CYFSA DECISION 4

Complaint FA20-00017

Catholic Children's Aid Society of Toronto

April 26, 2022

Summary: This decision concerns a complainant’s request under Part X of the Child, Youth and Family Services Act, 2017  (the Act ) for records about a family member. It considers the right of access in Part X to records of an individual’s personal information that relate to the provision of a service to the individual. It also considers the potential relevance of sections of Part X that permit or require the disclosure of personal information in some circumstances.

In this decision, the adjudicator finds that the complainant does not have a right of access to personal information of his family member under the Act , because he is neither the individual to whom the personal information relates, nor an authorized substitute decision-maker for that individual. She also finds that the service provider properly exercised its discretion under a potentially applicable section of the Act  that permits disclosure in some circumstances. In the result, she upholds the service provider’s refusal of the complainant’s request for his family member’s personal information. She also upholds the service provider’s search for other records within its custody or control about the complainant and other family members. She dismisses the complaint.

Statutes Considered: Child, Youth and Family Services Act, 2017 , SO 2017, c 14, Sch 1, sections 2  (definitions), 281 (definitions), 286, 292(1)(g), 295, 301, 303, 312(1), 313, 314, and 321(1); Freedom of Information and Protection of Privacy Act , RSO 1990, c F.31, section 2  (definitions); Personal Health Information Protection Act, 2004 , SO 2004, c 3, Sch A  (as amended).

Decisions Considered: PHIPA Decisions 19 and 96.

OVERVIEW:

[1] This decision considers a request made under the Child, Youth and Family Services Act, 2017 (the Act) for records about the requester’s family member. The requester also questioned whether the service provider had located all records responsive to his request for records relating to himself and various other family members.

[2] When a requester seeks personal information relating to another individual under the Act , it may be necessary to consider whether the requester has a right of access to that information under Part X of the Act . It may also be necessary to consider the potential application of sections of the Act  that permit or require a service provider to disclose personal information in some circumstances. As will be seen below, different sections of Part X address these different concepts, and impose different obligations on a service provider in responding to a request for personal information.

[3] For reasons set out in detail below, I conclude that the requester in this case does not have a right of access under Part X of the Act  to personal information about his family member, because he is neither the individual to whom the information relates, nor an authorized substitute decision-maker for that individual. I also find that the service provider properly turned its mind to one potentially applicable section of the Act  that permits disclosure in some circumstances, and appropriately exercised its discretion under this section. Finally, I consider the requester’s claim that the service provider did not conduct a reasonable search for certain records relating to himself and other family members. I find the service provider made reasonable efforts to locate responsive records, and there is no reasonable basis to conclude that the particular records identified by the complainant exist. In the result, I dismiss the complaint.

BACKGROUND:

[4] This complaint arises from three requests made by a requester (the complainant in this matter) to the Catholic Children’s Aid Society of Toronto (the CAS) for records about services the CAS had provided to the complainant and to various family members. The complainant had been a child in care of the CAS. The complainant’s mother (now deceased) and his maternal uncle had also been in the care of the CAS.

[5] The first request was made by the complainant together with his sister. They requested complete access to all CAS records relating to their mother’s care when she was a Crown ward. The complainant and his sister explained that their mother had encountered significant physical and mental health issues during that time. They also requested full access to the complainant’s records for the period when he was in care of the CAS.

[6] Soon afterward, the complainant made his own request to the CAS under the Act , seeking information about himself and about his mother, his maternal uncle, and his maternal grandparents. The complainant explained that he is particularly interested in obtaining information relating to his family members’ physical and mental health.

[7] The CAS responded to the complainant’s request by granting him partial access to the records found in the following files:

1. The child in care file for the complainant;
2. A file after discharge related to the complainant;
3. The child in care file for the complainant’s mother;
4. A family file for the complainant’s mother;
5. A family file for the complainant’s mother (“a later involvement”);
6. The child in care file for the complainant’s uncle; and
7. The family file for the complainant’s grandmother.

