FINAL ORDER MO-2288-F

 

Appeal MA06-324

 

Toronto Police Services Board

NATURE OF THE APPEAL:

 

The Toronto Police Services Board (the Police) received a multi-part request under the Municipal Freedom of Information and Protection of Privacy Act (the Act) for records held by the Police involving the requester.  One part of the request was for records that contain the:

 

Logs of who accessed information about [the requester] – held in Toronto Police records (CPIC, ECOPS, MANIX, CIPS, Professional Standards database, etc…). Include name, badge number, date, time.  From Jan 1/00- Present (on or after May 12/06).

 

The Police sought written clarification from the requester regarding portions of the request.  The requester responded to the Police’s request for clarification by resubmitting the original request.  At the same time, the requester also sought the following additional information from the Police databases:

 

Please provide to me the number of times [a named police officer (police officer #1)] accessed information - as contained in Toronto Police Records (electronic and other) - about any individual who resided at [address] - from January 2000 through to and including August 9, 2006.

 

I would like to stress that I am requesting non-identifying information in numeric form…

 

In response to the portions of the request that did not involve database searches, the Police located responsive records.  In their decision letter, the Police advised the requester that partial access was granted to some of the responsive information, with severances made pursuant to sections 38(a), in conjunction with sections 8(1) (law enforcement), 9(1) (relations with other governments) and 13 (threat to health or safety); and section 38(b) (personal privacy) of the Act.  Concerning the requester’s database requests, the Police advised the requester that:

 

• the request for information relating to the residents at [address], the Freedom of Information and Protection of Privacy Unit is not mandated to conduct investigations and cannot, therefore, know the identities of these residents.  Moreover, even had the names of these persons been provided, the existence of records pertaining to other named individuals cannot be confirmed in accordance with section 14(1) of the Act; and 

 

• the Police are not obliged to create a record of the logs of those individuals who accessed information about the requester in the Police databases.

 

The requester (now the appellant) appealed the Police’s decisions.

 

During mediation, the appellant advised the mediator that he believes various officers accessed his personal information, and that there should be a way to track the log-in history of this.  He believes the Police produce this type of information for internal audit review processes, so there should be a responsive record. 

 

The appellant is also pursuing access to the number of times and dates that a police officer #1 accessed information from Toronto Police records databases in relation to a specified address.  The Police advised the mediator that both of these requests would constitute an “off-line” search that would require them to create records.  The Police indicated that they are not obligated to create records and this issue, along with other issues, remained in dispute. 

 

As mediation was not successful in resolving the appeal, the file was transferred to me to conduct an inquiry.  I sent a Notice of Inquiry, setting out the facts and issues, to the Police, initially.  I received representations from the Police.  I sent a copy of the Police’s representations, along with a Notice of Inquiry, to the appellant.  Portions of the Police’s representations were withheld due to confidentiality concerns.  I received representations in response to the Notice of Inquiry from the appellant.  I then issued Interim Order MO-2257-I, in which I disposed of all of the issues in the appeal, except those concerning the appellant’s request that the Police undertake the two above-referenced database searches.

 

With respect to the appellant’s two database requests, provision 3 of Order MO-2257-I required the Police:

 

…to answer the following questions [from the Notice of Inquiry] concerning the appellant’s request for records/logs of any officers who accessed information about him through any Toronto Police database and his request for the number of times and dates that police officer #1 accessed information from the Police databases in relation to a specified address and to provide me with their answers by [a specified date]:

 

•         Is the information requested by the appellant contained in a machine readable record?  If so, how is it so stored?  If not, what parts of it are not so stored?

 

•         Is there information contained in the machine readable record which contains unique information for each individual entered in the database?  If so, what is this information?  How does the computer hardware or software distinguish the unique information for each individual?

 

•         If there is information contained in the machine readable record which contains unique information for each individual entered in the database, is it possible to replace this unique information with a unique number?  If so, how?  If not, why not?

 

•         If it is possible to replace this unique information with a unique number, could the record be considered to have been “produced” from the machine readable record?

 

•         If the record could be considered to have been “produced” from the machine readable record, would the means required to produce the record be means “normally used by the Police”?

 

•         If the record could be considered to have been “produced” from the machine readable record, would the process of producing it unreasonably interfere with the operations of the Police?  If so, how?

