ORDER MO-3728

Appeal MA16-1

City of Toronto

January 31, 2019

Summary: The appellant made a request to the City of Toronto (the city) pursuant to the Municipal Freedom of Information and Protection of Privacy Act  (the Act ) for access to all written communications, including emails and attachments between city staff and two named professors regarding the proposed implementation of “internet voting.” The city located responsive records and granted partial access to them, withholding information pursuant to sections 7 (advice or recommendations), 8(1)(i) (security), 10(1)(a) (third party information), 11(g) (economic and other interest) and 14 (personal privacy) of the Act  with some personal information of individuals removed as non-responsive. During adjudication, the appellant raised the public interest override at section 16. In this appeal, the adjudicator finds that some of the information the city claimed was personal information is professional information and orders it disclosed. The adjudicator upholds the city’s remaining exemption claims under sections 8(1), 14, 10(1) and 11 and also finds that a compelling public interest in disclosure does not exist.

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. M.56 , as amended, sections 2 (definition of “personal information”), 8(1)(i), 10(1)(a), 11(g), 14 and 16.

Orders and Investigation Reports Considered: Orders P-900, P-984 and PO-2072-F.

Cases Considered: Ontario Hydro v. Mitchinson, [1996] O.J. No. 4636 (Div. Ct.).

BACKGROUND:

[1]  The appellant made a request to the City of Toronto (the city) pursuant to the Municipal Freedom of Information and Protection of Privacy Act  (the Act ) for access to all written communications, including emails and all attachments, between city staff and two named professors with regard to the proposed implementation of internet voting.

[2]  In its search, the city identified responsive records and granted partial access to them. Access to some of the information was denied pursuant to sections 7 (advice or recommendations), 8(1)(i) (security), 10(1)(a) (third party information) and 11(g) (economic interests of the institution) of the Act . Some personal information of individuals was also removed as not responsive to the request.

[3]  The requester, now the appellant, appealed the decision.

[4]  During the course of mediation, the city supplied the appellant with an index of records along with an explanation for any severances. In that index, the city refers to the mandatory personal privacy exemption at section 14(1) for at least three pages of records. As a result, section 14 was added to the scope of the appeal.

[5]  As mediation did not resolve the dispute, this appeal was transferred to the adjudication stage, where an adjudicator conducts a written inquiry under the Act . As the adjudicator in this appeal, I invited the parties, including affected parties, to make representations. Representations were received and shared in accordance with section 7 of IPC’s Code of Procedure and Practice Direction 7.

[6]  The scope of the request and the responsiveness of the information withheld as non-responsive was identified by the mediator as an issue between the parties. On that basis, I invited the parties to speak to that issue during the inquiry. Neither the city nor the appellant addressed this issue in their representations.

[7]  In this order, I uphold the city’s claim of section 14(1) for some of the information. I find that the withheld email does not contain the personal information of an affected party and is not exempt under section 14(1) and order this email disclosed. The remainder of the city’s decision is upheld and I find that the public interest override does not apply to require disclosure of the withheld information.

RECORDS:

[8]  The records at issue are comprised of the written communications including emails and attachments between city staff and two named professors. The records are described in an index of records, which has been shared with the appellant during mediation. The index divides the records into six different categories which for the purpose of this order will be referred to as Groups 1, 2, 3, 4, 5 and 6.

ISSUES:

1. Do the records contain “personal information” as defined in section 2(1) and, if so, to whom does it relate?
2. Does the mandatory personal privacy exemption at section 14(1) apply to the information at issue?
3. Does the discretionary exemption at section 8(1) (security) apply to the records?
4. Does the mandatory third party information exemption at section 10 apply to the records?
5. Does the discretionary exemption at section 11 (economic interests of an institution) apply to the records?
6. Did the institution exercise its discretion under sections 8(1) and 11? If so, should this office uphold the exercise of discretion?
7. Is there a compelling public interest in disclosure of the records that clearly outweighs the purpose of the section 10, 11 and 14 exemptions?
8. What is the scope of the request? What records are responsive to the request?

DISCUSSION:

Issue A: Does the record contain “personal information” as defined in section 2(1) and, if so, to whom does it relate?

[9]  In order to determine which sections of the Act  apply, it is necessary to decide whether the records contains “personal information” and if so to whom it relates. That term is defined in section 2(1) as follows:

“personal information” means recorded information about an identifiable individual, including,

(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

(c) any identifying number, symbol or other particular assigned to the individual,

(d) the address, telephone number, fingerprints or blood type of the individual,

(e) the personal opinions or views of the individual except if they relate to another individual,

(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

(g) the views or opinions of another individual about the individual, and

(h) the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

[10]  The list of examples of personal information under section 2(1) is not exhaustive. Therefore, information that does not fall under paragraphs (a) to (h) may still qualify as personal information. [1]

[11]  Sections (2.1) and (2.2) also relate to the definition of personal information. These sections state:

(2.1) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

(2.2) For greater certainty, subsection (2.1) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling.

[12]  To qualify as personal information, the information must be about the individual in a personal capacity. As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be “about” the individual. [2]

[13]  Even if information relates to an individual in a professional, official or business capacity, it may still qualify as personal information if the information reveals something of a personal nature about the individual. [3]

[14]  To qualify as personal information, it must be reasonable to expect that an individual may be identified if the information is disclosed. [4]

Representations:

[15]  The city submits that there are three pages of records in Group 5 which contain personal information. It refers to an email address on pages 1 and 7 (appearing on page 7 in 3 separate instances) and also information that indicates aspects of the health of an individual on page 131 of Group 5. [5] The city claims that this is personal information (email address and medical information) within the meaning of that term as defined in section 2(1)  of the Act .

[16]  The city submits that personal email addresses are personal information. It notes that this office distinguishes between professional and personal email addresses and notes that the email address in this appeal is not a professional email address and as such, qualifies as personal information as defined in section 2(1)  of the Act . It also submits that information about an individual’s medical history is a listed example of personal information under the Act .

[17]  The appellant argues that the records relate to security experts and would not contain their personal information.

[18]  The affected parties named in the request, were also invited to provide representations in this appeal. None of the affected parties provided representations.

Finding

[19]  The city identified an email address and medical information relating to a city employee as personal information.

[20]  I find that the email address of the specified professor is not personal information because it was used in a business context in order to communicate with the city regarding internet voting. I find that section 2(2.2) applies to this information. As only personal information can be withheld under section 14(1), I will order the city to disclose this information to the appellant.

