ORDER PO-2656

 

Appeal PA-060020-1

 

Ministry of Children and Youth Services

NATURE OF THE APPEAL:

 

The requester submitted a request to the Ministry of Children and Youth Services (the Ministry) under the Freedom of Information and Protection of Privacy Act (the Act) for access to a copy of a Privacy Impact Assessment (PIA) and a Threat Risk Assessment (TRA) as they relate to the Client Information Management System (CIMS).

 

The Ministry issued a decision in which it stated that it could not provide access to the records requested on the basis that it did not have custody and control of them.  In its decision letter, the Ministry explained that the Government of Ontario, through the Ministry of Finance, entered into a partnership with a named mental health centre (the Centre) to expand the already established CIMS and stated that the Ministry is “only responsible for providing advice and assistance for the current project.”  The Ministry goes on to state that the Centre is the sponsor of the PIA and the TRA and that the Centre is responsible for the management of CIMS.  The Ministry also advised that the implementation and operation of CIMS and any supporting documentation were created for and by the Centre and remain the property of the Centre.  The Ministry stated that it can only provide access to Ministry records and, as the two documents are the property of the Centre, the Ministry cannot provide copies. 

 

The requester (now the appellant) appealed the Ministry’s decision.

 

During the mediation stage of the appeal process, the Ministry confirmed that it has a “copy” of the records at issue but maintains that it does not have “control” of them.

 

Conversely, the appellant believes that the Ministry has “control” of the records he is seeking.

 

As it was not possible to resolve this issue through mediation, the file was transferred to the adjudication stage of the appeal process.  The adjudicator previously assigned to this appeal commenced the inquiry by sending a Notice of Inquiry to the Ministry and seeking representations.  The Ministry submitted representations and agreed to share them in their entirety with the appellant.

 

The previous adjudicator then sought representations from the appellant and provided him with a copy of the Notice of Inquiry along with a copy of the Ministry’s representations.  The appellant submitted representations in response.

 

After reviewing the appellant’s submissions, the previous adjudicator provided the Ministry with an opportunity to reply.  However, the Ministry chose not to submit anything further on this issue.  

 

The file was subsequently transferred to me to complete the adjudication process.

 

RECORDS:

 

There are two records at issue in this appeal, a PIA and a TRA, both of which relate to CIMS.

 

 

 

DISCUSSION:

 

CUSTODY OR CONTROL

 

General principles

 

Section 10(1) reads, in part:

 

Every person has a right of access to a record or a part of a record in the custody or under the control of an institution unless . . .

 

Under section 10(1), the Act applies only to records that are in the custody or under the control of an institution.

 

The courts and this office have applied a broad and liberal approach to the custody or control question [Ontario (Criminal Code Review Board) v. Ontario (Information and Privacy Commissioner), [1999] O.J. No. 4072 and Canada Post Corp. v. Canada (Minister of Public Works) (1995), 30 Admin. L.R. (2d) 242 (Fed. C.A.), Order MO-1251].

 

Factors relevant to determining “custody or control”

 

Based on the approach set out in the decisions cited above, this office has developed a list of factors to consider in determining whether or not a record is in the custody or control of an institution.  These factors reflect a purposive approach to the “custody or control” question under section 10(1) (see Orders P-120, MO-1237 and MO-1251).  The list is not intended to be exhaustive.  Some of the listed factors may not apply in a specific case, while other unlisted factors may apply.  These factors include:

 

• Was the record created by an officer or employee of the institution? [Order P-120]

 

• What use did the creator intend to make of the record? [Orders P-120, P-239]

 

• Does the institution have a statutory power or duty to carry out the activity that resulted in the creation of the record?  [Order P-912, upheld in Ontario (Criminal Code Review Board) v. Ontario (Information and Privacy Commissioner), above]

 

• Is the activity in question a “core”, “central” or “basic” function of the institution? [Order P-912]

 

• Does the content of the record relate to the institution’s mandate and functions? [Orders P-120, P-239]

 

• Does the institution have physical possession of the record, either because it has been voluntarily provided by the creator or pursuant to a mandatory statutory or employment requirement? [Orders P-120, P-239]

 

• If the institution does not have possession of the record, is it being held by an officer or employee of the institution for the purposes of his or her duties as an officer or employee? [Orders P-120, P-239]

 

• Does the institution have a right to possession of the record? [Orders P-120, P-239]

 

• Does the institution have the authority to regulate the record’s use and disposal?  [Orders P-120, P-239]

 

• Are there any limits on the use to which the institution may put the record, what are those limits, and why do they apply to the record?

