request, and I find that it would interfere with the city’s operations to do so. I accept the city’s evidence that it does not have a method of quickly distinguishing or sorting the data that is generated into a record, to identify which data is personal information and which is not. Likewise, I accept that it does not have this capacity to identify third party information easily.

[75] In any event, the city may be required by the Act  to notify each vendor regarding information relating to them. The fact that financial or commercial information may be ultimately ordered released on an appeal to the IPC does not relieve an institution of its third party notification obligations under the Act . While I appreciate the appellant’s willingness to forgo the “Explanation” field for thousands of lines, this would still leave the city with the legal obligation to identify and notify thousands of vendors. I find that if the city were obliged to notify the 2,500 or so vendors mentioned in its representations, this would reasonably be considered onerous on the city’s limited resources such that it would interfere with its operations, based on the evidence before me. Therefore, I am persuaded by the city’s representations that Order PO-3204 is distinguishable from the circumstances in this appeal due to the difference in volume and corresponding effort that would be involved.

[76] The appellant addresses matters relating to the purpose behind his request at some length. The city acknowledges, and I find, no reason to find bad faith behind the appellant’s request at this time. However, this does not mean that the city has not sufficiently established that processing the request would interfere with its operations. Bad faith is not at all required for the ground of frivolous and vexatious claims that the city has claimed here. In fact, bad faith is a separate ground altogether under section 4(1)(b).

[77] Finally, I decline to order the appellant to narrow his request. The appellant says that he would forgo the “Explanation” field but then repeatedly says he would “seek more information separately for specific records of interest.” In my view, that is too vague, especially considering that the responsive record is thousands of lines long, such that I can meaningfully order a remedy that would not result in a similar outcome to this appeal. If the appellant wishes to file a new request, he may do so, with the benefit of the findings in this order regarding scope and the town’s legal obligations under the mandatory exemptions at section 14(1)  and 10(1)  of the Act .

ORDER:

I uphold the city’s decision and dismiss the appeal.

Original signed by:		July 10, 2024
Marian Sami
Adjudicator