[21]  In my view, the health information relating to a city employee is not professional information but is personal information and fits within paragraphs (b) and (h) of section 2(1)  of the Act . Accordingly, I will consider whether this information is exempt under section 14(1).

Issue B: Does the mandatory personal privacy exemption at section 14(1) apply to the information at issue?

[22]  Where a requester seeks personal information of another individual, section 14(1) prohibits an institution from releasing this information unless one of the exceptions in paragraphs (a) to (f) of section 14(1) applies.

[23]  In the circumstances, it appears that the only exception that could apply is section 14(1)(f), which allows disclosure if it would not be an unjustified invasion of personal privacy.

[24]  The factors and presumptions in sections 14(2) and (3) help in determining whether disclosure would or would not be an unjustified invasion of privacy under section 14(1)(f). Also, section 14(4) lists situations that would not be an unjustified invasion of personal privacy.

[25]  If any of paragraphs (a) to (h) of section 14(3) apply, disclosure of the information is presumed to be an unjustified invasion of personal privacy under section 14. Once established, a presumed unjustified invasion of personal privacy under section 14(3) can only be overcome if section 14(4) or the “public interest override” at section 16 applies. [6]

[26]  The city submits that the presumption at paragraph (a) of section 14(3) applies as the personal information in question relates to a medical condition.

Representations:

[27]  The city submits that it withheld portions of pages 1, 7, and 131 of Group 5 on the basis of section 14. It states that where records contain personal information of another individual other than the appellant, section 14(1) prohibits the disclosure of the personal information at issue except in certain circumstances. It is the city’s submission that the only relevant exception in this appeal is section 14(1)(f).

[28]  The only information I have found to be personal information is the information withheld on page 131. The city submits that this is personal information about an individual’s health status, and refers to the presumption at section 14(3)(a) which supports non-disclosure of the information. The city claims section 14(3)(a) applies because the personal information, “relates to a medical, psychiatric or psychological history, diagnosis, condition, treatment or evaluation.” The city submits that although this information may be considered minor or general, the information meets the requirements of section 14(3)(a) and therefore the presumption applies and releasing the information would constitute an unjustified invasion of personal privacy.

[29]  I find that the presumption in section 14(3)(a) applies to the withheld information such that disclosure is presumed to be an unjustified invasion of the individual’s personal privacy. I also find that none of the circumstances listed in section 14(4) apply. Accordingly, this information is exempt under section 14(1) subject to my finding on the appellant’s public interest claim.

Issue C: Does the discretionary exemption at section 8(1) (security) apply to the records?

[30]  The city relies on section 8(1)(i) to withhold portions of the records.

[31]  Sections 8(1) states, in part:

(1) A head may refuse to disclose a record if the disclosure could reasonably be expected to,

(i) endanger the security of a building or the security of a vehicle carrying items, or of a system or procedure established for the protection of items, for which protection is reasonably required;

[32]  Generally, the law enforcement exemption must be approached in a sensitive manner, recognizing the difficulty of predicting future events in a law enforcement context [Ontario (Attorney General) v. Fineberg (1994), 19 O.R. (3d) 197 (Div. Ct.)].

[33]  In the case of section 8(1)(i), where section 8 uses the words “could reasonably be expected to”, the institution must provide detailed evidence to establish a “reasonable expectation of harm”. Evidence amounting to speculation of possible harm is not sufficient [Order PO-2037, upheld on judicial review in Ontario (Attorney General) v. Ontario (Information and Privacy Commissioner), [2003] O.J. No. 2182 (Div. Ct.), Ontario (Workers’ Compensation Board) v. Ontario (Assistant Information and Privacy Commissioner) (1998), 41 O.R. (3d) 464 (C.A.)].

[34]  It is not enough for an institution to take the position that the harms under section 8 are self-evident from the record or that the exemption applies simply because of the existence of a continuing law enforcement matter. [7] The institution must provide detailed evidence about the potential for harm. It must demonstrate a risk of harm that is well beyond the merely possible or speculative although it need not prove that disclosure will in fact result in such harm. How much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences. [8]

[35]  Although this provision is found in a section of the Act  dealing specifically with law enforcement matters, it is not restricted to law enforcement situations and can cover any building, vehicle or system which requires protection. [9]

Representations

[36]  The city indicated that it applied section 8(1)(i) to portions of the records because if this information were disclosed, it could allow individuals to interfere with the orderly operation of internet voting systems (the “protection-redactions”). The city notes that this exemption forms part of the “law enforcement” exemption and submits that the IPC has previously established that its application is not restricted to law enforcement situations but can be extended to any building, vehicle or system which reasonably requires protection. [10]

[37]  The city submits that the withheld information reviews issues of potential vulnerabilities of internet voting systems, along with steps to be taken to address those vulnerabilities. The city states that there can be no dispute that a system for the casting of ballots in democratic elections is something that deserves protection. The city notes that the review is related to the security systems and procedures proposed, rejected and contemplated to be put into place with respect to the city’s efforts respecting the internet voting processes, both generally, and with respect to specific potential systems being proposed. The city submits that recent world events show that protection of the free exercise of democratic rights is something that is reasonably required.

[38]  The city submits that the redactions include specific references to “cryptography keys,” along with discussions of potential vulnerabilities, arising in light of a specific computer virus, and steps to be taken with respect to these vulnerabilities related to the third party company’s proposal. The city states that the redactions include specific reference to specific security issues that would be relevant for all forms of implementation of internet voting. The city notes that it claimed the section 8(1)(i) exemption on the basis that such information may be used for the purpose of circumventing the city’s processes which are designed to avoid misuse of internet voting systems for purposes other than the accurate and reliable transmission of individuals’ votes on specific municipal election matters.

[39]  The city submits the IPC has determined that section 8(1)(i) must be approached in a sensitive manner, recognizing the difficulty of predicting future events [11] ; however, the reasons for resisting disclosure must not be frivolous or exaggerated. [12] As indicated by previous IPC orders, disclosure under the Act : "represents 'disclosure to the world' and once in the public domain, there is no way of limiting or controlling the use of this information for illegal purposes." [13] The city submits that there is no actual dispute that the disclosure of information concerning the particular information in question would allow individuals to more easily exploit potential vulnerabilities to interfere or reduce the efficacy of the system and process designed to protect the exercise of democratic involvement utilizing internet technology.

[40]  The city submits that the appellant’s position is that the city should choose to expose itself to this sort of harm, and implement additional security measures to prevent the harms this disclosure would cause. The city submits that the appellant is of the opinion that exposing vulnerabilities to the public will, if combined with additional security matters, have benefits for the city and/or the third party company.