[8] The CAS explained that it had made some severances to the records, including to remove the personal information of other individuals that is unrelated to the service provided to the complainant and to his family members. For instance, the CAS explained that it had removed the names and other information about other (unrelated) children who had been in care at the same time as the complainant, and information about a common law partner of the complainant’s mother, where that information was unrelated to child protection issues.

[9] The CAS also confirmed that it had not made any severances to the mother’s family file (which concerns the mother as a parent), or to the grandmother’s family file. [1] However, the CAS acknowledged that there is some deterioration in the quality of the pages in the grandmother’s family file, and that one page is illegible.

[10] The complainant was dissatisfied with the CAS’s decision and filed a complaint with the Information and Privacy Commissioner/Ontario (IPC), seeking all the information that the CAS had withheld in the records.

[11] After he filed the complaint, the CAS and the complainant had discussions that led to the complainant’s submitting an “amended records request” to the CAS. In this request, the complainant raised a number of concerns about the CAS’s severances to the records, and he asked the CAS to conduct additional searches for certain categories of records that he believes ought to exist. (I describe these categories in more detail later in this decision.)

[12] In response, the CAS conducted further searches for responsive records, but was unable to locate the particular records identified by the complainant.

[13] However, through these further discussions, the CAS and the complainant were able to resolve other issues. Among other things, after receiving further information from the complainant, the CAS provided him with his foster care file and records relating to his foster mother.

[14] Later, in a final revised access decision, the CAS provided the complainant with a “full, unredacted copy” of all the records it had previously provided to him.

[15] As a result, it is my understanding that the CAS has provided the complainant with complete copies of all the records it located through its searches and identified in its various decision letters. The parties have not disputed my understanding in this regard.

[16] After considering the CAS’s most recent decision, the complainant conveyed additional questions for the CAS through the IPC mediator. The complainant also advised that he is seeking access to any information that has not already been released to him concerning his maternal grandparents and his maternal great-aunt.

[17] The CAS responded to the complainant’s questions. In response to the complainant’s request for further information about his maternal grandparents, and information about his maternal great-aunt, the CAS stated, in part:

[The CAS] has disclosed all of the copies of the records in relation to [the complainant’s grandmother]. [The CAS] acknowledges the records are of poor quality. [The complainant] [was] provided a copy of [his grandmother]’s records as a copy of her obituary was provided to [the CAS] and she has been deceased for over 30 years.

With respect to [the complainant’s grandfather] and [his great-aunt], [the complainant] did not provide [the CAS] with consent from their estates (assuming that they are deceased) or evidence that they have been deceased for over 30 years. [The CAS] is not permitted to provide any of their personal information unless it was found in the records of individuals that [the complainant] had the right of access to. For example, there is some information in relation to [the grandfather] in [the grandmother]’s records. Given that the records were dedicated primarily to providing services to [the grandmother], the [CAS] did not redact [the grandfather]’s information.

Unlike [the Personal Health Information Protection Act, 2004 ] and other privacy legislation, PART X of the Act  does not have a provision that allows [the CAS] to disclose personal information with respect to a deceased on compassionate grounds or that [the complainant] reasonably requires the information to make decisions about their own health care or their children’s health care.

I don’t believe that Part X of the legislation permits [the CAS] to confirm the existence of a record without the appropriate consents either. As confirmation of the existence of records confirms involvement with a child protection agency, [the CAS] believes that this information too must remain confidential.

[18] Later, the CAS determined that the complainant’s grandfather had been deceased for more than 30 years, and confirmed for the complainant that it had already provided him with all the records relating to his grandfather.

[19] The complainant continues to believe that there exist additional records about his maternal grandparents and maternal great-aunt. He also believes, based on his own investigations, that the CAS should have records from certain organizations involved in his and his mother’s care.

[20] The CAS confirms that it understands the complainant’s request under the Act  to include not only the information he originally identified (in the request he made with his sister, and in the separate request he filed on his own), but also the additional information he identified in later communications with the CAS. The CAS does not dispute that the complainant’s request now encompasses records relating to his maternal great-aunt.

