ORDER MO-2408

 

Appeal MA08-5

 

City of Ottawa

NATURE OF THE APPEAL:

 

The City of Ottawa (the City) received a request under the Municipal Freedom of Information and Protection of Privacy Act  (the Act) for access to the following information:

 

All emails, letters and faxes sent or received by [named City Solicitor (the Solicitor)], and/or his legal assistant [named assistant] of Ottawa’s Legal Services Department, addressed to and received from the following persons or organizations between February 2007 and the current date.

 

1.      to and from [requester];

2.      to and from anyone at The Children’s Aid Society of Ottawa;

3.      to and from [6 named individuals] regardless of the address used to communicate with these individuals; and

4.      to and from anyone with an email address ending in [a named internet domain].

 

The City responded to the request by advising that it had determined that the communications in question do not relate to the Solicitor’s duties as City Solicitor but rather to his role as a member of the Board of the Children’s Aid Society (CAS).  The City applied section 4(1) of the Act and advised that it has neither custody nor control of the requested records and, therefore, it is unable to process the request as the records fall outside of the scope of the Act.

 

The requester, now the appellant, appealed the City’s decision to this office.

 

The City originally identified 417 pages of records as responsive to the appellant’s request. 

 

During the mediation stage of the appeal process, the appellant narrowed the scope of his request. Specifically, the appellant advised that he is seeking access to the following information:

 

Any record relevant to [the appellant], in addition to discussions relating to the provision of a list of members of the Children’s Aid Society between February 2007 and October 23, 2007.

 

The records responsive to the narrowed request were identified and the remaining records were removed from the scope of the appeal. The records that were removed from the scope of the appeal were identified as pages 1 to 234, 243, 254 to 263, 279 to 369, 374 to 378, 381 to 386, 388 to 390 and 392 to 417.

 

After having reviewed the records responsive to the narrowed request, the mediator advised the appellant that pages 264 to 278 of the records are duplicates of pages 235 to 238, 242, and 244 to 252 of the records. The appellant confirmed that he is not seeking access to pages 264 to 278. Accordingly, these pages have been removed from the scope of the appeal.

 

At the close of mediation, the following 26 pages of records remained at issue: 235 to 242, 244 to 253, 370 to 373, 379, 380, 387 and 391. The issue to be determined is whether the City has custody and control of these records.

 

I began my inquiry by sending a Notice of Inquiry to the City, initially. The City responded with representations. In its representations, the City advised that it had obtained consent to disclose from two of the authors of some of the records at issue and that it was prepared to facilitate the disclosure of 20 pages of records. The City identified the following 20 pages of records to which it was prepared to facilitate disclosure:

 

•      Records 235 to 242 (8 pages)

•      Records 244 to 253 (10 pages), and

•      Records 379 to 380 (2 pages).

 

The City disclosed the records identified above to the appellant but advised that despite its disclosure it continues to maintain that it has neither custody nor control of any of the records at issue.

 

I then sent a copy of the Notice of Inquiry, which I modified to reflect the disclosure of the additional records, to the appellant. I also enclosed a copy of the City’s representations in their entirety. The appellant provided representations in response. As the appellant’s representations raised issues to which I believe the City should be given an opportunity to reply, I sent to the City a copy of the appellant’s representations, in their entirety, seeking reply representations. The City provided reply representations in response.

 

RECORDS:

 

There are 6 pages of records that remain at issue in this appeal:

           

•      Pages 370-373 – an email chain and attachment sent by the Executive Director of the CAS to employees, a consultant and volunteers of the CAS, including the Solicitor at his City email address.

 

•      Page 387 – an email sent by the Executive Director of the CAS to the Solicitor at his City email address. This email was also sent to two other individuals: another CAS volunteer and a CAS employee.

 

•      Page 391 – an email sent on behalf of the Executive Director of the CAS by her executive assistant to a number of individuals who are either employees or volunteers of the CAS. Among the recipients is the Solicitor and the email was sent to his City email address.