[41]  The city submits that the appellant’s opinion regarding the appropriate suite of security measures to take in order to deal with potential harms from the aftermath of disclosure of the protection-redactions does not change the fact that the disclosure of potential vulnerabilities of the systems does in itself endanger these systems' security. The city refers to the appellant’s position that it is “obvious” that individuals will attempt to “break” the internet voting systems and that she does not dispute that some of the requested information may be used by individuals to “break” these systems.

[42]  The city submits that the appellant’s position is that it should choose to disclose the information for which section 8(1)(i) has been claimed, because in the appellant’s opinion, the best method to protect the various systems is to: a) make disclosure of the information; b) thereby endangering the security of the system by making it somewhat easier for individuals to "break" the system; and, c) utilize the feedback from the attempts to "break" the system to identify advances for purposes of security.

[43]  The appellant does not comment specifically on the application of section 8(1)(i) in her representations. The appellant’s submissions focus mainly on a public interest in disclosure which is discussed below.

Analysis and finding

[44]  To establish a valid exemption claim under section 8(1)(i), the city must provide detailed evidence to establish a “reasonable expectation of harm”. I have carefully reviewed the portions of the records withheld under section 8(1)(i) and find that disclosure of the information at issue could reasonably be expected to result in the harms identified by the city.

[45]  In making this determination, I rely on Order P-900, where Adjudicator Cropley considered whether section 14(1)(i) (the provincial Act  equivalent to section 8(1)(i)) was restricted to law enforcement matters. In that order, the adjudicator found that although “section 14(1)(i) is included in the section of the Act  which specifically addresses law enforcement concerns, there is nothing in the section which indicates that it is restricted to law enforcement matters.” The adjudicator found that section 14(1)(i) did not refer to a law enforcement matter and therefore “this section relates to security for the protection of any building, vehicle or system for which such protection is reasonably required.” I adopt this reasoning for the purpose of this appeal.

[46]  I am satisfied that disclosure of information could reasonably be expected to allow individuals to interfere with the orderly operation of the city’s internet voting systems. After a review of the information withheld under section 8(1)(i), I agree that it addresses potential vulnerabilities of internet voting systems, along with steps to be taken to address those vulnerabilities. As submitted by the city, I find that the redactions include specific references to “cryptography keys,” along with discussions of potential vulnerabilities, arising in light of a specific computer virus, and steps to be taken with respect to these vulnerabilities related to the third party company’s proposal. The redactions include reference to specific security issues that would be relevant for all forms of implementation of internet voting. I agree with the city that the section 8(1)(i) exemption applies to the redactions on the basis that the redacted information may be used for the purpose of circumventing the city’s processes to avoid misuse of internet voting systems for purposes other than the accurate and reliable transmission of individuals’ votes on specific municipal election matters.

[47]  Having regard to the above, I am satisfied that disclosure of the withheld portions of the records qualify for exemption under section 8(1)(i). I will consider the city’s exercise of discretion below.

[48]  The city claimed the exemption for advice and recommendations at section 7(1) to withhold the same information it claimed was exempt under section 8(1)(i). As I have upheld the city’s application of section 8(1)(i), I do not need to consider the application of section 7(1).

Issue D: Does the mandatory exemption for third party information at section 10 apply to the records?

[49]  The city claimed section 10(1) to withhold information that it says is technical information relating to the particulars of the third party company’s proposal.

[50]  Section 10(1) states, in part:

A head shall refuse to disclose a record that reveals a trade secret or scientific, technical, commercial, financial or labour relations information, supplied in confidence implicitly or explicitly, if the disclosure could reasonably be expected to,

(a) prejudice significantly the competitive position or interfere significantly with the contractual or other negotiations of a person, group of persons, or organization;

(b) result in similar information no longer being supplied to the institution where it is in the public interest that similar information continue to be so supplied;

(c) result in undue loss or gain to any person, group, committee or financial institution or agency; or

[51]  Section 10(1) is designed to protect the confidential “informational assets” of businesses or other organizations that provide information to government institutions. [14] Although one of the central purposes of the Act  is to shed light on the operations of government, section 10(1) serves to limit disclosure of confidential information of third parties that could be exploited by a competitor in the marketplace. [15]

[52]  For section 10(1) to apply, the city must satisfy each part of the following three- part test:

1. the record must reveal information that is a trade secret or scientific, technical, commercial, financial or labour relations information; and
2. the information must have been supplied to the institution in confidence, either implicitly or explicitly; and
3. the prospect of disclosure of the record must give rise to a reasonable expectation that one of the harms specified in paragraph (a), (b), (c) and/or (d) of section 10(1) will occur. Part 1: type of information

[53]  The types of information listed in section 10(1) have been discussed in prior orders. The one that is relevant in this appeal is:

Technical information is information belonging to an organized field of knowledge that would fall under the general categories of applied sciences or mechanical arts. Examples of these fields include architecture, engineering or electronics. While it is difficult to define technical information in a precise fashion, it will usually involve information prepared by a professional in the field and describe the construction, operation or maintenance of a structure, process, equipment or thing. [16]

[54]  I adopt this definition for the purpose of this appeal.

[55]  In its representations, the city states that the information that was withheld under section 10(1) is technical information relating to the particulars of the third party company’s proposal. It refers to Order P-454 and submits that the IPC has concluded that technical information would include "information belonging to an organized field of knowledge which would fall under the general categories of applied sciences or mechanical arts" and although difficult to define in a "precise fashion," technical information will usually involve information prepared by a professional in the field and describe the construction, operation or maintenance of a structure, process, equipment or thing. The city submits that these redactions deal with the specific aspects of the internet voting systems proposed by the third party company and argues that there is no significant dispute that the information covered in these redactions is technical information.

[56]  The appellant did not speak to the type of information that was withheld under section 10(1) in her representations.

[57]  The third party company, although invited, did not provide representations in this appeal.

[58]  In reviewing the portions of the records that were withheld under section 10(1)  of the Act , I am satisfied that they all contain technical information, as defined, as they include “information prepared by a professional in the field and describes the construction, operation or maintenance of a structure, process, equipment or thing.”

Part 2: supplied in confidence

Supplied

[59]  The requirement that the information was “supplied” to the institution reflects the purpose in section 10(1) of protecting the informational assets of third parties. [17]

[60]  Information may qualify as “supplied” if it was directly supplied to an institution by a third party, or where its disclosure would reveal or permit the drawing of accurate inferences with respect to information supplied by a third party. [18]

[61]  The city submits that there is no dispute that this information originated from the third party company and was supplied to the city.