[21] However, the CAS takes the position that the complainant does not have a right under the Act  to any records that may exist regarding his great-aunt. The CAS maintains that it has already provided the complainant with all the records to which he is entitled under the Act .

[22] As the parties were unable to resolve the issues through mediation, the complaint was transferred to the adjudication stage. I conducted a review of the matter, during which the parties exchanged representations on the issues.

[23] For the reasons I describe in detail below, I find that the complainant does not have a right of access under the Act  to personal information about his maternal great-aunt. I also find the CAS appropriately considered the complainant’s request under sections of the Act  that permit disclosure, and properly exercised its discretion in deciding not to disclose personal information in the circumstances. Finally, I uphold the CAS’s search for responsive records. I therefore dismiss the complaint.

[24] However, I note that in his representations, the complainant appears to suggest (to my knowledge for the first time) that his maternal great-aunt may have died over 30 years ago. If this is the case, the great-aunt’s information would not be “personal information” within the meaning of the Act , so not subject to the Act ’s scheme governing access and disclosure. If this is the complainant’s claim, I encourage him to provide his evidence for it directly to the CAS, so that the parties may discuss what impact this may have on the complainant’s request for information outside the Act .

RECORDS:

[25] The records at issue are any that may exist within the CAS’s custody or control relating to the complainant’s maternal great-aunt.

[26] The complainant also believes that there exist additional records relating to himself, his mother, and his maternal grandparents that have not been identified by the CAS.

ISSUES:

1. Does the complainant have a right of access to records relating to his maternal great-aunt under section 312 of the Act ?
2. Do any disclosure provisions in the Act  permit the CAS to disclose to the complainant records relating to his maternal great-aunt? If so, did the CAS properly exercise its discretion under these sections of the Act ?
3. Did the CAS conduct a reasonable search for responsive records within its custody or control?

DISCUSSION:

PRELIMINARY ISSUES—Application of the Act

[27] Before addressing the various issues raised by the complaint, I make the following findings to confirm the application of the Act to the issues under review.

The CAS is a “service provider” within the meaning of the Act

[28] Part X of the Act  sets out rules to protect the privacy of individuals and to enable individuals to seek access to records of their “personal information” that are in the custody or control of “service providers,” and that relate to the provision of a “service.”

[29] “Service provider” is defined in section 2 of the Act  to include a person or entity, including a “society,” that provides a service funded under the Act . “Society” is defined to mean an agency designated as a children’s aid society under section 34(1) of the Act .

[30] Part X of the Act  defines “service” as a service or program that is provided or funded under the Act  or provided under the authority of a licence (section 281). “Service” is further defined at section 2 to include services for children and their families related to child protection.

[31] While certain service providers are exempt from Part X because they are already subject to other privacy legislation, there is no evidence to suggest this is the case here.

[32] The parties do not dispute, and I find, that the CAS is a “service provider” within the meaning of the Act , and thus subject to the requirements of Part X.

The records at issue are records of “personal information” that relate to the provision of a service

[33] Generally, Part X of the Act  applies to “personal information” in the custody or control of a service provider that relates to the provision of a service. (I discuss the concept of custody or control under Issue C, concerning reasonable search.)

[34] Section 2 of the Act  defines “personal information” to have the same meaning as in the Freedom of Information and Protection of Privacy Act  (FIPPA ). Section 2(1)  of FIPPA  defines “personal information” as follows:

“personal information” means recorded information about an identifiable individual, including,

(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

(c) any identifying number, symbol or other particular assigned to the individual,

(d) the address, telephone number, fingerprints or blood type of the individual,

(e) the personal opinions or views of the individual except if they relate to another individual,

(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

(g) the views or opinions of another individual about the individual, and

(h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual[.]

[35] Sections 2(2) , (3)  and (4)  of FIPPA  also relate to the definition of personal information. These sections state:

(2) Personal information does not include information about an individual who has been dead for more than thirty years.

(3) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

(4) For greater certainty, subsection (3) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling.

[36] The IPC has addressed the meaning of personal information in numerous orders issued under FIPPA  and its municipal counterpart, the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) (which contains an identical definition).

