ORDER MO-2374

 

Appeals MA07-277, MA07-346, MA08-88,

MA08-189 and MA08-334

 

City of Vaughan

BACKGROUND OF APPEAL:

 

Printed copies of emails between the Mayor of the City of Vaughan (the City), then a Regional Councilor, were anonymously left on the doorstep of the City’s former Mayor during the 2006 municipal election.  It appears that copies of the emails were also provided to a local reporter.  The Mayor alleged that a number of her e-mail messages had been printed, without her authority.  The allegation was brought to the attention of the police who determined that the matter did not warrant a criminal investigation.  The City subsequently issued the following press release on March 8, 2007, which is archived on its public website:

 

The City of Vaughan has secured the firm of Deloitte & Touche to perform a forensic audit regarding email disclosures at City Hall.

 

York Regional Police yesterday released the results of a four-month review which was to determine if the disclosures warranted a criminal investigation. The result of this review found that it is not a police matter. Officers consulted with the Information and Privacy Commissioner, the Ministry of Municipal Affairs and the Crown Attorney's Office.

 

"I respect the police service's decision, however this matter needs to be addressed," said Mayor Jackson. "I believe a forensic audit will help to resolve this issue."

 

Forensic experts began inspecting the City's computer system two weeks ago. The estimated date for completion of the audit is April. Deloitte & Touche is a professional services firm, providing audit, tax, consulting and financial advisory services.

 

NATURE OF THE APPEAL:

 

The City subsequently received five separate requests under the Municipal Freedom of Information and Protection of Privacy Act (the Act) for a copy of the audit report.  One of the requesters is a member of the media.

 

The City issued a decision to each requester denying access to the report.  The City withheld access to the report pursuant to sections 6(1)(b) (reveal deliberations of a closed meeting).  The City also claimed that disclosure of the report would constitute an unjustified invasion of privacy under section 14(1) (personal privacy) taking into consideration the presumptions at sections 14(3)(d) and 14(3)(g) of the Act.

 

The requesters (now the appellants) independently appealed the City’s decisions to this office.  The City was asked to provide a copy of the responsive record to this office.  In each appeal, the City provided a 25 page document prepared by the audit team.  This office was not provided with printed copies of the emails in question.

 

During mediation, one of the appellants raised the possible application of the public interest override at section 16 of the Act.  Also during mediation, the possible application of sections 38(a) and (b) of the Act was raised as it appeared that at least one of the appellants was named in the report.  Sections 38(a) and (b) recognize the special nature of requests for one’s own personal information and the desire of the legislature to give institutions the power to grant requesters access to their personal information.  

 

None of the issues in dispute were resolved in mediation and the appeals were transferred to adjudication.   

 

This office commenced its inquiry by seeking the representations of the City, initially.  The City provided representations.  The non-confidential portions of the City’s representations were provided to the appellants, who were given an opportunity to respond.  Three of the appellants submitted representations in response. 

 

I have decided to join the appeals relating to the five requests as the responsive record provided by the City in each appeal are identical.  Accordingly, this order will dispose of all issues relating to appeals MA07-277, MA07-346, MA08-88, MA08-189 and MA08-334.

 

RECORDS:

 

The records at issue total 25 pages and comprises of an audit report entitled “City of Vaughan Forensic Review of E-mail Activity”, dated June 18, 2007, along with the Executive Summary Report and letter of engagement, dated January 30, 2007, relating to the review.

 

Record	Number of pages
Executive Summary Report, not dated	3 pages
Letter of Engagement, dated January 30, 2007	2 pages
Audit Report, dated June 18, 2007	19 pages

 

The audit report consists of nineteen pages.  The first three pages are not numbered and consist of the title page, cover letter and table of contents.  Pages 1 and 2 set out the background, scope of review and restrictions of the audit.  Pages 3 to 7 contain the audit team’s summary of findings.  Pages 8 to 16 contain charts that organize the information the audit team gathered as a result of their interviews with City staff.  There are three charts.  The first chart sets out the name, position, employment duration and summary of statements of twelve Information and Technology staff members.  The second chart sets out the same information relating to the Mayor and her Executive Assistant and the third chart contains the same information for the Chief Information Officer. 

 

The Executive Summary report, prepared by the audit team, consists of four pages.  It summarizes most of the information contained in the audit report. 

 

The Letter of Engagement is from the audit team to the City and sets out the audit team’s understanding of the work that is to be completed and their proposed fees.  The letter consists of two pages.

 

DISCUSSION:

 

CLOSED MEETING

 

The City claims that the responsive records are exempt under the section 6(1)(b) of the Act.  The appellants reject the City’s position and one appellant claims that the exception under section 6(2)(b) applies in the circumstances of this appeal.  Section 6(1)(b) reads:

 

A head may refuse to disclose a record,

 

that reveals the substance of deliberations of a meeting of a council, board, commission or other body or a committee of one of them if a statute authorizes holding that meeting in the absence of the public.