[62]  The appellant did not speak to this part of the section 10(1) test in her representations.

[63]  In my review of the withheld information under section 10(1), I agree with the city that the technical information was supplied to it by the third party.

In confidence

[64]  In order to satisfy the “in confidence” component of part two, the parties resisting disclosure must establish that the supplier of the information had a reasonable expectation of confidentiality, implicit or explicit, at the time the information was provided. This expectation must have an objective basis. [19]

[65]  In determining whether an expectation of confidentiality is based on reasonable and objective grounds, all the circumstances are considered, including whether the information was

• communicated to the institution on the basis that it was confidential and that it was to be kept confidential
• treated consistently by the third party in a manner that indicates a concern for confidentiality
• not otherwise disclosed or available from sources to which the public has access
• prepared for a purpose that would not entail disclosure [20]

[66]  The city submits that the records held under section 10(1) were supplied with an explicit expectation of confidentiality but provided no evidence to establish this.

[67]  After my review of the withheld information, I find the records do not establish that there was an explicit expectation of confidentiality between the city and the third party. However, it is clear from the records that there was an implied expectation of confidentiality given the information, including recommendations on the security of internet voting. Therefore, I find that the records were supplied to the city with an expectation of confidentiality and part 2 is met.

Part 3: harms

General principles

[68]  The party resisting disclosure must provide detailed evidence about the potential for harm. It must demonstrate a risk of harm that is well beyond the merely possible or speculative although it need not prove that disclosure will in fact result in such harm. How much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences. [21]

[69]  The failure of a party resisting disclosure to provide detailed evidence will not necessarily defeat the claim for exemption where harm can be inferred from the surrounding circumstances. However, parties should not assume that the harms under section 10(1) are self-evident or can be proven simply by repeating the description of harms in the Act . [22]

Representations

[70]  The city submits that the information that was withheld under section 10(1) includes information on technical implementation (schematics, cryptology keys, operating system details, set up information, etc.) which could, if disclosed, have adverse impact to the third party company. It submits that the appellant does not dispute the potential for these adverse impacts. The city submits that the results of publishing the specific inner-workings of the third party’s system will allow the public, including both "good-guy" and "bad-guy" hackers, and competitors of the third party to review and utilize it to exploit the particulars of its system.

[71]  The city submits that it is reasonable to assume that the disclosure of the third party’s technical information to the public could be expected to have a negative effect on the third party’s competitive position in the market. The city submits that disclosure of the potential vulnerabilities of the third party’s system will allow for increased ease in exploiting these vulnerabilities by hackers. It is submitted that the hackers' actions will require the third party to implement counter-measures to address the increased vulnerability. These disclosures will cause the third party to divert resources from other methods of product improvement thereby disadvantaging the third party in the marketplace. The city submits that the third party’s competitive position will be affected by having to deal with the number of people "breaking" elements of its system as a result of the proposed disclosure, in comparison to its competitors which would not be subject to the same sort of increased public availability of technical information.

[72]  The city further submits that the disclosure of this information will assist the third party’s competitors in re-engineering layouts or systems specific to its systems for use in their products. It also submits that the third party’s competitors may utilize the technical information to develop advancements to their own programs, or to develop marketing materials "playing up" relative strengths of their products in comparison to the third party, while developing processes to off-set any potential relative weakness of their products. The city submits that the third party will not have the ability to implement similar counter-measures with respect to its competitor’s products.

[73]  The appellant submits that the primary motivation for the city in “fighting” her request is that it wants to protect the third party from embarrassing revelations, which she submits is not its role. The appellant submits that instead, the city should make the vulnerabilities public, after giving the third party time to repair those vulnerabilities, so that other cities do not put their elections at risk by using that third party’s unrepaired insecure system. The appellant submits that more than enough time has passed for the third party to have fixed the vulnerabilities and there is no further justification in delaying the release of the information.

[74]  The city provided reply representations in this appeal. It notes that throughout the appeal process, the appellant has not denied that disclosure of some or all of the withheld information would allow individuals to harm the city and third parties. The city submits that the appellant believes that the city should expose itself and others to these harms caused by disclosure, and then expend public funds to adopt a specific security process urged by the appellant. The city submits that the appellant does not appear to be disputing its application of the Act but disputes the city’s larger policy decision to adopt a security protocol that does not utilize public funds to advance the private interest of certain members of the public. The city submits that second guessing policy decision and mandating institutions to adopt specific policies and expend public resources is not the role of the IPC.

Analysis and finding

[75]  In my view the city has provided detailed evidence about the potential for harm under the section 10(1) exemption. In addition, after reviewing the parties’ representations, I find that it has demonstrated that the risk of harm is well beyond the mere possible or speculative, which was reinforced by the appellant’s own representations.

[76]  After my review of the records withheld under section 10(1), I agree with the city that they include information on technical implementation of the online voting system which if disclosed could reasonably be expected to have an adverse impact to the third party. I accept that by disclosing the withheld information, the third party’s competitors would be able to utilize the technical information to possibly develop advancements to their own programs, or affect the way that competitor may market its own product in comparison to the third party.

[77]  Based on my review, I find the city has established the harm set out in section 10(1)(a). I find that if the withheld information is disclosed it could reasonably be expected to “prejudice significantly the competitive position or interfere significantly with the contractual or other negotiations” of the third party. Therefore, I find that section 10(1) was properly applied to the records that have been withheld under this section.

Issue E: Does the discretionary exemption at section 11 (economic and other interests) apply to the records?

[78]  In many instances where the city claimed the section 11 exemption, it also claimed the section 8(1) exemption. Since I have upheld the city’s claim with regard to section 8(1)(i), the only remaining information for which the section 11 exemption could apply appears in Group 1, pages 9 to 54.