[37] Through these orders, the IPC has established some principles that assist in determining whether information qualifies as “personal information” within the meaning of those statutes. Among other things, these orders have established that the list of examples contained in section 2(1)  is not exhaustive. Therefore, information that does not fall under paragraphs (a) to (h) of section 2(1)  may still qualify as personal information. [2]

[38] I do not have the records at issue before me. However, considering the nature of the request and the context in which the requested records would have been created and used, I am satisfied that responsive records would contain the personal information of the complainant, his mother, and his great-aunt. I am also satisfied that the personal information in such records would have been collected for or relate to the provision of a “service” to those individuals, within the meaning of the Act . [3]

[39] My findings under this heading are subject to the caveat that if any of these individuals have been deceased for more than 30 years, information about them in the records sought by the complainant would not be their “personal information” within the meaning of the Act  (section 2(2) of FIPPA ). For instance, during the mediation stage of this complaint, the CAS received evidence that led the CAS to conclude that the requested information about the complainant’s maternal grandparents was not their personal information within the meaning of the Act .

[40] In his representations, the complainant suggests (to my knowledge for the first time) that he has reason to believe his maternal great-aunt has been deceased for more than 30 years.

[41] I have no evidence upon which to make a definitive ruling regarding the great-aunt’s information. I also note that the parties’ other representations on the issues are premised on the assumption the records contain the personal information of the complainant’s family members. Given this, I will proceed based on the assumption that all the records at issue contain personal information, and in this decision I will consider the complainant’s request for such records under the Act . However, I encourage the complainant to provide any evidence for his claim directly to the CAS, so that the parties can address his request outside the Act  if appropriate.

REQUEST FOR ANOTHER INDIVIDUAL’S PERSONAL INFORMATION—PROVISIONS OF THE ACT CONCERNING ACCESS AND DISCLOSURE

[42] In seeking records relating to his great-aunt (assuming they contain her personal information within the meaning of the Act , as discussed above), the complainant is requesting the personal information of an individual other than himself.

[43] A request for another individual’s personal information in the custody or control of a service provider may raise the question of whether the requester has a right of access to that information under the Act . Depending on the circumstances, it may also be necessary to consider the request under sections of the Act  that permit or require disclosure of personal information.

[44] Under Issue A, I will consider whether the complainant has a right of access under Part X to records relating to his great-aunt.

[45] Under Issue B, I will consider whether any disclosure provisions in Part X apply to the complainant’s request for records relating to his great-aunt.

A. Does the complainant have a right of access to records relating to his maternal great-aunt under section 312 of the Act?

[46] With limited exceptions, section 312(1) of the Act  grants an individual a right of access to a record of his or her own personal information that is in the custody or control of a service provider and that relates to the provision of a service to the individual.

[47] This means the right of access in Part X belongs only to the individual to whom the personal information relates. Part X does not grant a general right of access to another individual’s personal information.

[48] In some circumstances, a person other than the individual to whom the personal information relates may make an access request, on behalf of that individual. Such a person must be a lawfully authorized “substitute decision-maker” for the individual (sections 281, 303). In acting for the individual, the substitute decision-maker must take into consideration the individual’s wishes, values, and beliefs [section 302(1)(a)], among other factors.

[49] Section 301 of the Act  describes persons who may act as substitute decision-makers for an individual. The relevant portions of section 301 state:

(1) An individual who is capable may give, withhold or withdraw consent or may, if the individual is 16 or older, authorize in writing another individual who is 16 or older and capable to be the individual’s substitute decision-maker.

(4) Where an individual is not capable of consenting to the collection, use or disclosure of personal information, a person who would be authorized to consent to the collection, use or disclosure of personal health information on the individual’s behalf under the Personal Health Information Protection Act , 2004  may be the individual’s substitute decision-maker.