 

DISCUSSION:

 

PRELIMINARY ISSUE – RECORDS AT ISSUE

 

In his representations, the appellant takes the position that there should be more pages of records at issue than were noted in the Notice of Inquiry.  He submits:

 

            The Notice of Inquiry stated that there are only six pages which remain at issue and I respectfully submit that there are several more. On Paragraph 6 of page two of the Notice of Inquiry it states that pages 264 to 278 were removed due to duplication.  This is ok.  Further down the page at paragraph 8, bullet number 1, “page 243” of the record appears to be missing from the records at issue.

 

Also, bullet number 2 appears to miss pages 254 to 263 (9 pages) which appear to be unaccounted for and potentially at issue.

 

Furthermore, bullet number 3 stops at page 380. There were originally 417 pages and I wanted to be clear as to whether those above page 380 are part of the files removed due to the narrowing of the scope of the [access] request during mediation as described in paragraph 3 of page 2 on the Notice of Inquiry.

 

In its reply representations the City states that it disagrees with the appellant’s assertion that there are a number of pages missing from the count listed in the Notice of Inquiry. The City submits:

 

The scope of the request was narrowed considerably at mediation on consent of the parties, during which the appellant agreed that he was no longer interested in obtaining any duplicate pages (pages 264 to 278), as noted in the Mediator’s Report [...] These pages are therefore no longer included in the request. During mediation, the appellant further agreed that he was no longer interested in obtaining any records that did not specifically concern him.  This is also reflected in the Mediator’s Report.  Based on this, a number of pages were reviewed by the [...] Mediator and found not be relevant to the appellant, and therefore are no longer responsive to the request.  A summary of the status of the 417 pages of records is annexed to these reply representations for reference.

 

As stated in the Mediator’s Report, the following 26 pages of records remained at issue after mediation:

 

•         Pages 235 to 242 (8 pages),

•         Pages 244 to 253 (10 pages),

•         Pages 370 to 373 (4 pages),

•         Pages 379 to 380 (2 pages),

•         Page 387 (1 page), and

•         Page 391 (1 page).

           

In its initial representations [...] the City advised that it had obtained consent to disclose various records from two of the affected third parties in this appeal.  Therefore, the City was in a position to facilitate disclosure of pages 235 to 242, 244 to 253 and 379 to 380.  Presently, the remaining pages at issue in this appeal are pages 370 to 373, 387 and 391 (6 pages).

 

Analysis and findings

 

I have reviewed the representations of both the appellant and the City on this issue. I have also reviewed the Mediator’s Report as well as the file notes from mediation, which are not subject to mediation privilege, and find that the information before me supports the City’s interpretation of events. I find that there are six records that remain at issue in this appeal.

 

In my first Notice of Inquiry sent to the City, under the heading “Records”, I identified the following 26 pages of records as remaining at issue:  235 to 242, 244 to 253, 370 to 373, 379, 380, 387, and 391. These are the same 26 records that were enumerated on page 2 of the Mediator’s Report as the records remaining at issue following mediation. At the close of mediation, pages 1 to 234, 243, 254 to 263, 279 to 369, 374 to 378, 381 to 386, 388 to 390 and 392 to 417 had been removed from the scope of the appeal as a result of mediation efforts.

 

The Mediator’s Report, identifying the 26 records at issue, was sent by courier to both the City and the appellant at the conclusion of mediation. In accordance with this office’s practice, the covering letter to the Mediator’s Report asked the recipients to review the report and advise the Mediator of any errors or omissions.  The appellant chose not to make any comment and the description of the records at issue in my initial Notice of Inquiry reflected those identified in the Mediator’s Report.