[79]  The city claims the application of section 11(g), which provides:

A head may refuse to disclose a record that contains,

(g) information including the proposed plans, policies or projects of an institution if the disclosure could reasonably be expected to result in premature disclosure of a pending policy decision or undue financial benefit or loss to a person;

[80]  The purpose of section 11 is to protect certain economic interests of institutions. Generally, it is intended to exempt commercially valuable information of institutions to the same extent that similar information of non-governmental organizations is protected under the Act . [23]

[81]  For section 11(g) to apply, the institution must provide detailed evidence about the potential for harm. It must demonstrate a risk of harm that is well beyond the merely possible or speculative although it need not prove that disclosure will in fact result in such harm. How much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences. [24]

[82]  The failure to provide detailed evidence will not necessarily defeat the institution’s claim for exemption where harm can be inferred from the surrounding circumstances. However, parties should not assume that the harms under section 11 are self-evident or can be proven simply by repeating the description of harms in the Act . [25]

[83]  The fact that disclosure of contractual arrangements may subject individuals or corporations doing business with an institution to a more competitive bidding process does not prejudice the institution’s economic interests, competitive position or financial interests. [26]

[84]  In order for section 11(g) to apply, the institution must show that:

1. the record contains information including proposed plans, policies or projects of an institution; and

2. disclosure of the record could reasonably be expected to result in:

(i) premature disclosure of a pending policy decision, or

(ii) undue financial benefit or loss to a person. [27]

[85]  The term "pending policy decision" refers to a situation where a policy decision has been reached, but has not yet been announced. [28]

Representations

[86]  The city relies on section 11(g) to deny access to portions of the withheld records which indicate its plans, policies or projects concerning the topic of internet voting. The city submits that in particular, it withheld access to the portions of the records that would indicate the specific elements of next steps that it would be taking with respect to the issue of internet voting.

[87]  The city submits that it is required to demonstrate only that there is a reasonable basis for expecting more than a possibility of the specified harms (in this case the premature disclosure of a pending policy decision, or undue financial benefit or loss to a person) from the disclosure of requested records. The city submits that the withheld portions of the records contain details, requirements, strategies, positions, plans, procedures, criteria and instructions relating to the specific decisions concerning implementation of internet voting. It submits that disclosure of these redactions will reveal to the public at large the substance of these policy decisions, prior to the city being in a position to implement these decisions. It further submits that disclosure would reveal certain next steps, and the specific concerns relevant to the potential courses of action the city would take on internet voting, prior to such time as it is in a position to implement these decisions. The city submits that this potential satisfies the requirement of harm required by section 11(g).

[88]  The city also submits that the disclosure of the withheld information could prejudice existing suppliers, and indicate to other vendors potential opportunities which would allow them to utilize this information to situate themselves in an advantageous position for potential future negotiations with the city. For example, the city submits that the disclosure of details concerning internet voting, prior to its implementation of the policy decision, would allow larger vendors to begin developing particular systems and procedures to address specific concerns of the city with respect to future elements of internet voting. This would be in advance of the city being in the position to implement such policy decisions. It submits that other smaller vendors unable to establish specialized R&D for potential customers, in addition to the general R&D required by all industry participants, would be disadvantaged. Therefore, it submits that premature disclosure of the information in the records would allow certain individuals to obtain an advantage over others.

Analysis and finding

[89]  As noted, in order for section 11(g) to apply, the city must show that:

1. the record contains information including proposed plans, policies or projects of an institution; and

2. disclosure of the record could reasonably be expected to result in:

(i) premature disclosure of a pending policy decision, or

(ii) undue financial benefit or loss to a person. [29]

[90]  After my review of the remaining withheld information, I agree with the city that the section 11 exemption applies. I find the city has withheld portions of this record containing details, requirements, strategies, positions, plans, procedures, criteria and instructions relating to the specific decisions concerning implementation of internet voting. Therefore, I find that the city has established that part one of the test has been met.

[91]  I also find that disclosure of the withheld information prior to the implementation of these steps will reveal the substance of these policy decisions. In addition, I find that disclosure would reveal certain next steps on the policy decision, and the specific concerns relevant to the potential courses of action the city would take on internet voting, prior to such time as it is in a position to implement these decisions. I find this satisfies the second part of the test and I find that the city has established that section 11(g) applies to the withheld information in Group 1, pages 9 – 54. I will consider the city’s exercise of discretion below.

Issue F: Did the institution exercise its discretion under sections 8 and 11? If so, should this office uphold the exercise of discretion?

[92]  The sections 8 and 11 exemptions are discretionary, and permit an institution to disclose information, despite the fact that it could withhold it. An institution must exercise its discretion. On appeal, the Commissioner may determine whether the institution failed to do so.

[93]  In addition, the Commissioner may find that the institution erred in exercising its discretion where, for example,

• • it does so in bad faith or for an improper purpose

• • it takes into account irrelevant considerations

• • it fails to take into account relevant considerations.

[94]  In either case this office may send the matter back to the institution for an exercise of discretion based on proper considerations. [30] This office may not, however, substitute its own discretion for that of the institution. [31]

[95]  Relevant considerations may include those listed below. However, not all those listed will necessarily be relevant, and additional unlisted considerations may be relevant: [32]

• • the purposes of the Act , including the principles that

• o information should be available to the public

• o individuals should have a right of access to their own personal information

• o exemptions from the right of access should be limited and specific

• o the privacy of individuals should be protected

• • the wording of the exemption and the interests it seeks to protect

• • whether the requester is seeking his or her own personal information

• • whether the requester has a sympathetic or compelling need to receive the information

• • whether the requester is an individual or an organization

• • the relationship between the requester and any affected persons

• • whether disclosure will increase public confidence in the operation of the institution

• • the nature of the information and the extent to which it is significant and/or sensitive to the institution, the requester or any affected person

• • the age of the information

• • the historic practice of the institution with respect to similar information.

Representations

[96]  The city submits that it reviewed all of the relevant implications of releasing or denying access to the information in question and that in considering how to respond to these requests, it took into account all of the relevant considerations. The city submits that it considered

• • the purposes and principles of the Act  including the principles that information should be available to the public and exemptions to the right of access, should reflect the specific and limited circumstances where non-disclosure is necessary for the proper operation of municipal institutions; the wording of the relevant exemptions and the interests the exemptions seek to protect

• • the fact that the appellant has expressed an interest in utilizing the information for purposes of reviewing risks and vulnerabilities in a specific commercial product

• • the nature of the information and the fact that the records are highly significant and sensitive to the city, and indirectly to another entity

• • the historic practice of the city in relation to the requested materials.

[97]  The city submits that the appellant’s objection to its decision is largely driven by her opinion that the specific technical information should be released to help ensure public confidence in the city’s decisions concerning internet voting and the implementation of the third party company’s system. The city submits that it reviewed this issue carefully and concluded that the impact on public confidence in the city’s operations resulting from disclosure would be both positive and negative. It submits the positive aspects would be that individuals would see the details of the city's review and evaluation of specific technical aspects of the implementation of internet voting, generally, and specific proposed systems. However, it submits the public confidence in the city's operations would be negatively impacted, as the increased technical details of the specific systems involved would then be able to be exploited for purposes not in the public interest.

