ORDER PO-2391

 

Appeal PA-040296-1

 

Ministry of Consumer and Business Services

NATURE OF THE APPEAL:

 

The Ministry of Consumer and Business Services (the Ministry) received a request under the Freedom of Information and Protection of Privacy Act (the Act) for the following:

 

Access to manuals, procedures, guides and directives, for years 1999,  2000 and 2001, dealing with the Registrar General’s Computer System, (Collection and Storage of scanned images and data), including the implementation for year 2000 of [an identified system].

 

The Ministry located records responsive to the request and denied access to them on the basis of the exemption in section 14(1)(i) (security of a system or procedure) of the Act.

 

The requester (now the appellant) appealed the Ministry’s decision.

 

Mediation did not resolve the issues in this appeal and it was transferred to the inquiry stage of the process.  I sent a Notice of Inquiry identifying the facts and issues to the Ministry initially, and the Ministry provided representations.  I then sent the Notice, along with a copy of the non-confidential portions of the Ministry’s representations, to the appellant, who also provided representations in response.

 

RECORDS:

 

The records at issue relate to the computer system used by the Office of the Registrar General.  They include various user guides for collecting and keying in information, scanning documents, and for proper installation, operation and maintenance; a workflow process description document; and various other records relating to the system.

 

DISCUSSION:

 

PRELIMINARY ISSUES

 

In my cover letter to the Ministry enclosing a Notice of Inquiry, I stated that the representations were due March 22, 2004.  In accordance with this office’s usual practice, I also stated:

 

Should your representations not be received by the date specified in this letter, the decision making process will proceed, and an order may be issued in the absence of these representations.

 

The Ministry subsequently requested, and was granted, an extension of time to provide representations to this office.  The revised due date for representations was April 1, 2004.  The Ministry’s representations were received by this office on April 6, 2004.

 

In his representations, the appellant asks the question:

 

Did the Ministry comply with the Commission’s Procedures and submit its representations by the due date?

 

 

The appellant also suggests that I should not accept the representations of the Ministry in the circumstances of this appeal, because they were received after the due date.

 

Previous orders of this office have examined the issue of whether representations received after the due date should be considered.  Senior Adjudicator David Goodis addressed this issue in Order MO-1698 as follows:

 

The purpose of the paragraph [in the Notice of Inquiry referencing the representations] is to ensure that parties are aware of the importance of providing their representations on time, and that if they fail to do so, they risk the possibility of an order being issued in the absence of their representations.  I do not accept the appellant’s position that, because I received the representations six days late, I should not consider them.  Under the Act, an adjudicator has the discretion to consider late material, taking into account all of the circumstances, including any prejudice that may accrue to either party.  To act otherwise and take an overly technical approach, in my view, would be contrary to principles of fairness and natural justice.  This approach is consistent with this office’s Code of Procedure, which states at sections 2.03 and 2.04:

 

2.03 A failure to follow any procedure in this Code does not for that reason alone render an appeal, or any step in an appeal, invalid.

 

2.04 The IPC may in its discretion depart from any procedure in this Code where it is just and appropriate to do so.

 

Here, the appellant did not suffer any significant prejudice by the relatively short delay in the process.  On the other hand, should I not consider the Police’s representations, it may put me in a position of having to reject the exemption claim for lack of evidence, leading to an order to disclose the record, where I might reach a different result should I consider that material.  In my view, the potential prejudice to the Police clearly outweighs any prejudice to the appellant.  Accordingly, I do not accept the appellant’s request that I not consider the Police’s representations.

 

I adopt the approach taken tot his issue in MO-1698 and apply it in this appeal.  In this appeal, the appellant did not suffer any significant prejudice by the relatively short delay in the process, and, if I were not to consider the Ministry’s representations, it may put me in a position of having to reject the exemption claim for lack of evidence, where I might reach a different result should I consider that material.  In my view, the potential prejudice to the Ministry clearly outweighs any prejudice to the appellant, and I will consider the Ministry’s representations.

 

In addition, the appellant takes the position that the Ministry’s decision letter is inadequate as it did not identify specifically the name and position of the person responsible for making the decision, as required by section 29(1)(b)(iii) of the Act.  However, since this issue was not raised in the earlier stages of this appeal, and the Ministry has not had the opportunity to address it, I will not be reviewing it.  In any event, even if the appellant were correct, in the circumstances of this appeal, I would have seen no useful purpose in requiring the Ministry to provide a new decision letter to the appellant to address this inadequacy, or in providing any other remedy at this stage in the processing of the appeal (See Order MO-1731).