 

DISCUSSION:

 

Although ordered to do so, the Police have not directly answered the questions posed to them in provision 3 of Order MO-2257-I.  Instead they have provided representations indicating that obtaining the information requested by the appellant would entail conducting an “off-line search”, which would constitute the creation of a record, and that they are not obliged to do so.  

 

The Police rely on the findings of Former Adjudicator Marano in Order No. MO-1446, where she summarized the procedure involved in obtaining an off-line search.  In that Order, she stated:

 

CPIC [Canadian Police Information Centre] is a centralized computer system managed by the Royal Canadian Mounted Police (RCMP).  Police departments and agencies across Canada enter information into this system which is accessible to other departments and agencies through local computer terminals.  An off-line search is a method of processing and searching the computer records on this database.  To obtain an off-line search, a police agency submits a request to the RCMP.  After the request is approved and a search completed, the RCMP forwards the results to the requesting police department.  The search results then become a record in the custody and control of that police department.

 

Section 2 of the Act defines a record as:

 

…any record of information however recorded, whether in printed form, on film, by electronic means or otherwise, and includes,

 

(a)        correspondence, a memorandum, a book, a plan, a map, a drawing, a diagram, a pictorial or graphic work, a photograph, a film, a microfilm, a sound recording, a videotape, a machine readable record, any other documentary material, regardless of physical form or characteristics, and any copy thereof, and

 

(b)        subject to the regulations, any record that is capable of being produced from a machine readable record under the control of an institution by means of computer hardware and software or any other information storage equipment and technical expertise normally used by the institution;

 

Section 1 of Regulation 823 under the Act states:

 

A record capable of being produced from machine readable records is not included in the definition of “record” for the purposes of the Act if the process of producing it would unreasonably interfere with the operations of an institution.

 

The Divisional Court, in the recently released case of Toronto (City) Police Services Board v. Ontario (Information and Privacy Commissioner), [2007] O.J. No. 2442 (Div. Ct.) (application for leave to appeal filed), ruled on a related issue concerning a request to the Toronto Police Services Board for certain electronic data.  The databases at issue in that case were two of the same databases at issue in this appeal, namely, the Criminal Information Processing System (CIPS) and in the Master Name Index (MANIX).  The Police in that case refused access to the information saying that fulfilling the request would necessitate the creation of records by the Police. 

 

In granting the judicial review application, Justice Carnwath for the Court, concluded that the words “normally used by the institution” in section 2(b) qualify both “by means of computer hardware and software” and “any other information storage equipment and technical expertise.”

 

He further held that an analysis of section 2(b) requires:

 

1.    a finding there is a “record” capable of being produced from a machine-readable record;

 

2.    a finding that such a “record” is under the control of the institution; and,

 

3.    a finding that the “record” can be produced “by means of computer hardware and software or any other information storage equipment and technical expertise normally used by the institution”.  [Emphasis added by the Court.]

 

If requirement three is not satisfied, that is the end of the matter.  If it is satisfied, there remains the requirement established by s. 1 of O. Reg. 823 that the “producing” must not unreasonably interfere with the operation of the institution.

 

In this case, I asked the Police in the Notice of Inquiry to identify whether the records responsive to the appellant’s database questions are “capable of being produced from a machine readable record under the control of an institution by means of computer hardware and software or any other information storage equipment and technical expertise normally used by the institution.”  In that regard, I specifically asked the Police to address the questions set out in provision 3 of Order MO-2257-I.  The Police, both in their representations in response to the initial Notice of Inquiry and in their letter in response to Interim Order MO-2257-I did not respond to these questions.  In response to the Notice of Inquiry, the Police simply stated that:

 

Not only does the Act not require the Police to create a record in response to this request, but the parameters of the request are so broad as to make creating such a record a practical impossibility.

In response to provision 3 of Order MO-2257-I, the Police replied that:

 

It should be noted that the Toronto Police Service does not itself have members fill in a paper or computer log or record listing all the computer checks done by each individual each day.

 

The only record of such checks would be what is known as an “off-line search”.   Although an off-line search is a machine-readable record; it is not a record to which the Toronto Police Service has direct access, nor is the Freedom of Information Coordinator authorized to initiate an off-line search.