 

As noted above, in its representations in response to the initial Notice of Inquiry, the City advised that it was prepared to facilitate the release of the following 20 pages of records: 235 to 242, 244 to 253, and 279 to 380. The City provided me with a copy of the cover letter that it sent to the appellant confirming the disclosure of the 20 pages. Accordingly, as a result of this disclosure, the records at issue were reduced from 26 to 6. Subsequently, I sent the appellant a Notice of Inquiry that was modified to reflect this change. I described the circumstances surrounding the additional disclosure and identified the 6 pages that remained at issue. To assist the appellant in understanding which pages remain at issue and which ones have been removed, I have reproduced, as Appendix A to this Order, a table prepared and submitted by the City with its reply representations, which summarize the status of the records.

 

Based on all of the information before me in this appeal, I am satisfied that there are only 6 records remaining at issue. The appellant had an opportunity to review the Mediator’s Report and at that time did not object to the records clearly identified as remaining at issue. Therefore, I find that the only records that remain at issue in this appeal are pages 370 to 373, 387 and 391, as described above.

 

CUSTODY OR CONTROL

 

Section 4(1) of the Act sets out the statutory basis upon which a request for access is made. That section states, in part:

 

Every person has a right of access to a record or a part of a record in the custody or under the control of an institution unless . . .

 

Under section 4(1), the Act applies only to records that are in the custody or under the control of an institution.

 

The courts and this office have applied a broad and liberal approach to the custody or control question [Ontario (Criminal Code Review Board) v. Ontario (Information and Privacy Commissioner), [1999] O.J. No. 4072, Canada Post Corp. v. Canada (Minister of Public Works) (1995), 30 Admin. L.R. (2d) 242 (Fed. C.A.), Order MO-1251].

 

Factors relevant to determining “custody or control”

 

Based on the above approach, this office has developed a list of factors to consider in determining whether or not a record is in the custody or control of an institution. The list is not intended to be exhaustive.  Some of the listed factors may not apply in a specific case, while other unlisted factors may apply.

 

• Was the record created by an officer or employee of the institution? [Order P-120]

 

• What use did the creator intend to make of the record? [Orders P-120, P-239]

 

• Does the institution have a statutory power or duty to carry out the activity that resulted in the creation of the record?  [Order P-912, upheld in Ontario (Criminal Code Review Board) v. Ontario (Information and Privacy Commissioner), above]

 

• Is the activity in question a “core”, “central” or “basic” function of the institution? [Order P-912]

 

• Does the content of the record relate to the institution’s mandate and functions? [Orders P-120, P-239]

 

• Does the institution have physical possession of the record, either because it has been voluntarily provided by the creator or pursuant to a mandatory statutory or employment requirement? [Orders P-120, P-239]

 

• If the institution does not have possession of the record, is it being held by an officer or employee of the institution for the purposes of his or her duties as an officer or employee? [Orders P-120, P-239]

 

• Does the institution have a right to possession of the record? [Orders P-120, P-239]

 

• Does the institution have the authority to regulate the record’s use and disposal?  [Orders P-120, P-239]

 

• Are there any limits on the use to which the institution may put the record, what are those limits, and why do they apply to the record?

 

• To what extent has the institution relied upon the record? [Orders P-120, P-239]

 

• How closely is the record integrated with other records held by the institution? [Orders P-120, P-239]

 

• What is the customary practice of the institution and institutions similar to the institution in relation to possession or control of records of this nature, in similar circumstances? [Order MO-1251]

 

Representations

 

City’s representations

 

The City takes the position that the records remaining at issue in this appeal are neither within the custody nor under the control of the City and, as a result, the Act does not apply to them.

 

The City explains that the emails were sent to the Solicitor who was the volunteer President of the Board of Directors of the CAS. The City submits that the contents of all three emails pertain to CAS business and were sent to the Solicitor in his volunteer capacity with the CAS, not in the role as Solicitor for the City.