[50] “Capable” and “incapable” are defined in Part X as follows (at section 281):

“capable” means able to understand the information that is relevant to deciding whether to consent to the collection, use or disclosure of personal information and able to appreciate the reasonably foreseeable consequences of giving, withholding or withdrawing the consent and “capacity” has a corresponding meaning;

“incapable” means not capable, and “incapacity” has a corresponding meaning[.]

[51] I have no evidence before me concerning the great-aunt’s mental capacity for the purposes of the substitute decision-making provisions of the Act . But in either case, there is no evidence to establish that the complainant would have the appropriate authority to act on behalf of his great-aunt in respect of her personal information.

[52] Specifically, assuming the great-aunt is mentally capable within the meaning of the Act , there is no claim by the complainant that he has his great-aunt’s consent to act as her substitute decision-maker for the purposes of Part X. (I note that any claimed consent would also have to fulfil the requirements of consent in section 295 of the Act , as discussed further below.)

[53] Alternatively, assuming the great-aunt is mentally incapable within the meaning of the Act , there is no evidence to establish that the complainant is an authorized person under the relevant provisions of the Personal Health Information Protection Act, 2004  (PHIPA ) to act as her substitute decision-maker. [4]

[54] I want to acknowledge the complainant’s deeply personal and thoughtful representations on this issue. They set out important context to explain why he seeks records about his family’s involvement with the CAS, and some of the impact this involvement has had on his family. I am sympathetic to the broader questions the complainant has raised concerning the role of systemic racism and institutional bias in decisions that were made about his family, and the laudable purposes of his wider project to document his family’s history. I also acknowledge his comments about the emotional and mental toll of the request process.

[55] Although I am sympathetic to the circumstances behind the complainant’s search for information, these circumstances do not influence the legal question of whether he is authorized to act as the substitute decision-maker for his great-aunt for the purposes of Part X of the Act . As the complainant has not established any authority to act in this way on her behalf, he cannot exercise a right of access to her personal information under the Act .

[56] However, I will consider under the next heading whether the complainant’s representations raise the potential application of any disclosure provisions in the Act .

B. Do any disclosure provisions in the Act permit the CAS to disclose to the complainant records relating to his maternal great-aunt? If so, did the CAS properly exercise its discretion under these sections of the Act?

[57] Under this heading, I will consider whether the complainant’s request raises the potential application of sections of the Act  that permit or require the “disclosure” of personal information in some circumstances.

[58] Disclosure is not a defined term in the Act . However, the IPC has noted that the term generally refers to releasing or making the information available to another person or organization. [5]

[59] Section 286 addresses the collection, use, and disclosure of personal information collected by a service provider for the purpose of providing a service to an individual. It states:

A service provider shall not collect personal information about an individual for the purpose of providing a service or use or disclose that information unless,

(a) the service provider has the individual’s consent under this Act  and the collection, use or disclosure, to the best of the service provider’s knowledge, is necessary for a lawful purpose; or

(b) the collection, use or disclosure without the individual’s consent is permitted or required by this Act .

[60] Thus, the Act  contemplates the disclosure of personal information in some circumstances: where there is the appropriate consent (and other conditions are met); and where the Act  permits or requires the disclosure to be made without consent. I will consider each scenario in turn.

Disclosure with consent

[61] Under section 286(a), a service provider may disclose personal information relating to the provision of a service to an individual with the consent of that individual (or his or her lawfully authorized substitute decision-maker), where, to the best of the service provider’s knowledge, that disclosure is necessary for a lawful purpose.

[62] Any consent must fulfil the requirements of consent set out in section 295 of the Act . These requirements include (among other things) that: the consent be the consent of the individual to whom the personal information relates; the consent be knowledgeable; and the consent relate to the information at issue.

[63] Neither the CAS nor I have been provided with a valid consent of the great-aunt. The provision of the Act  allowing disclosure with consent is not relevant in this case.

Disclosure without consent

[64] Section 286(b) contemplates disclosure without consent where other sections of the Act  permit or require a service provider to disclose personal information relating to the provision of a service to an individual.