[98]  The city also explains that in exercising its discretion to not disclose the information, it considered that disclosing the information in dispute would allow for specific issues regarding internet voting to be identified and exploited; to mitigate this adverse impact, the city submits that it would be required to expend additional funds and efforts if the information is released.

[99]  The city submits that its head considered all relevant factors and properly engaged in a good faith exercise of her discretion under the Act , and that this exercise of discretion should be upheld.

[100]  The appellant did not specifically address the city’s exercise of discretion in her representations.

Finding

[101]  I have considered the circumstances surrounding this appeal and the parties’ representations and I am satisfied that the city has properly exercised its discretion with respect to sections 8(1)  and 11  of the Act . I am satisfied that the city did not exercise its discretion in bad faith or for an improper purpose. I am satisfied that the city considered the purposes of the Act and the various exemptions that it claimed, and has given due regard to the nature and sensitivity of the information in the specific circumstances of this appeal. Accordingly, I find that the city took relevant factors into account and I uphold its exercise of discretion in this appeal.

Issue G: Is there a compelling public interest in disclosure of the records that clearly outweighs the purpose of the section 10(1), 11 and 14(1) exemptions?

[102]  As noted, records that are found to be exempt under section 8  of the Act  are not subject to the public interest override. Having upheld the city’s exemption claim under section 8 to all records for which it was claimed, the remaining records that could be subject to the public interest override are those found to be exempt under sections 10(1), 11 and 14(1) and consist of the following records:

• • In Group 1, pages 9 to 54 which have been found to be exempt under section 11

• • In Group 2, pages 36 to 45 and 47 to 51 which have been found to be exempt under section 10(1)

• • In Group 4, pages 3 to 309 and 316 to 341 which have been found to be exempt under section 10(1)

• • In Group 5, page 131 which was found to be exempt under section 14(1)

• • In Group 6, pages 4 to 5, 19 to 47 and 49 have been found to be exempt under section 10(1).

[103]  Section 16 states:

An exemption from disclosure of a record under sections 7, 9, 10, 11, 13 and 14 does not apply if a compelling public interest in the disclosure of the record clearly outweighs the purpose of the exemption.

[104]  For section 16 to apply, two requirements must be met. First, there must be a compelling public interest in disclosure of the records. Second, this interest must clearly outweigh the purpose of the exemption.

[105]  The Act  is silent as to who bears the burden of proof in respect of section 16. This onus cannot be absolute in the case of an appellant who has not had the benefit of reviewing the requested records before making submissions in support of his or her contention that section 16 applies. To find otherwise would be to impose an onus which could seldom if ever be met by an appellant. Accordingly, the IPC will review the records with a view to determining whether there could be a compelling public interest in disclosure which clearly outweighs the purpose of the exemption. [33]

[106]  In considering whether there is a “public interest” in disclosure of the record, the first question to ask is whether there is a relationship between the record and the Act ’s central purpose of shedding light on the operations of government. [34] Previous orders have stated that in order to find a compelling public interest in disclosure, the information in the record must serve the purpose of informing or enlightening the citizenry about the activities of their government or its agencies, adding in some way to the information the public has to make effective use of the means of expressing public opinion or to make political choices. [35]

[107]  A public interest does not exist where the interests being advanced are essentially private in nature. [36] Where a private interest in disclosure raises issues of more general application, a public interest may be found to exist. [37]

[108]  The word “compelling” has been defined in previous orders as “rousing strong interest or attention”. [38]

[109]  Any public interest in non-disclosure that may exist also must be considered. [39] A public interest in the non-disclosure of the record may bring the public interest in disclosure below the threshold of “compelling”. [40]

Representations

[110]  As noted, most of the appellant’s submissions deal with the public interest in disclosing the withheld information. The appellant submits that it is in the interest of residents of Toronto and Canada to release the requested information. The appellant submits that the security and accuracy of elections is the foundation of democracy and public trust in government begins when the declared election winners are the actual winners. The appellant submits that internet voting will put our elections at risk and will erode that trust and threaten our democracy.

[111]  The appellant submits that she requested communications relating to the third party company because this third party has been hired to provide internet voting services by the city. The appellant submits that according to the security analysis of the third party company’s (and other third parties) internet voting system, no proposal provides adequate protection against the risks inherent in internet voting and it was recommended that the city not proceed with internet voting in the upcoming municipal election.

[112]  The appellant submits that despite the unambiguous warning from the security experts hired by the city, the third party company was given a contract to conduct internet voting, although the contract ultimately was cancelled. However, the appellant submits that in the interest of transparency and to avoid the possibility that the city might in future contract for an insecure form of voting, the requested documents should be made public.

[113]  The appellant refers to the 2016 U.S. election which she submits was hacked by the Russians and refers to a leaked classified NSA report that states that Russian hackers successfully broke into VR systems. [41] The appellant submits that it is highly likely that the third party could be vulnerable to the same attack that was conducted against VR systems and that the requested information should provide some insight into the third party’s vulnerabilities.

[114]  The appellant submits that there have been numerous successful attacks on a large number of corporate and government entities and that at least one NDP internet election was hit with attacks that may have affected the outcome. The appellant submits that if companies like Google and Symantec, which hire large numbers of computer security experts, and banks like JPMorgan Chase and Tesco, who spend vast sums of money to protect their systems, are vulnerable, why would the city be able to protect itself against an attack on an internet based election.

[115]  The appellant submits that not only would Toronto election servers be vulnerable, but so would the computers used by voters. The appellant compares this to on-line banking which she submits the public believes is safe but vast sums of money are stolen annually from on-line bank accounts by malware surreptitiously installed on victims’ machines. The appellant submits that banks can and do replace stolen money but no one can replace stolen or modified votes.

[116]  The appellant also submits that in addition to the security study conducted by the city, at least two other Canadian studies concluded that internet voting is unsafe and should not be implemented.

[117]  In the city’s reply representations, it addressed the public interest identified by the appellant. The city submits that there is currently no internet voting program taking place at the city. The city submits that the disclosed information confirms that recommendations confirmed that proceeding with internet voting at that time would result in specific security risks which could not be reasonably mitigated.

[118]  The city submits that in considering whether there is a public interest in disclosure of the records, the first question to ask is whether there is a relationship between the specific information for which access has been withheld and the Act ’s central purpose of shedding light on the operations of government. The city submits that previous IPC orders have stated that in order to find a “compelling” public interest in disclosure, the information in the record must serve the purpose of informing or enlightening the citizenry about the activities of their government or its agencies, adding in some way to the information the public has to make effective use of the means of expressing public opinion or to make political choices. The city submits that the word compelling has been defined in previous orders as "rousing strong interest or attention."