 

• To what extent has the institution relied upon the record? [Orders P-120, P-239]

 

• How closely is the record integrated with other records held by the institution? [Orders P-120, P-239]

 

• What is the customary practice of the institution and institutions similar to the institution in relation to possession or control of records of this nature, in similar circumstances? [Order MO-1251]

 

In Order PO-1725, former Assistant Commissioner Tom Mitchinson noted that the orders of this office dealing with issues of custody and control have turned on the particular circumstances of each appeal in relation to the principles first enunciated by former Commissioner Linden in Order P-120 (see, for example, Orders P-239, P-271, P‑326, P-396, M-5, P-912, M-315, M-506, MO-1237 and MO-1242).  As in that case, the current appeal must also be decided on the basis of its particular facts.

 

In this case, the Ministry acknowledges that it has physical possession of the responsive records, but takes the position that it does not have control over them. 

 

It is clear from the wording of section 10(1) that in order to be subject to an access request under the Act, a record must either be in the custody or under the control of an institution (see, for example, Orders M-1078, P-1397 and PO-1947). 

 

In Order P-120, former Commissioner Linden considered what constitutes custody under the Act and concluded that physical possession of a record is the best evidence of custody, and only in rare cases could it successfully be argued that an institution did not have custody of a record in its actual possession.  However, bare possession does not amount to custody for the purposes of the Act (Order P-239); rather, there must be some right to deal with the records and some responsibility for their care and protection.  Nevertheless, the Act will apply to information in the custody or under the control of an institution notwithstanding that it was created by a third party (Orders P-239, P-1001 and MO-1225).

 

The Representations

 

In explaining how and why it obtained a copy of the responsive records, the Ministry provides some background regarding their creation.  The Ministry refers to “The Strengthening Our Partnership initiative” announced in the 2003 Ontario Budget and states that under this initiative, the Government of Ontario, through the Ministry of Finance, entered into a partnership with [the Centre] to expand the already integrated and established CIMS to a wider group of service providers.  The Ministry notes that although the funding agreement between the Ministry of Finance and the Centre required that the Centre undertake both a PIA and a TRA, there was no requirement for approval of the PIA or TRA.  The Ministry states further:

 

The CIMS is currently operational in six sites and [the Centre] is responsible for the management of the system.  [The Centre] is a service provider (also known as a transfer payment agency) of the Ministry.  [The Centre] is the sponsor of the project and the lead agency for implementation of CIMS.  The development, implementation and operation of the CIMS and any supporting documentation were created for and by [the Centre] and remain the property of [the Centre].

 

…

 

 

[The Centre] and the participating agencies are transfer payment agencies in that they receive annual operating funding from the Ministry and are accountable to the Ministry for the use of those funds and for the quality of the program.  An independent board of Directors administers these agencies.  Each agency maintains a record for each client in its care and for every family to whom it provides service and these records are created and maintained by the agency for its own uses.  The management of agencies is responsible for records management practices.  The CIMS database supports these agencies in the management of client files.

 

With respect to the indicia of custody and/or control discussed above, the Ministry indicates that the PIA and TRA were prepared by a consultant engaged by the Centre and its participating agencies.  The Ministry states further that the consultant was required to complete a Conceptual Privacy Impact Assessment for the sole use of the project steering committee, constituted by the Centre.