 

 

Section 6(2) of the Act sets out exceptions to sections 6(1)(a) and/or (b).  Section 6(2)(b) reads:

 

Despite subsection (1), a head shall not refuse under subsection (1) to disclose a record if, in the case of a record under clause (1)(b), the subject matter of the deliberations has been considered in a meeting open to the public

 

 

For the section 6(1)(b) exemption to apply, the institution must establish that

 

1.         a council, board, commission or other body, or a committee of one of them, held a meeting

 

2.         a statute authorizes the holding of the meeting in the absence of the public, and

 

3.         disclosure of the record would reveal the actual substance of the deliberations of the meeting

 

[Orders M-64, M-102, MO-1248]

 

Under part 3 of the test

 

•                     “deliberations” refer to discussions conducted with a view towards making a decision [Order M-184]

 

•                     “substance” generally means more than just the subject of the meeting [Orders M-703, MO-1344]

 

Section 6(1)(b) is not intended to protect records merely because they refer to matters discussed at a closed meeting.  For example, it has been found not to apply to the names of individuals attending meetings, and the dates, times and locations of meetings [Order MO-1344].

 

The City submits that all three parts of the test for the application of section 6(1)(b) have been met and that the exception at section 6(2)(b) does not apply in the circumstances of this appeal.  The representations provided by the appellants do not appear to dispute that a meeting of Council took place.  However, their representations question the City’s position that disclosure of the records would reveal the substance of deliberations of Council. 

 

As noted above, one of the appellants claims that the exception at section 6(2)(b) applies in the circumstances of this appeal.  This appellant submits that “the subject matter of the record was presented at a meeting open to the public”.  Section 6(2)(b) of the Act provides that an institution shall not refuse to disclose a record if the subject matter of the deliberations has been considered in a meeting open to the public.  For the exception at section 6(2)(b) to apply, it must be shown that the subject matter of the deliberations was considered in a meeting open to the public.  In my view, evidence that the audit report was mentioned at an open meeting does not demonstrate that the subject matter of the deliberations was considered in an open meeting.  Accordingly, I find that the exception at section 6(2)(b) has no application in this appeal. 

 

I will now consider each part of the three part test to determine whether section 6(1)(b) applies to the records.

 

Part 1 – meeting or council, board, commission or other body, or a committee of one of them

 

The City states that Council held a meeting on June 14, 2007.  In support of its position, the City provided a copy of an extract from the Special Council Meetings Minutes which indicate that Council resolved into the Committee of the Whole (Closed Session) on June 14, 2007.  The confidential portions of the City’s representations attached a copy of the Closed Session Minutes for the June 14, 2007 meeting. 

 

Having regard to the above, I am satisfied that on June 14, 2007 a meeting of Council took place.  Accordingly, I find that part one of the test has been met.

 

Part 2 – statute authorizes the holding of the meeting in the absence of the public

 

The City submits that the meeting was held in camera in accordance with section 239(2)(b) of the Municipal Act.  Section 239(2)(b) reads:

 

A meeting or part of a meeting may be closed to the public if the subject matter being considered is personal matters about an identifiable individual, including municipal or local board employees

 

The extract from the Special Council Meetings Minutes attached to the City’s representations states that Council resolved into the Committee of the Whole for the purpose of discussing “personal matters about an identifiable individual, including municipal or local board employees.”  As noted above, the confidential portions of the City’s representations included a copy of the in-camera minutes of the June 14, 2007 meeting.

 

In Order MO-2237, Assistant Commissioner Brian Beamish stated that institutions cannot properly rely on the statutory provisions which enable them to hold a close meeting if those present at the meeting had no intention of discussing or reviewing the substance of the issues.

 

Though I am satisfied that section 239(2)(b) of the Municipal Act authorizes the City to hold closed meetings to discuss personal matters about identifiable individuals, including municipal or local board employees, I find that the City has failed to provide me with sufficient evidence supporting their position that “personal matters” relating to the records were discussed at the meeting.  In particular, the City’s representations, including the confidential portions, failed to specify what “personal matters” were discussed at the closed meeting.  Accordingly, I find that the City has failed to satisfy the second part of the test.  Although it is not necessary to do so, I have also considered whether the third part of the test has been met.