 

ENDANGER SECURITY

 

Introduction

 

The Ministry claims that the records are exempt under section 14(1)(i), which reads:

 

A head may refuse to disclose a record where the disclosure could reasonably be expected to,

 

Endanger the security of a building or the security of a vehicle carrying items, or of a system or procedure established for the protection of items, for which protection is reasonably required;

 

To meet the test under section 14(1)(i), the Ministry must provide “detailed and convincing” evidence to establish a “reasonable expectation of harm”.  Evidence amounting to speculation of possible harm is not sufficient [Order PO-2037, upheld on judicial review in Ontario (Attorney General) v. Goodis (May 21, 2003), Toronto Doc. 570/02 (Ont. Div. Ct.), Ontario (Workers’ Compensation Board) v. Ontario (Assistant Information and Privacy Commissioner) (1998), 41 O.R. (3d) 464 (C.A.)].

 

It is not sufficient for an institution to take the position that the harms under section 14 are self-evident from the record or that a continuing law enforcement matter constitutes a per se fulfilment of the requirements of the exemption [Order PO-2040; Ontario (Attorney General) v. Fineberg].

 

 

Generally, the law enforcement exemption must be approached in a sensitive manner, recognizing the difficulty of predicting future events in a law enforcement context [Ontario (Attorney General) v. Fineberg (1994), 19 O.R. (3d) 197 (Div. Ct.)].

 

Representations

 

The Ministry begins by identifying that the request is for information concerning the computer operating system used by the Office of the Registrar General (the ORG).  The Ministry identifies the broad range of information administered by the ORG under the Vital Statistics Act, which requires a uniform system of registration for all vital events that occur in Ontario (including births, deaths, marriages, stillbirths, adoptions and changes-of-name).  The Ministry also identifies

identifies the vast number of registration documents the ORG has in its custody (more than 20 million documents), and that the documents contain the personal information of Ontarians.

 

The Ministry takes the position that the release of any or all of the records requested could reasonably be expected to endanger the security of the ORG’s computer systems and/or its operational procedures.  The Ministry states that these systems and procedures protect the personal information in the custody of the ORG.

 

In support of its position, the Ministry provides an affidavit sworn by the Chief Security Officer for the ORG, who identifies the broad nature of the registration information which the ORG is responsible for.  He also describes the nature of the information contained in the systems manuals requested in this appeal – that they contain detailed and specific information about the ORG’s computer operations, including sensitive login procedures, diagrams, screen reproductions and step-by-step instructions.  Furthermore, the affidavit identifies the security arrangements in place for these records, and that access to these records is very limited, even within the Ministry.

 

The Ministry also refers to previous orders of this office which have found that information pertaining to computer and operating systems can qualify for exemption under section 14(1)(i).  It refers to Orders P-1078, P-874, P-756 and P-649 in support of its position.

 

Finally, with respect to the question of whether portions of the records could be made available, the Ministry takes the position that this is not an appropriate case for severance of the records, as very little material could be disclosed, and “the appellant would be left with nonsensical material.”

 

The appellant takes the position that the disclosure of the requested records could not result in the anticipated harm.  In support of his position, the appellant refers to articles available to the public which he states provide a description of the records requested, and he attaches copies of those articles to his representations.  He states that the identity of the supplier of the computer system and the nature of the specific software used is generally known, and refers to this information in both his request letter and his representations.  The appellant also states that the computer system and related software has been described as an “out of the box” product.  In his view, the records requested relate to general information about a computer system that is used by many companies worldwide.  He states:

 

The Registrar General’s Office is just 1 of 1300 companies worldwide and their employees, not to mention the 4000 employees at [the computer supplier company] that would have access to these or similar type manuals for the … software.

 

Findings

 

I have carefully reviewed the representations, as well as the records at issue in this appeal, which relate to the computer system used by the ORG and contain detailed, specific information about this system including login procedures, disgrams, screen reproductions and step-by-step instructions.

 

With respect to the information stored in the computer system, the Ministry identified that this information consists of a broad range of personal information of Ontarians administered by the ORG under the Vital Statistics Act, including specific information about individual births, deaths, marriages, stillbirths, adoptions and changes-of-name.  I am satisfied that the protection of this information is reasonably required, including protection from tampering or unauthorized modification.

 

Furthermore, I am satisfied that the records at issue relate to the security of a system as well as a procedure established for the protection of the information contained in the system.  The Ministry identifies that one of the reasons the computer system and the operational procedures were put in place by the Ministry was to protect the specific information in the system.  The affidavit provided by the Ministry also identifies the security arrangements in place for these records.

 

Finally, I am satisfied that disclosure of the records could reasonably be expected to endanger the security of the system or procedure established for the protection of the information.  The records contain detailed, specific information about this system and the operational procedures including sensitive login procedures, diagrams, screen reproductions and step-by-step instructions, as well as information about the security of the system itself.