 

In its representations, the City submits that a number of factors support its view that it does not have custody or control of the three emails that remain at issue. It submits:

 

To the extent that the City possesses the records because they were received on the City’s email system, such possession is due to [the Solicitor’s] position at the CAS.  The City argues that the records are in their nature personal emails of [the Solicitor] and only came to be received by the City’s email system because of [the Solicitor’s] volunteer work with the CAS and for no other reason.

 

[The Solicitor] has stated he uses his City email address for the purposes of receiving communications pertaining to his CAS volunteer position for ease of convenience since his position at the City requires his presence at the City during the day and thus it is easier to receive communications regarding his CAS obligations (which occur after daytime business hours) at the City since he often goes straight to CAS meetings after the completion of his day at the City.  Section 2.2 of the City’s Responsible Computing Policy [attached to the City’s representations and provided to the appellant] permits incidental personal use of City assets such as computers.

 

The records at issue were kept in a separate electronic file on [the Solicitor’s] (and his assistant’s) computer system at the City, and were completely segregated from any other records that he or his assistant might receive, create or use for City business.  The emails at issue in this appeal were never integrated into other City files or records, either in paper or electronic format.  The records were not sent to any other employee of the City.

 

The subject matter of the records pertains solely to CAS business and in no way relates to City business, or to its core, central or basic functions as a municipality.  [The Solicitor] has only used the records for the purposes of his volunteer position at the CAS and has not used the records in any way in relation to his employment duties at the City.

 

Likewise, the records were not received by [The Solicitor] as a result of any statutory requirement or obligation applying to the City, or to any obligation that he has stemming from his employment at the City.  The City has never relied on or used the emails for any of its business, mandate or functions (other than to process the [access] request that is the source of this appeal), and it is reasonable to expect that the City will never have any reason to do so in the future given that the records do not pertain in any way to its mandate or functions.

 

The City submits that while it would have the authority to regulate the disposal of the emails at issue, it has chosen not to do so by By-law.  City Council has decided to exclude these types of emails from its official business records and has not created a retention period for these types of personal emails, but rather allows employees to delete these types of records as soon as the same day they are received. This is in contrast to other records (and emails) which are official business records of the City for which specific retention periods have been created.

 

With its representations, the City enclosed a copy of By-Law No. 2003-527, which is its Records Retention By-law. The City argues that the emails at issue in this appeal fall under the definition of “transitory records” as defined in section 2 of the By-law. That definition reads:

 

            “transitory record” means a record that is:

 

(h)        an email message that is not an official business record.

 

The term “official business record” is also defined in section 2 of the Records Retention By-law. That definition reads:

 

            “official business record” means a record that:

 

(a)                commits the City to an action,

(b)               documents any obligation or responsibility,

(c)                comprises information connected to the accountable business of the City,

(d)               is legally recognized as the corporate authority for establishing a fact and providing the most conclusive information, and

(e)                is registered in the Records Management System.

 

The City submits that a review of the records at issue in light of the definition of “official business records” in the Records Retention By-law reveals that the e-mails are not official business records as they do not fall under any of paragraphs (a) through (e) of the definition of section 2.

 

The City also points to Section 8 of the Records Retention By-law which deals with the deletion of transitory records. That section reads:

 

A transitory record may be deleted or otherwise destroyed on the same day the transitory records was created or received.

 

The City submits that it “has taken positive steps to distance itself from personal employee e-mails of the type at issue in this case by making them transitory records.”

 

Appellant’s representations

 

The appellant takes the position that the City has “custody” or “control” of the e-mails of all its staff in order to enable it to determine whether its resources are being used for inappropriate or unlawful purposes.

 

First, the appellant questions the validity of the City’s Records Retention By-law No. 2003-527. He submits that the Records Retention By-law originally passed “under the radar” of the Auditor General of the City. He states that, shortly after he submitted his first access request to the City that is the subject of this appeal, he noticed that the By-law was on the agenda of the City’s Corporate Services and Economic Development Committee. The appellant states that he brought it to the attention of the City’s Auditor General who, the appellant submits “acted immediately to have the By-law item removed from the agenda because the By-law had originally passed without him noticing that personal emails could be deleted as part of the By-law” [Emphasis by appellant].