 

In their letter in response to Order MO-2257-I, the Police rely on Orders MO-1446, MO-1596 and MO-1422.  Two of these Orders deal with the CPIC database, one of the databases referred to in the first of the appellant’s database requests.  I will deal with the appellant’s request relating to the CPIC database separately from his request for information accessible through other databases operated by the Police.

 

CPIC DATABASE RECORDS

 

With respect to the CPIC database, the appellant is seeking the logs of anyone in the Police who accessed information about him held in that database between January 1, 2000 and May 12, 2006.

 

Order MO-1446 addressed a request to the Halton Regional Police Services Board for a record of an off-line search for a communication relating to a specific incident in the CPIC database.  CPIC is a centralized computer database managed by the Royal Canadian Mounted Police (RCMP).  Police departments and agencies across Canada enter information into this database which is accessible to other departments and agencies through local computer terminals.

 

In Order MO-1446, Adjudicator Donald Hale found that the Halton Police did not input any information relating to a specific incident on the CPIC database.  Therefore, no record would exist on CPIC of the incident referred to in the request.  As no responsive record existed in that appeal, Adjudicator Hale found that no useful purpose would be served by requiring the Halton Police to run an off-line CPIC search for such a record.

 

 

Order MO-1596 concerned a request for all information respecting any North Bay Police criminal record checks performed using the CPIC database about the requester.  The police in that appeal conducted a search within the police department for records indicating whether anyone in the North Bay Police had conducted an “off-line search” involving a request to the RCMP’s CPIC database concerning the appellant.  As the North Bay Police did not have any records of such an off-line search being conducted by anyone in that police service, no responsive records existed within their record-holdings.

 

In Order MO-1596, Adjudicator Donald Hale found that the North Bay Police were not required to ask the RCMP to conduct their own search as to whether anyone within the North Bay Police has initiated an off-line search of the CPIC database concerning the appellant.  Adjudicator Hale determined that such a request from the North Bay Police to the RCMP would be tantamount to requiring the North Bay Police to create a record.

 

It is clear from Orders MO-1446 and MO-1596, that the CPIC database is not a database to which the police departments have direct access.  Police departments are required to submit a request to the RCMP to have the RCMP search the CPIC database.  In Order MO-1446 records existed within the Halton Police service as to whether anyone had inputted information in the CPIC database.  Similarly in Order MO-1596, records existed in the North Bay Police service demonstrating whether anyone in that police service had submitted a request to the RCMP for the RCMP to search the CPIC database.

 

The Police submit that they do not have their members fill in a paper or computer log or record listing all the computer checks done by each individual each day.  However, the Police have not provided me with specific information as to whether they have conducted a search for records that would reveal whether anyone in the Police had inputted the appellant’s information into the CPIC database or had submitted a request to the RCMP for the RCMP to search the CPIC database for information concerning the appellant.  Each of these types of records would be responsive to the appellant’s request for logs (including the name, badge number, date and time) of anyone within the Police who accessed information concerning the appellant in CPIC.

 

Therefore, I will order the Police to conduct a search for any records they have concerning:

 

• the inputting of information relating to the appellant into the CPIC database; and,

 

• the submitting of a request to the RCMP to search CPIC for information relating to the appellant.

 

In addition, the appellant believes that police officer #1 had, without authorization, accessed information about him in the CPIC database.  The appellant provided me with a March 25, 2008 newspaper article which confirms that:

 

On Jan. 16, Detective [name], an investigator with the professional standards unit of the Toronto Police, handed down a report confirming [police officer #1’s] misuse of the CPIC database on seven occasions.

According to [the detective’s] report, [police officer #1] told investigators that he initially went into CPIC after hearing complaints about [the appellant’s] behaviour:  “I did the first check to see if [the appellant] had contact with police and because if I'm going to deal with this guy I want to make sure I know who he is from an officer safety standpoint,” he said…

 

Therefore, based on the information in this newspaper article, I will also order the Police to conduct a search for all records that contain information about the seven occasions when the police officer #1 accessed CPIC about the appellant.

 

NON-CPIC RELATED INFORMATION

 

I will now deal with the remainder of the appellant’s two database related requests.  With respect to the non-CPIC related information, the appellant is pursuing access to:

 

1.       the records/logs of any officers who accessed information about him through any Toronto Police database (including …, ECOPS, MANIX, CIPS, Professional Standards Database, etc.) from January 1, 2000 until May 12, 2006; and, 

 

2.       the number of times a police officer #1 accessed information about any individual who resided at a specified address from January 2000 until August 9, 2006. 