[119]  The city submits that the appellant has put forward the opinion that disclosing the information will assist certain members of the public, with specific skills and interests, to attempt to “break” the various systems for their own purpose, or allow for detailed review of the specific features of the specific system by people with specialized knowledge and skill, such as the appellant. The city submits that obtaining specific technical knowledge advanced for personal gain, is not a public interest. The city submits that the appellant is attempting to convert a “private interest” into a public interest by suggesting that disclosure should be made to advance the private interests of individuals and then further public funds should be utilized to attempt to capture a public benefit.

[120]  The city submits that the IPC has found that a compelling public interest does not exist where, for example, another public process or forum has been established to address public interest considerations; [42] or a significant amount of information has already been disclosed and this is adequate to address any public interest considerations; [43] where there has already been wide public coverage or debate of the issues, and the records would not shed further light on the matter. [44] The city also submits that the IPC has found that a compelling public interest does not exist where the records do not respond to the applicable public interest raised by the appellant. [45]

[121]  The city submits that currently, it is indisputable that the topic of internet voting and the city’s decision has been the subject of wide public coverage and debate. It submits it has hosted a number of public consultations on reform to voting systems and has had public debates before council and committees of council on these issues over several years. The city submits that a significant amount of information has already been disclosed to the public through other public processes and to the appellant in responding to the request in this appeal. The city submits that disclosure of the withheld information would not shed further light on the matter as a whole and that as such no public interest in disclosure has been established.

[122]  The city submits that the appellant has not raised a specific public interest in the current information requested, compelling or otherwise, nor established a basis as to how the information in these records would related to this public interest.

[123]  The city submits that any public interest in non-disclosure must also be considered in this appeal. And if there is a significant public interest in the non-disclosure of the withheld information, then any interest advanced by disclosure cannot be considered “compelling” and the public interest override will not apply to the information. The city submits that there is a public interest in non-disclosure of the records. Not disclosing the information at issue would avoid the potential harms to the city from hackers and competitors utilizing the information. Moreover, the city would not be forced to expend funds to defend its systems from hackers or other similar parties (as well as avoiding the use of public funds for advancing private interests of hackers and other similar interested parties).

[124]  The city submits that while the appellant has outlined general concerns with internet voting, she has not indicated how disclosing the withheld information would provide assistance for members of the public in engaging in a policy decision in relation to this issue that would outweigh the specific purposes of these exemptions. The city submits that disclosing the information would allow for specific issues to be identified and exploited in furtherance of private interests. The city submits that not only would it be required to expend additional funds and efforts to mitigate the adverse impact to it, but it would be deprived of the advantage of the advice received, criteria to be applied to advance this advice, and the possibility of obtaining similar technical information again in the future.

[125]  The city further submits that the existence of a compelling public interest is not sufficient to trigger disclosure under section 16. It submits that the interest must also clearly outweigh the purpose of the established exemption claim in the specific circumstances.

[126]  The appellant was provided with a copy of the city’s representations and provided further representations in reply. The appellant submits that after reviewing the city’s representations, it appears that it is more concerned with protecting the third party vendor than with protecting the security of public elections in Ontario.

[127]  The appellant states that she has dedicated the last 14 years of her life to working pro bono on making elections secure in the U.S. and Canada. For example, the appellant indicates that she testified before the parliamentary Standing Committee on election reform in Vancouver. In response to the city’s representations, the appellant submits the following:

• • She is not a hacker

• • She is opposed to malicious hacking

• • She has no financial stake in the outcome of this appeal and has spent both money and time pursuing same

• • She wants to make elections as secure as possible in Toronto and elsewhere.

[128]  With regard to the city’s suggestion that the appellant wants it to expose itself to harms, the appellant submits that it is the harm of insecure internet voting that she is trying to protect the city against. The appellant references “widespread attacks on liberal democracies conducted by Russia,” and notes that other countries such as North Korea and Iran also have the capacity to attack internet elections. The appellant also submits that if there were successful attacks, there is a good chance that it would not be discovered immediately or potentially at all.

[129]  With regard to the city’s suggestion that the appellant wants it to expend public funds to adopt the specific security program that she selected in order to further the private interests of hackers and other individuals, the appellant submits that she has never been interested in furthering the private interests of hackers. She submits that she wants to see the city adopt a security program that prevents the deployment of insecure voting systems. The appellant submits that it appears that the city is eager to protect an insecure voting system that would indeed satisfy the interests of the very hackers it accuses her of supporting.

[130]  The appellant refers to the city’s submission that there is currently no program in place that would create risks to the democratic process. The appellant submits that the city signed a contract with the third party provider even though named professors recommended against it. The appellant submits that the city could decide to implement internet voting in the future and that it is critical that the public be informed of all the potential risks, including any risks that are being withheld from the public in this appeal.

[131]  Even though the appellant indicates that she is not a hacker, she speaks to hacking in her representations in order to clarify points made by the city. The appellant submits that “white-hat hackers” work by attempting, with permission, to break into systems to determine where they are insecure. She submits that white-hat hackers are in great demand wherever computers are widely used. The appellant refers to two studies completed in California and Ohio where the states hired computer security experts to attempt to hack into the voting system in order to determine how secure the systems were. The appellant submits that in all cases, the “hackers” succeeded in breaking into the systems resulting in them being ultimately decommissioned.

[132]  In response to the city suggesting that releasing the information would lead to other hackers conducting unauthorized access, control or modification of the computer systems for malicious ends, the appellant submits that this is why it is important to make the information public, “so that the insecure voting system will not be deployed in Toronto or elsewhere.” The appellant submits that there is no justification for concealing the vulnerabilities from the voting public, just because revealing that information might be contrary to the interests of a for-profit vendor.

[133]  The appellant submits that she is not pursuing this appeal for personal gain and that she has never attempted to break into any computer and has no intention of ever doing so.

[134]  The appellant queries that if the city has already provided much information to the public on the topic of internet voting, why is it fighting so hard to prevent the requested information from being provided.

[135]  The city was forwarded a copy of the appellant’s representations and provided reply representations. In most of the city’s reply it repeats and relies upon earlier submissions and the reply will not be summarized here.

Analysis and finding

[136]  As noted above, for section 16 to apply, two requirements must be met. First, there must be a compelling public interest in disclosure of the records. Second, this interest must clearly outweigh the purpose of the exemption for which the record was withheld.