 

The appellant further submits that by allowing City employees to delete their personal e-mails immediately after receiving them also “has the effect of “frustrating” provincial and federal statues thereby rendering the By-law “without effect” according to section 14 of the Municipal Act, 2001.”  Section 14 of that Act reads:

 

            (1)        A by-law is without effect to the extent of any conflict with,

 

(a)                a provincial or federal Act or a regulation made under such an Act, or

(b)        an instrument of a legislative nature, including an order, licence or approval, made or issued under a provincial or federal Act or regulation.

 

(2)        Without restricting the generality of subsection (1), there is a conflict between a by-law of a municipality and an Act, regulation or instrument described in that subsection if the by-law frustrates the purpose of the Act, regulation or instrument.  

 

The appellant submits a “non-exhaustive list of federal and provincial statutes the By-law frustrates in relation to their various disclosure, evidence and other provisions, as per section 14 of the Municipal Act, 2001”, which includes:

 

•         The Act

•         Freedom of Information and Protection of Privacy Act

•         Municipal Act, 2001

•         Criminal Code of Canada 

•         Provincial Offences Act

•         Canada Evidence Act

•         Evidence Act

•         Courts of Justice Act, Rules of Civil Procedure

 

The appellant submits:

 

The By-law frustrates these and other Federal and Provincial statutes in that if a staff member of the [City] has used and deleted personal emails on [City] computers for the purpose of committing or furthering the commission of either a Criminal or Provincial Offence (as is the case in relation to this appeal) how can anyone use the statutes listed above to obtain evidence required for legal purposes if the perpetrator is allowed to simply delete their “personal” emails, (evidence) simply because the respondent holds the position that “personal email” is not in the “custody” or “control” of the City as stated in their position.

 

Second, the appellant also takes the position that the By-law is in conflict with the provisions of the City’s Responsible Computing Policy. He submits that for the City “Managers [to] ensure that their staff, hired contractors and other authorized users comply with the provision of [the] Policy” as set out under the “Responsibilities” section, the City must have custody or control of e-mails, whether they are of a personal nature or for official business purposes. The appellant also submits that under the “Monitoring/Contraventions” section the Policy states that:

 

[T]he use of email and other communications systems of the City of Ottawa are “subject to monitoring by ITS [Information and Technology Services] for ... non-compliance with City policies ... whether it is for business or incidental personal use... Monitoring may be done at any time without notice of the use, and without the user’s knowledge ... Users are therefore advised that their use of City IT services and assets, including incidental personal use is not private” and that “Users with privacy concerns should refrain from using IT services and/or assets to process, store or transmit personal-use information.”

[Emphasis added by appellant]

 

The appellant states that the staff, volunteers, contractors and others of the City “must all agree to this Policy” [emphasis by appellant] and therefore, that “they are at all times aware that any e-mails, personal or otherwise are under the ‘custody’ and ‘control’ of the City and not to be deemed  ‘private.’”

 

City’s reply representations

 

Responding to the appellant’s position regarding the validity of its Records Retention By-law, the City asserts that the By-law is authorized under section 255(3) of the Municipal Act, 2001, which provides legal authority to a municipality to establish retention periods for its records subject to the approval by the Municipal Auditor. The City submits that the By-law obtained the requisite approval by the City’s external auditor. The City states that its external auditor is different from the City’s Auditor General and that the distinction is established in the Municipal Act, 2001 itself.

 

The City also submits that there is no conflict between the City’s By-law and the provisions of the Act because section 30(1) of the Act and section 5 of Regulation 823 under the Act allow a municipality to retain its records for the period set-out in a by-law.  The City therefore submits that the Act itself recognizes a municipal Council’s right to set retention periods for its own records.  The City further submits that there is no conflict between its By-law and any other provincial or federal statue, as the By-law was properly passed in accordance with the provisions of the Municipal Act, 2001.