 

The Police take the position that, as these records do not exist, responding to these requests would require the creation of records.  The Police indicated that they are not obligated to create such records.

 

The Police submit that the only record of computer checks done by officers each day would be what is known as an “off-line search” which would constitute the creation of a record.  They submit that:

 

Although an off-line search is a machine-readable record; it is not a record to which the Toronto Police Service has direct access, nor is the Freedom of Information Coordinator authorized to initiate an off-line search.

 

I disagree with the Police’s claim that they cannot access records obtained through an off-line search as that is not a record to which the Toronto Police Service have direct access, nor is the Freedom of Information Coordinator (the Coordinator) authorized to initiate an off-line search.  The appellant’s request was made to the Police, not to the Coordinator.  The issue is whether the responsive records are in the custody or control of the Police, not whether the FOIC is authorized to search for these records or whether the Police have “direct” access to these records.  In both requests, the appellant sought information from various databases, including several named databases.  The Police have not responded with sufficient particularity as to whether the information at issue in the databases other than the CPIC database, is information which the Police have custody or control over.

 

The Police rely on Order MO-1422 where Adjudicator Donald Hale found that:

 

…[it was not] possible for the Police to electronically retrieve information relating to contacts between its officers and the Office of the Public Guardian and Trustee  pursuant to Procedure 09-01 using the existing database.

 

Because fields capturing the information sought by the appellant simply do not exist, I concur with the position of the Police and find that it is impossible to retrieve this information without modifying significantly the existing fields which capture information entered by the investigating officers electronically.

 

The Police submit that they do not have their members fill in a paper or computer log or record listing all the computer checks done by each individual each day.  However, as demonstrated by the information in the newspaper article referred to above, the Police clearly have responsive records concerning the accessing of one database (CPIC) about the appellant, as well as having responsive records in the Police’s Professional Standards Bureau.  In his request, the appellant sought information from the Police’s Professional Standards Bureau database.  The Police have not provided me with sufficient information as to whether they have custody or control over records responsive to the appellant’s two database questions. 

 

In the circumstances of this case, by not answering the questions posed in provision 3 of Order MO-2257-I, the Police have not provided me with sufficient evidence as to whether they are able to electronically retrieve information concerning the two database questions posed by the appellant in his request.  In other words, I am unable to determine whether the Police are able to provide records responsive to the appellant’s database questions which are “capable of being produced from a machine readable record under the control of an institution by means of computer hardware and software or any other information storage equipment and technical expertise normally used by the institution” (Toronto (City) Police Services Board v. Ontario (Information and Privacy Commissioner, [cited above]).  Therefore, I will order the Police to search all of their databases, including the ECOPS, MANIX, CIPS and Professional Standards databases, for:

 

• the records/logs of any officers who accessed information about the appellant from January 1, 2000 until May 12, 2006;

 

•         the number of times police officer #1 accessed information about any individual who resided at a specified address from January 2000 until August 9, 2006. 

 

 

 

 

 

ORDER:

 

1.   I order the Police to conduct a search for any records they have concerning

 

• the inputting of information relating to the appellant into the CPIC database;

 

• the submitting of a request to the RCMP to search CPIC for information relating to the appellant; and,

 

• the seven occasions when police officer #1 accessed CPIC about the appellant;

 

      and to provide the appellant with a decision letter in accordance with the provisions of sections 19, 21 and 22 of the Act, treating the date of this order as the date of the request, without recourse to a time extension under section 20 of the Act.  I further order the Police to provide me with a copy of this decision letter to the appellant.

 

2.   I further order the Police to conduct a search all of their databases, including the ECOPS, MANIX, CIPS and Professional Standards databases, for

 

• the records/logs of any officers who accessed information about the appellant from January 1, 2000 until May 12, 2006; and,

 

• the number of times police officer #1 accessed information about any individual who resided at a specified address from January 2000 until August 9, 2006;

 

and to provide the appellant with a decision letter in accordance with the provisions of sections 19, 21 and 22 of the Act, treating the date of this order as the date of the request, without recourse to a time extension under section 20 of the Act.  I further order the Police to provide me with a copy of this decision letter to the appellant.

 

 

 

 

 

Original Signed by:                                                                                     April 2, 2008                                         

Diane Smith