[137]  I will first consider whether there is a compelling public interest in disclosure of each record. If so, I will go on to consider whether this interest clearly outweighs the purpose of the exemption.

[138]  The appellant did not comment in her representations whether there existed any public interest in disclosure of the personal information that I have found exempt under section 14(1)  of the Act . In my review of this personal information, I do not see how the public interest could apply and find that there is no public interest in disclosing the personal information found exempt under section 14(1).

[139]  After a review of the records, and for the reasons that follow, I find that any public interest in disclosure of the information found exempt under sections 10(1)  and 11  the Act , is not “compelling”. While I agree with the appellant that there is a public interest in disclosing information relating to internet voting and issues related to same, there is, in my view, also a public interest in not disclosing the withheld information in this appeal.

[140]  I agree with the city, who referenced Ontario Hydro v. Mitchinson [46] that when deciding whether there is a compelling public interest in disclosing the information, I must also take into account any public interest in not disclosing the information.

[141]  Former Assistant Commissioner Mitchinson stated in Order PO-2072-F when discussing the public interest override at section 23 (the provincial Act  equivalent to section 16):

This approach to section 23 also accords with the intention of the legislature to permit the disclosure of exempt material to serve the public interest. If there is a public interest in non-disclosure that, while not related to the “purpose of the exemption” as canvassed in the second part of section 23, is nevertheless strong enough to indicate that disclosure would have a serious adverse impact on the public interest, this would, in my view, demonstrate that any public interest in disclosure that might exist would not be “compelling”.

[142]  In the circumstances of this appeal, I find there is an interest in not disclosing the withheld information as disclosure may result in serious harm to the city (or its systems). This harm would arise from third parties, including hackers or competitors utilizing the information to “hack” into the city’s system. This could result in the potential need for a further expenditure of public funds. In addition, since there are no restrictions on the information once disclosed to the appellant, any vulnerabilities of the third party program may be identified, impacting the city’s decisions with regard to future implementation of internet voting. While the appellant sees this as a benefit, I agree with the city that this is evidence that there exists a public interest in not disclosing the withheld information.

[143]  In addition, orders from this office have found that where “another public process or forum has been established to address public interest considerations,” or where “a significant amount of information has already been disclosed” which adequately addresses the public interest consideration, that a compelling public interest in disclosure does not exist. The city has indicated it is undisputed that the topic of internet voting and the city’s decision have been the subject of wide public coverage and debate, noting that it has hosted a number of public consultations on reforms to voting systems over several years. The city submits that disclosure of the withheld information would not shed further light on the matter as a whole and as such no public interest in disclosure has been established.

[144]  Although the appellant has not viewed the withheld information, she did not challenge the city’s submission that much information has already been disclosed to the public.

[145]  As noted by Adjudicator Big Canoe in Order P-984, the word “compelling” has been defined as “rousing strong interest or attention.” According to the adjudicator, “the public interest in disclosure of a record should be measured in terms of the relationship of the record to the Act ’s central purpose of shedding light on the operations of government.” However, after reviewing the withheld information contained in the records, and considering the city’s ongoing dissemination of information relating to internet voting, I agree with the city that disclosure of the withheld information would not shed further light on the matter as a whole. In my review, I find that the remaining information withheld under sections 10(1), 11 and 14(1) contains technical data and information that would not inform or enlighten the citizenry about the activities of government or add in some way to the information the public already has. This technical information may benefit an individual with experience in computer data; however, I find that disclosure of this type of technical information does not shed light on the operations of government because it is information that would not be understood by the general public with the exception of a few groups (i.e. hackers and those familiar with coding).

[146]  As a result, I find that there is no compelling public interest in disclosure of the withheld information.

[147]  Since I have found that there is no compelling public interest in disclosure of the withheld information, I do not have to consider whether this interest clearly outweighs the purpose of the exemptions.

Issue H: What is the scope of the request? What records are responsive to the request?

[148]  The issue of responsiveness of some of the withheld information of the records was identified as an issue by the mediator and the parties were invited to speak to this issue in the adjudication stage. Neither party addressed this issue.

[149]  Section 17  of the Act  imposes certain obligations on requesters and institutions when submitting and responding to requests for access to records. This section states, in part:

(1) A person seeking access to a record shall,

(a) make a request in writing to the institution that the person believes has custody or control of the record;

(b) provide sufficient detail to enable an experienced employee of the institution, upon a reasonable effort, to identify the record;

. . .

(2) If the request does not sufficiently describe the record sought, the institution shall inform the applicant of the defect and shall offer assistance in reformulating the request so as to comply with subsection (1).

[150]  Institutions should adopt a liberal interpretation of a request, in order to best serve the purpose and spirit of the Act . Generally, ambiguity in the request should be resolved in the requester’s favour. [47]

[151]  To be considered responsive to the request, records must “reasonably relate” to the request. [48]

Finding

[152]  As noted, none of the parties provided representations on the issue of the responsiveness of certain information marked as not responsive by the city.

[153]  In any event, I have reviewed the portions of the withheld information that the city determined was not responsive to the appellant’s request. I find that the severed information is responsive to the access request because it is information that reasonably relates to the appellant’s request.

[154]  In many instances, the city has severed the email address of one of the specified professors. This is the same email address that I dealt with in Issue A of this order. In my view, even though the city has indicated that this email address is not responsive in many parts of the records, I have found that this email address is not personal information and should be disclosed to the appellant. I rely on this finding for this same email address that has been severed by the city and marked as non-responsive. As a result, the city will be ordered to disclose this email address in the records where it has been marked as non-responsive.

[155]  However, the city has also identified other severances in the records as non- responsive where in my view, they are actually responsive. Since the appellant has not commented on this issue in her representations, she should inform the city whether she continues to seek access to this information. If the appellant continues to seek access to this information, the city should issue an access decision with regard to the parts of the records that were marked as non-responsive and have not been dealt with in the scope of this appeal.

ORDER:

1. I uphold the city’s decision with respect to section 14(1), in part:
1. I order the city to disclose to the appellant the email address on page 1 and 7 of Group 5 that I have found is not personal information and where it appears in the parts of the records that the city has marked as non-responsive, in accordance with the highlighted records enclosed with the city’s copy of the order. To be clear, only the highlighted information should be disclosed to the appellant.
2. I uphold the remainder of the city’s decision.
3. I order that the city make the disclosure referred to in paragraph 1 of this order, by March 5, 2019 but not before February 28, 2019.

Original signed by:		January 31, 2019
Alec Fadel
Adjudicator