 

Finally, the City argues that although the By-law may be subject to a future review by the City’s Auditor General, City Council or one of City Council’s standing committees, or may be amended in the future, such has not been the case to date. It submits:

 

[T]he fact that the By-law was to go before a Committee of Council earlier this year for re-approval and that the staff report was withdrawn from the Committee’s agenda is irrelevant to this appeal; the fact is that the By-law, as it exists at the time of this appeal, classifies employee personal emails as transitory records and further more permits the destruction of these transitory records as noted in the City’s initial representations in this matter. This weighs heavily in favour of finding that the City does not have the custody or control of the personal emails at issue in this appeal.

 

The City submits that it disagrees with the appellant’s position that its Responsible Computing Policy has the effect of creating custody or control over the e-mails at issue. The City submits that the Policy recognizes that incidental personal use of City computers may be made by City employees but that the “Monitoring/Contraventions” section of the Policy advises employees that “all uses, even personal use, of City computers may be monitored for unauthorized use by City IT staff, and may be used by the Auditor General in an appeal or an investigation.”  The City argues that the Policy “does not have the effect of creating automatic custody and control by the City over employee personal e-mails that have not been monitored or investigated by City staff, as is the case of the records in this appeal” [emphasis by City]. The City explains:

 

Should employee emails be monitored and used by authorized City staff or the Auditor General for the purposes of an investigation or audit, it could be that the emails would become official business records of the City at that point and thereby come under the custody and control of the City at that time.  However, this is not the case for the emails at issue in this appeal, as these have neither been investigated nor monitored by City staff or the Auditor General under the Responsible Computing Policy.  In fact, the emails at issue in this appeal have not been relied on, accessed or used by the City for any City business and therefore remain the personal emails of the employee in question.

 

Analysis and Findings

 

It is clear from the wording of section 4(1) of the Act that in order to be subject to an access request under the Act, a record must either be in the custody or under the control of an institution [Orders M-1078, P-1397, PO-1947].

 

Prior orders of the Commissioner have recognized that a purposive approach must be taken to “custody or control” questions under section 4(1) [Orders MO-1237 and MO-1251].  Consistent with the purposive approach, it has been found that bare possession does not amount to custody for the purposes of the Act, absent some right to deal with the records and some responsibility for their care and protection [Order P-239]. Additionally, “custody or control” has been found despite lack of possession where the relationship between an institution and the party in possession of the records lead to a conclusion that the institution has a “right of ownership and possession” of the records [Order MO-1237]. Further, the Act will apply to information in the custody or under the control of an institution notwithstanding that it was created by a third party [Orders P-239, P-1001, and MO-1225].

 

In Order 120, former Commissioner Sidney Linden outlined what he felt was the proper approach to determining whether specific records fell within the custody or control of an institution.

 

In my view, it is not possible to establish a precise definition of the words “custody” or “control” as they are used in the Act, and then simply apply those definitions in each case.  Rather it is necessary to consider all aspects of the creation, maintenance and use of particular records, and to decide whether “custody” or “control” has been established in the circumstances of a particular fact situation.

 

In doing so, I believe that consideration of the following factors will assist in determining whether an institution has “custody” and/or “control” of particular records:

 

1.                  Was the record created by an officer or employee of the institution?

 

2.                  What use did the creator intend to make of the record?

 

3.                  Does the institution have possession of the record, either because it has been voluntarily provided by the creator or pursuant to a mandatory statutory or employment requirement?

 

4.                  If the institution does not have possession of the record, is it being held by an officer or employee of the institution for the purposes of his or her duties as an officer or employee?