 

The Ministry notes that PIAs are not required under current privacy legislation, and organizations that conduct a PIAs or TRAs are not required to submit them for review.  In this case, the Ministry indicates that it, through the Manager of the Freedom of Information Unit (FIPP Unit), offered advice, guidance and suggestions to the agencies on the privacy implications and risks of the CIMS project. In this context, the PIA and TRA were voluntarily provided to the Ministry for this purpose.  The Ministry maintains that although the Manager of the FIPP Unit has possession of the records and presumably reviewed them in order to provide advice, guidance and suggestions, the Manager has no corresponding approval role with respect to them.  Moreover, the Ministry asserts that it has no authority to regulate the use or disposal of the records, nor has it relied on the records other than to provide comments or suggestions based on the Manager’s experience and knowledge of privacy principles.  The Ministry states that the records have not been integrated with Ministry records and have only been shared within the Ministry for the purposes of providing advice and support to the project members.

The Ministry indicates that while it has historically been its practice to review and approve Ministry records related to PIA and TRA for the Ministry’s own databases and projects affecting personal information, it does not typically review privacy projects undertaken by transfer payment agencies.

Referring to Order P-1069, regarding records in the custody and control of the Children’s Aid Society (CAS), the Ministry submits that the conclusions in that order are similarly applicable in the current case.  The Ministry notes that Order P-1069 speaks to the relationship between the Ministry and its transfer payment agencies and concluded that the Ministry does not have the authority to access CAS records and, therefore, is unable to disclose CAS records.

In his representations, the appellant points out that the Ministry has clearly acknowledged that it has “possession” of the records at issue and, referring to the Ministry’s representations noted above, argues that they imply that the Ministry has “custody” of them within the meaning of the Act.  The appellant submitted copies of an e-mail exchange in December 2005 between the Executive Director of one of the agencies required to take part in the CIMS Project and a Program Supervisor with the Ministry. In the initiating e-mail, the Executive Director requested copies of the records at issue.  The appellant notes that in the reply e-mail from the Program Supervisor, which was copied to two Ministry employees, she implies that the Ministry has copies of the records.  The appellant notes further that the Program Supervisor stated in her e-mail that it was the Ministry's intention to partition sections of the reports for viewing, and that the Ministry was developing workplans based on the recommendations of the reports in question.

The appellant also provided a copy of the Service Contract between the Ministry and the Centre, which he asserts clearly indicates that the Ministry had copies of the records at issue in the course of implementing the CIMS Project.  The appellant states further:

In its representations, the Ministry maintained that its involvement in the CIMS project was limited to providing advice, guidance and suggestions through the involvement of the Manager of the Freedom of Information Unit (FIPP Unit). However, examination of the Service Contract between the Ministry and [the Centre] reveals that a number of other Ministry officials have been involved in the project, and that their involvement extends far beyond providing advice, guidance and suggestions. The Service Contract suggests that numerous Ministry officials not only had copies of the reports in question, but played a key role in the completion, approval and implementation of the PIA and TRA.

The appellant then refers to numerous sections of the Service Contract, notably Articles 4.1, 5.1 and portions of Schedule A, which he claims support his position that the indicia of custody and/or control are present in the circumstances.  These articles generally refer to the establishment and functions of a Project Steering Committee and Project Management Office, the membership of which includes Ministry personnel.  The appellant takes the position that Ministry officials would not be a part of conducting assessments, reporting findings of these assessments and approving reports had they not been in possession of and reviewed them. He submits further:

… on the basis of the Ministry's own admissions and representations, and on the basis of the Service Contract that the ministry has custody of the documents in question, and that this goes beyond mere possession.

Moreover, commenting on the Ministry’s position that it cannot deal with an access request for the records as they are the property of the Centre, the appellant states:

 

This is contrary to a finding in Order P-239 which states the following:

It is my opinion that to remove information originating from non-institutions from the jurisdiction of the Act would be to remove a significant amount of information from the right of public access, and would be contrary to the stated purpose and intent of the Act.

 

Therefore, it is my view that the Act can apply to information which originated in the Ombudsman's office which is in the custody or under the control of an institution.