[65] These are found at sections 292 to 294 of the Act . In the circumstances, the only potentially relevant provisions are found in section 292 of the Act . (Section 293 concerns disclosures to a prescribed entity or similar entity, [6] while section 294 concerns disclosure of a record of a mental disorder pursuant to a summons or similar requirement. Neither of these circumstances is applicable here.)

[66] Section 292 states:

(1) A service provider may, without the consent of the individual, disclose personal information about an individual that has been collected for the purpose of providing a service,

(a) to a law enforcement agency in Canada to aid an investigation undertaken with a view to a law enforcement proceeding or to allow the agency to determine whether to undertake such an investigation;

(b) to a proposed litigation guardian or legal representative of the individual for the purpose of having the person appointed as such;

(c) to a litigation guardian or legal representative who is authorized under the Rules of Civil Procedure, or by a court order, to commence, defend or continue a proceeding on behalf of the individual or to represent the individual in a proceeding;

(d) for the purpose of contacting a relative, member of the extended family, friend or potential substitute decision-maker of the individual, if the individual is injured, incapacitated or otherwise not capable;

(e) for the purpose of contacting a relative, member of the extended family or friend of the individual if the individual is deceased;

(f) subject to section 294, for the purpose of complying with,

(i) a summons, order or similar requirement issued in a proceeding by a person having jurisdiction to compel the production of information, or

(ii) a procedural rule that relates to the production of information in a proceeding;

(g) if the service provider believes on reasonable grounds that the disclosure is necessary to assess, reduce or eliminate a risk of serious harm to a person or group of persons; or

(h) if permitted or required by law or by a treaty, agreement or arrangement made under an Act  or an Act  of Canada, subject to the requirements and restrictions, if any, that are prescribed.

(2) A society may disclose to another society or to a child welfare authority outside Ontario personal information that has been collected for the purpose of providing a service if the information is reasonably necessary to assess, reduce or eliminate a risk of harm to a child.

(3) A society may disclose personal information that has been collected for the purpose of providing a service if the information is reasonably necessary for a prescribed purpose related to a society’s functions under subsection 35 (1).

[67] Section 292(4) clarifies that the term “law enforcement” in section 292 has the same meaning as in section 2(1)  of FIPPA .

[68] In PHIPA Decision 96, the IPC considered, under PHIPA , a father’s request for information about services his children may have received from a health information custodian. Like the Act , PHIPA  confers a right of access only to the individual to whom the requested information [7] relates, or to a lawfully authorized substitute decision-maker for that individual. In PHIPA Decision 96, the IPC found in those circumstances that the father did not have a right of access under PHIPA  to records of his children’s information.

[69] However, the IPC found that the father had provided grounds for the custodian to consider his request under several sections of PHIPA  that confer discretion on the custodian to disclose information belonging to other individuals, without consent, in some circumstances. In the particular circumstances of that case, and based on the evidence provided by the father, the IPC found that the custodian had a duty to consider the father’s request under several discretionary disclosure provisions in PHIPA . Because the custodian had failed to do so, the IPC ordered the custodian to consider the request again under those permissive sections of PHIPA , and to decide whether or not to disclose under those sections (in legal terms, the custodian was ordered to “exercise its discretion”). [8]

[70] The IPC has confirmed that a custodian must exercise its discretion under PHIPA  in a proper manner. This means the custodian must make its decision based on relevant considerations and not based on irrelevant considerations, and must do so in good faith, and for a proper purpose. If a custodian fails to exercise its discretion under PHIPA  in a proper manner, the IPC may order the custodian to consider the matter again, and may provide comments and recommendations to guide the custodian’s exercise of discretion. [9] However, the IPC cannot order disclosure under the discretionary provisions of PHIPA . [10]

[71] Like PHIPA, Part X of the Act  contains different provisions addressing the right of access to and the disclosure of personal information about individuals. As noted above, PHIPA  (like Part X of the Act ) does not confer a general right of access to another individual’s personal information. Both statutes also contain rules governing the collection, use, and disclosure of that information to protect the privacy of the individuals to whom the information belongs (among other purposes). For instance, both statutes prohibit disclosure except where there is the appropriate consent, or where disclosure without consent is permitted or required to be made under the applicable statute.