 

5.                  Does the institution have a right to possession of the record?

 

6.                  Does the content of the record relate to the institution’s mandate and functions?

 

7.                  Does the institution have the authority to regulate the record’s use?

 

8.                  To what extent has the record been relied upon by the institution?

 

9.                  How closely is the record integrated with the other records held by the institution?

10.              Does the institution have the authority to dispose of the record?

 

These questions are by no means an exhaustive list of all factors which should be considered by an institution in determining whether a record is “in the custody or under the control of an institution.”  However, in my view, they reflect the kind of consideration which heads should apply in determining questions of custody or control in individual cases.

 

I agree with the above comments made by former Commissioner Linden and will consider the factors that he identified in my analysis below.

 

Although this office has considered the issue of “custody or control” in a number of orders, in my view, Order PO-1725 is particularly relevant in the context of electronic documents. In Order PO-1725 a requester sought access to the electronic agenda of a named employee at the Premier’s office.  The agenda contained both governmental and personal appointments.  Former Assistant Commissioner Tom Mitchinson found that all entries, both personal and professional, were created and stored in a database that was owned and maintained by the government and used for government business. As such, he held that the information was under the custody of the Premier’s office and it could be released subject to any exemptions. In Order PO-1725, former Assistant Commissioner Mitchinson stated:

 

In my view, there are a number of facts and circumstances surrounding the creation, possession and maintenance of the records at issue in these appeals which support the conclusion that they are in the custody of the Premier’s Office.  All entries, whether they contain personal or professional information, were created and stored in the same database.  This database is owned and maintained by the government on behalf of the Premier’s Office.  This factor alone gives the institution both a right to deal with the records and a responsibility for their care and protection, in order to ensure the integrity of the database as a whole and of the information entered into it.

 

In addition, it is clear that the purpose for which the database exists is for use by employees attending to the business of the Premier’s Office.  The capabilities of the database in permitting employees to make entries relating to personal matters, and to place certain restrictions on access to its contents (subject to systems management considerations), are normal features of most electronic calendar management databases and are not inconsistent with the institution’s lawful custody of the database and its contents, or with its responsibilities in relation to its records management functions.  If an employee of a government institution voluntarily chooses to place information, whether personal or professional in nature, into a government maintained database, it is difficult to conceive how the record containing that information would fall outside the institution’s lawful custody, absent the most exceptional circumstances, which I do not find present here.

It is not enough for an institution to assert simply that the named employee has sole authority over access to the records, that there is no protocol in place governing their disposition during the employee’s tenure, or that the retention schedule does not specifically deal with these types of records. As the Divisional Court noted in Ontario (Criminal Code Review Board) v. Ontario (Information and Privacy Commissioner) (March 7, 1997), Toronto Doc. 283/95 (Ont. Div. Ct.), affirmed November 1, 1999, Doc. C28685 (C.A.), for example, the absence of evidence that an institution has actually exercised control over particular records will not necessarily advance the institution’s argument that it, in fact, has no control.  If it were otherwise, government institutions would be in a position to abdicate their information management responsibilities under the Act by the simple device of failing to implement appropriate information management practices in respect of records in their lawful custody.  So long as records are in an institution’s custody, that body must deal with them in accordance with all applicable laws, including the provisions of the Act.

 

            ...

 

In light of all of the circumstances under which the records at issue in these appeals were created and maintained, I find that the Premier’s Office has both the right and responsibility to deal with the records, and that they are in the lawful custody of the Premier’s Office.  The database on which the information was created is owned and maintained by government on behalf of the Premier’s Office; the individual who made use of this database is an employee of the Premier’s Office; the Premier’s Office has the authority to dispose of the database as part of its general replacement and updating of computer systems or applications; and the Premier’s Office may dispose of the records upon termination of an employee’s employment.

 

I agree with the reasoning expressed by the former Assistant Commissioner and adopt it for the purposes of the current appeal.