 

With respect to the appellant’s contention that the records merely relate to general information about a computer system that is used by many companies worldwide, my review of the records has confirmed that they relate to the specific system used by the ORG for the information it is responsible for under the Vital Statistics Act, and is not the sort of generic information referred to by the appellant.

 

Accordingly, I am satisfied that the disclosure of the records could reasonably be expected to endanger the security of a system or procedure established for the protection of the information contained in the system, for which protection is reasonably required, and that section 14(1)(i) applies to the records.

 

Additional Issue

 

As a final matter, the appellant takes the position that the Ministry improperly relies on two different parts of the section 14(1)(i) exemption, and argues that the Ministry cannot do so.  He refers to the Ministry’s representations which state that the exemption in section 14(1)(i) applies because the disclosure of the record “could reasonably be expected to endanger the security of the ORG’s computer systems and/or its operational procedures” (emphasis added).  The appellant then identifies that the exemption in section 14(1)(i) refers to endangering “the security of a building or the security of a vehicle carrying items, or of a system or procedure…”.  The appellant states that, by referring to the disclosure of the information as endangering the security of a system and/or a procedure, the Ministry is adding to the clear wording of the Act, which it cannot do.

 

I do not accept the appellant’s position.

 

The meaning of the word “or”, as it is found in legislative contexts, has been reviewed in a number of court decisions and legal texts.  These confirm that the word “or” is presumed to be inclusive, unless this presumption is clearly rebutted.  The way in which the word “or” has been interpreted is succinctly set out by Ruth Sullivan in her textbook entitled Statutory Interpretation (Faculty of Law, University of Ottawa. (C) 1997 Irwin Law Inc.) as follows:

 

In most legislative contexts, the “and” is joint rather than joint and several.  To express the idea of “and/or”, the inclusive “or” is normally used.

 

“Or” is always disjunctive in the sense that it always indicates that the things listed before and after the “or” are alternatives.  However, “or” is ambiguous in that it may be inclusive or exclusive.  In the case of the exclusive “or”, the alternatives are mutually exclusive: (a) or (b), but not both; (a) or (b) or (c), but only one of them to the exclusion of the others.  In the case of the inclusive “or”, the alternatives may be cumulated: (a) or (b) or both; (a) or (b) or (c), or any two, or all three.

 

Like the joint and several “and”, the inclusive “or” expresses the idea of “and/or.”

…

 

In legislation, “or’s” are presumed to be inclusive, but the presumption is rebutted where it is clear from the context that the listed alternatives are meant to be mutually exclusive.  For example, many Criminal Code  provisions sa that a person who acts in a certain way is guilty of an indictable offence and is liable to imprisonment for a stipulated number of years or is guilty of an offence punishable on summary conviction.  In this context, in keeping with normal practice, the “and” is joint: the person is both guilty of an offence and liable to punishment.  However, the presumption of inclusive “or” is rebutted.  Since the same Code violation cannot be treated as both an indictable and a summary conviction offence, the “or” in this provision is exclusive: an indictable offence or a summary conviction offence, but not both.

 

I adopt the above interpretation of the word “or” in the circumstances of this appeal and with respect to that word as found in section 14(1)(i).  In my view it is clear that the word “or” found in that section is meant to be inclusive.  The nature of the exemption and the harms it seeks to protect, as well as the wording of the exemption support such a finding, and there is nothing in the wording or the context of the section to rebut the presumption that the word “or” is meant to be inclusive.  Indeed, to find otherwise is, in my view, unsupportable.  For example, if a request was received for access to specific information about a security alarm system in place to protect a building, it is possible that the disclosure of the information could endanger both the security of the alarm system itself, as well as the security of the building.  To suggest that the wording in section 14(1)(i) prohibits such a finding would be unreasonable and unsupportable, and I do not accept the appellant’s position that an institution is prohibited from relying on more than one of the specific parts of section 14(1)(i).

 

The appellant also takes the position that the Ministry is precluded from relying on more than one specified exemption for the records, and refers to sections 29(1)(b) and 53 of the Act in support of this argument.  I do not accept the appellant’s position.  Given the nature of the exemptions in the Act, it is clear that more than one could apply to the same record, and the Act implicitly contemplates multiple exemptions claims.  In my view, therefore, specific legislative language would be required to preclude institutions from claiming more than one exemption for a record.  The Act contains no such provision.  (See also Order P-1052 and Practice Direction 1 of this office’s Code of Procedure).

 

ORDER:

 

 

I uphold the decision of the Ministry.

 

 

 

 

 

 Original signed by:                                                                       May 16, 2005                                        

Frank DeVries