[72] In this context, I find the IPC’s approach to the discretionary disclosure provisions in PHIPA  to be broadly applicable in interpreting the discretionary disclosure provisions in Part X of the Act . In particular, I find that the discretion that is conferred on service providers under Part X of the Act  must be exercised in a proper manner, based on proper considerations, in good faith, and for a proper purpose.

[73] I also find that the IPC has the authority to review a service provider’s exercise of discretion under Part X, and that, following this review, the IPC has the power to order the service provider to exercise (or to re-exercise) its discretion, and to provide comments or recommendations on the exercise of discretion. [11] This approach is consistent with the remedies the IPC provides under PHIPA , and under FIPPA  and MFIPPA, when the IPC finds that a body subject to those statutes has failed to properly exercise its discretion under those statutes. [12]

[74] In view of this background, I asked the parties to address whether the complainant’s request raises the potential application of any sections of the Act  that permit or require disclosure without consent, and, if so, whether the CAS properly considered the request under those sections.

[75] The CAS says that it considered whether the complainant’s request meets any of the conditions for disclosure without consent under Part X, and concluded that it does not.

[76] The CAS acknowledges that the complainant has explained that he seeks historic records about his family members in order to know more about his family’s history, particularly in relation to the prevalence of particular medical conditions. On this basis, the CAS considered the potential application of section 292(1)(g) of the Act , which permits disclosure of personal information, without consent, where a service provider believes on reasonable grounds that the disclosure is “necessary to assess, reduce or eliminate a risk of serious harm to a person or group of persons.” It determined, however, that the disclosure of personal information about the complainant’s great-aunt would not be necessary for this purpose. In making this assessment, the CAS took into account the fact the complainant is already aware of his mother’s medical history, and that he is also aware he has the particular medical conditions he mentions.

[77] I find no defect in the CAS’s exercise of discretion in this case. I am satisfied the CAS properly turned its mind to a potentially applicable section of the Act  that permits disclosure in some circumstances, and made its decision not to disclose based on relevant considerations. There is no evidence to suggest the CAS took into account irrelevant considerations, or that its exercise of discretion was otherwise improper.

[78] I also agree with the CAS that no other sections of the Act  permitting or requiring disclosure without consent are applicable in this case. I confirm the CAS’s observation that Part X does not contain an authority for disclosure without consent based on compassionate grounds.

[79] As a result, I uphold the CAS’s exercise of discretion in deciding not to disclose the requested information.

C. Did the CAS conduct a reasonable search for responsive records within its custody or control?

[80] In addition to the records addressed above, concerning his great-aunt, the complainant believes that there exist additional records relating to himself, his mother, and his maternal grandparents beyond those the CAS located through its searches (and released to him in full). These include the following categories of records that the complainant identified in his “amended records request” to the CAS:

1. Records of the Canadian Mothercraft Society concerning the complainant over a defined time frame nearly 60 years ago;
2. Newspaper advertisements from nearly 60 years ago, depicting the complainant as an infant available for adoption by the CAS;
3. Medical records from the office of two named physicians;
4. Records relating to the complainant’s foster family’s interactions with the Family Service Association, including yearly visits to Bolton Camp from a period over 50 years ago; and
5. Records of formal requests made by the complainant, over a defined time range over 40 years ago, to named staff of the CAS.

[81] When a requester claims that additional records exist beyond those identified by a service provider, the issue to be decided is whether the service provider has conducted a reasonable search for records as required by sections 313 and 314 of the Act . These sections address the written request that an individual may make to a service provider to exercise a right of access to records, and the obligations of the service provider in responding to the access request.

[82] The IPC has not yet interpreted these sections of the Act . However, the IPC has extensively canvassed sections of FIPPA , MFIPPA, and PHIPA  that set out the obligations of institutions (under FIPPA  and MFIPPA) and health information custodians (under PHIPA ) to conduct a reasonable search for records in response to access requests made under those statutes. It is also important to note that the right of access in those statutes and in the Act  applies only to records and information in the “custody” or under the “control” of the body to which the request is made. The IPC has also addressed the question of custody or control under those other statutes.