 

Having considered all of the circumstances before me, I find that the representations of the City support a conclusion that the e-mails at issue are in its “custody” or “control” within the meaning of section 4(1) of the Act.

 

I accept that all three e-mails pertain to CAS business and were sent to the Solicitor in relation to his voluntary position with the CAS, and not for the purposes of his duties as a City employee. I also accept that the contents of the e-mails clearly do not relate to any City business based on its mandate and functions and there is no evidence before me that would suggest that they have been relied upon by the City for any purpose.  I appreciate that the City has a policy that permits incidental personal use of its e-mail system by employees.  I also understand that “for ease of convenience” the Solicitor voluntarily chose to take advantage of this policy in order to receive communications pertaining to his CAS volunteer position at his City e-mail address.

However, my acknowledgement of these circumstances does not alter my view that the City retains custody and/or control of the records at issue. I reach this conclusion for the following reasons:

 

First, the City has physical possession of the records on its e-mail server, as well as the right to such possession.  The fact that the Solicitor kept the e-mails in a separate folder in the e-mail system does not alter the fact that they were received and stored in the City’s e-mail server. Following Order PO-1725, I do not accept the argument that the City does not have “custody” of records voluntarily received and subsequently stored by an employee on a City owned, maintained and regulated e-mail system, which has the primary purpose of facilitating City business.

 

Second, the City’s submissions indicate that it has the authority to regulate the use of the e-mail system upon which the records are kept as well as the disposal of such records, demonstrating that it clearly has “control” over the e-mails that are within its custody. The City states that although it would have the authority to regulate the disposal of personal e-mails, it has chosen not to do so. I accept that the City has no objection to the “incidental personal use of City assets such as computers” and the creation or receipt of personal e-mails by its employees. However, I am not persuaded that by allowing for personal usage and by addressing the disposal of such e-mails in its Records Retention By-law the City has given up its authority over personal e-mails stored on City servers. While I accept that the City is authorized under section 255(3) of the Municipal Act, 2001 to establish retention periods for its records, I do not accept that the City can divest itself of its responsibilities under the Act by choosing not to exercise control over a particular type of record. As noted above, in Ontario (Criminal Code Review Board), which was cited in Order PO-1725, the Divisional Court stated that “the absence of evidence that an institution has actually exercised control over particular records will not necessarily advance the institution’s argument that it, in fact, has no control.”

 

Third, I also do not accept the City’s argument that unless and until employees’ personal e-mails are relied on, accessed or used by the City for the purpose of an investigation or audit, the e-mails are not under its “custody” or “control.” In my view, the fact that the City has explicitly stated that employees are permitted to use the e-mail system for incidental personal use but that personal use of City computers may be monitored for unauthorized use by the City’s Information and Technology staff, supports a conclusion that the City does have the authority to regulate the treatment of those records even if it chooses not to do so. As stated by former Assistant Commissioner Mitchinson in Order PO-1725, “[s]o long as records are in an institution’s custody, that body must deal with them in accordance with all applicable laws, including the provisions of the Act.” Accordingly, in my view, even if employees are permitted to dispose of these records at will, it does not follow that the e-mails that remain on the City’s e-mail system are not within its custody or control.

 

In conclusion, I find that the e-mails at issue are in the City’s “custody or control” within the meaning of section 4(1) and are therefore, subject to the Act. Having determined that the records fall within the scope of the Act, I will order the City to issue an access decision.

ORDER:

 

1.                  I order the City to issue a decision letter to the appellant regarding access to the records at issue in accordance with the provisions of the Act, treating the date of this Order as the date of the request.

 

2.                  I order the City to provide me with a copy of the decision letter referred to in Provision 1 when it is sent to the appellant. This should be forwarded to my attention, c/o Information and Privacy Commissioner/Ontario, 2 Bloor Street East, Toronto, Ontario M4W 1A8.

 

 

 

 

 

Original signed by:                                                                        April 9, 2009                                                     

Catherine Corban