The implication of this finding in this case is that while the PIA and TRA may have originated from a non-institution [the Centre], these assessments are still subject to the Act if they are in the custody or under the control of the Ministry.

…

Within Order P-1069, reference is made to Order P-239. The section cited is the following:

In my view, the fact that there may be limits on the institution's ability to govern the use of the records is relevant to the issue of whether the institution has control of the records, but does not preclude the institution from having custody.

 

Although the Ministry chose not to respond to the appellant’s submissions as set out above, it is apparent that it was aware of some of his arguments.  In the Ministry’s initial representations, it addressed in a general way, what it believes to be the appellant’s position, stating:

 

… the appellant believes that the ministry has control of the records as the ministry is planning on distributing portions of the records at issue. In response, it is the ministry's position that the manager of the FIPP Unit suggested to the CIMS committee that it prepare an Executive Summary of the PIA and TRA. The purpose of the summary would be to communicate the process and steps taken to; identify privacy risks; the approach to administrative, physical and technical solutions to lessen those risks; and policies and procedures developed to support staff in dealing with sensitive, personal information, including personal health information.

The ministry shared with the committee members the privacy and security risks associated with providing a complete and unabridged copy of the PIA and TRA conducted on the CIMS system. They were advised that it is not the ministry's practice to widely share these types of records within the ministry let alone disclosure to the public.

The appellant also believes that the ministry is developing work plans based on the records. The ministry has advised and provided tools and resources to the CIMS members on how to approach the work associated with conducting a PIA and TRA. This included discussions on the steps involved in completing these documents throughout the life cycle of the CIMS project.  Advice was provided on completing a Conceptual PIA, and Logical PIA and finally a Physical PIA and the timeframes on when these products should be undertaken.

…

 

The ministry and the agencies involved in the development and implementation of the CIMS project recognized the benefits and rewards of taking the privacy rights of clients seriously. A shared vision of entrenching those privacy principles in the CIMS project would serve the agencies and its clients well. As a result, the ministry provided the advice, guidance and support of its experience and expertise to the project members in an advisory capacity only, the agencies involved made the final decisions. It is for this reason that the ministry maintains that while the ministry has a copy of the records in its custody it does not control the record.

 

Findings

 

As I noted above, the Act requires that the records be in the custody or under the control of the Ministry.  Having reviewed the submissions of both parties and the documents tendered by the appellant in support of his claim that the records are in the custody and/or control of the Ministry, I find that the records are clearly in the Ministry’s custody.

 

I find that the circumstances that resulted in Order P-1069 are distinguishable from those in the current appeal.  In the former case, the records being sought were in the custody of the CAS.  In that case, the adjudicator found that the records at issue were not within the Ministry’s control.  In the current appeal, the Ministry clearly has possession of the records.  By the Ministry’s own admission, it obtained the records as part of its role in providing guidance and advice based on its own expertise in the area of developing PIAs and TRAs.  Following the reasoning in Order P-239, which was referred to in Order P-1069, I find that any limits there might be on the Ministry's ability to govern the use of the records is relevant to the issue of whether it has control of the records, but does not preclude the Ministry from having custody.  In this case, the Ministry has actively obtained the records, its staff have been involved in assisting the Centre to prepare the records through the advice and guidance they provided and the Ministry, by virtue of the Service Contract and/or its own participation in the process, has exerted a level of interest in the records to bring them well beyond only “bare possession”.  Accordingly, I will order the Ministry to make a decision regarding the appellant’s request for access to the records at issue.

 

ORDER:

 

1.         I order the Ministry to provide the appellant with a new decision letter regarding access to information in its custody which relates to the appellant's request in accordance with the access provisions of the Act, using the date of this order as the date of the request.

 

2.         In order to verify compliance with the provisions of this order, I reserve the right to require the Ministry to provide me with a copy of the decision letter which is provided to the appellant pursuant to Provision 1.

 

 

 

 

 

 

 

                                                                                                             April 1, 2008                                                 

Laurel Cropley