[83] In my view, the relevant provisions of those statutes and the Act  are broadly analogous, and the principles outlined in IPC orders and decisions issued under those statutes are instructive in making determinations about the obligations of service providers in respect of requests made under the Act . I have applied those principles here in making my findings on whether the CAS conducted a reasonable search for responsive records within its custody or control.

Reasonable search

[84] Where the issue is whether a body has conducted a reasonable search for records, in accordance with its statutory obligations, the body need not prove with absolute certainty that further records do not exist. However, the body must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. [13] To be responsive, a record must be “reasonably related” to the request. [14]

[85] A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records which are reasonably related to the request. [15]

[86] If I am satisfied that the search carried out was reasonable in the circumstances, I will uphold the decision. If I am not satisfied, I may order further searches.

[87] Although a requester will rarely be in a position to indicate precisely which records the body has not identified, the requester still must provide a reasonable basis for concluding that such records exist. [16]

Custody or control

[88] The courts and the IPC have applied a broad and liberal approach to the question of custody or control in the context of FIPPA  and MFIPPA. [17] Based on this approach, the IPC has developed a non-exhaustive list of factors to consider in determining whether or not a record is in the custody or control of an institution under FIPPA  or MFIPPA, as follows. [18] Some listed factors may not apply in a specific case, while other unlisted factors may apply.

[89] Drawing from this list, I find the following factors to be relevant in this complaint:

• Was the record created by an officer or employee of the service provider?
• Was the individual who created the record an agent of the service provider for the purposes of the activity in question?
• Does the service provider have a statutory power or duty to carry out the activity that resulted in the creation of the record? Is the activity in question a “core,” “central,” or “basic” function of the service provider?
• Does the service provider have physical possession of the record, either because it has been voluntarily provided by the creator or pursuant to a mandatory statutory or employment requirement?
• If the service provider has possession of the record, is it more than “bare possession”? In other words, does the service provider have the right to deal with the record in some way and does it have some responsibility for its care and protection? [19]
• Does the content of the record relate to the service provider’s mandate and functions?
• To what extent has the service provider relied upon the record?

[90] In determining whether records are in the “custody or control” of a service provider, I must consider relevant factors contextually in light of the purpose of the legislation. [20]

[91] During the mediation stage of the complaint process, the CAS conducted additional searches for the records identified by the complainant, but was unable to locate these records. The CAS provided the complainant and the IPC with details of the various searches it had conducted, including the sources it had searched.

[92] The CAS also advised that it has had in place policies regarding recordkeeping since around 1986. I note that all the records sought by the complainant are from before 1986, and that the majority of the records date several decades before then.

[93] In the circumstances, I find the CAS has fulfilled its obligations under the Act  to conduct a reasonable search for responsive records in its custody or control. This is because I am satisfied from the evidence that it has made reasonable efforts to locate the records identified by the complainant.

[94] I am also not persuaded that additional searches would yield the records the complainant seeks, including because I am not satisfied such records would be in the custody or control of the CAS. Some of the records the complainant describes are those of other organizations, or concern the complainant’s and his family’s interactions with other organizations, and it is not clear why the CAS would currently have copies of those records (assuming it ever had copies), or that it had any role in the creation or use of the records, or that it would have custody or control of the records on other grounds.

[95] In the case of other records, given the age of the records sought and the fact they pre-date the CAS’s policies on recordkeeping, there is a reasonable possibility that responsive records that may once have existed in the CAS’s record-holdings no longer exist. Against these considerations, the complainant has provided no reasonable basis for his belief that the records he seeks exist. In the circumstances, I see no grounds to order further searches.

[96] I therefore uphold the CAS’s search for records within its custody or control.

[97] For all the foregoing reasons, I dismiss the complaint.

NO ORDER:

For the foregoing reasons, I dismiss the complaint and issue no order.

Original Signed by:		April 26, 2022
Jenny Ryu
Adjudicator