 

Part 3 – disclosure of the record would reveal the actual substance of the deliberations of the meeting

In support of its position that disclosure of the records would reveal the actual substance of the deliberation of the closed session, the City states:

 

It is the City of Vaughan’s position that disclosure of the report dealing with personal matters about an identifiable individual, including municipal or local board employees would reveal the substance of deliberations at that meeting, because the report was the subject matter of the meeting, or part therefore, and it was discussed in its entirety and in detail at the meeting.  The duration of the meeting was 1 hour and 26 minutes.  The extract from Special Council Meetings Minutes (2) June 14, 2007 indicates “that the confidential recommendation of the Committee of the Whole (Closed Session) of June 14, 2007, be approved”.  The substance of the matter was not discussed in a meeting open to the public. 

 

The representations provided by the appellants question the City’s position that disclosure of the records would reveal the “substance of deliberations” taking place at the closed meeting.  One of the appellants submits that the audit report could not contain information which, if disclosed, would reveal the deliberations of the closed meeting as the report was prepared before the meeting took place.  This appellant’s position is that the report “probably does not contain recommendations, only findings” and that “… the deliberations are not [the] request nor are they required.  If decisions were made on the report, these decisions are quite distinct from the report itself”. 

 

Under part 3 of the test it must be shown that disclosure of the record would reveal the actual substance of the deliberations of the meeting.  As noted above, “deliberations” refer to discussions conducted with a view towards making a decision and “substance” generally means more than just the subject of the meeting.

 

The City submits that the records were discussed in a closed meeting and that the meeting was not held in public so that Council could discuss “personal matters”.  Accordingly, I reviewed the records at issue along with the closed meeting minutes provided by the City to determine whether part 3 of the test has been met.  In my view, the City failed to adduce sufficient evidence in support of its position that disclosure of the records would either reveal the substance of deliberations or reveal any discussion that took place in closed session.  In making my decision, I note that the audit and summary reports contain information gathered by the audit team in the course of their investigation and does not record any information relating to any decisions or discussions that took place at the closed meeting session.  Accordingly, I find that part 3 of the test has not been met.  As a result, the records do not qualify for exemption under sections 6(1)(b) and/or 38(a) of the Act.

 

As the City has also claimed that the records are exempt under the personal privacy provisions of the Act, I must go on to consider whether disclosure of the records would constitute an unjustified invasion of personal privacy under section 14(1) and/or 38(b) of the Act.  However, first I must determine whether the records contain “personal information” as described in the definition of that term in section 2(1) of the Act.

 

PERSONAL INFORMATION

 

In order to determine whether section 14(1) and/or 38(b) of the Act may apply, it is necessary to decide whether the records contain “personal information” and, if so, to whom it relates.  The City claims that the records contain the “personal information” of identifiable individuals as described in paragraph (b) and (g) of the definition in section 2(1) of the Act.  That term is defined, in part, in section 2(1) as follows:

 

“personal information” means recorded information about an identifiable individual, including,

 

(b)      information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

 

(g)      the views or opinions of another individual about the individual, and

 

(h)      the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

 

The list of examples of personal information under section 2(1) is not exhaustive.  Therefore, information that does not fall under paragraphs (a) to (h) may still qualify as personal information [Order 11].

 

To qualify as personal information, the information must be about the individual in a personal capacity.  As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be “about” the individual [Orders P-257, P-427,
P-1412, P-1621, R-980015, MO-1550-F, PO-2225].

 

Even if information relates to an individual in a professional, official or business capacity, it may still qualify as personal information if the information reveals something of a personal nature about the individual [Orders P-1409, R-980015, PO-2225].

 

Effective April 1, 2007, the Act was amended by adding sections 2.1 and 2.2.  These amendments apply only to appeals involving requests that were received by institutions after that date.  All of the requests relating to the City’s decision to deny access to the audit report and related records were filed after April 1, 2007.

 

Section 2.1 modifies the definition of the term “personal information” by excluding an individual’s name, title, contact information or designation which identifies that individual in a “business, professional or official capacity”.  Section 2.2 further clarifies that contact information about an individual who carries out business, professional or official responsibilities from their dwelling does not qualify as “personal information” for the purposes of the definition in section 2(1). 

 

To qualify as personal information, it must be reasonable to expect that an individual may be identified if the information is disclosed [Order PO-1880, upheld on judicial review in Ontario (Attorney General) v. Pascoe, [2002] O.J. No. 4300 (C.A.)].

 

Representations of the parties

 

The City submits that the information contained in the report constitutes the “personal information” of identifiable individuals and states:

 

The record at issue in this appeal being the Deloitte and Touche report concerning the e-mail disclosures contains personal information as defined under section 2(1)(b) and (g) of the Act.  The record contains the name of some City of Vaughan residents.  No other personal information is attached to the names of these Vaughan residents.  The record contains their personal information, being who they communicated with.  In one instance the record reveals email habits personal to the individual.

 

The record also contains the names of the former Mayor, of a Regional Councillor (being the current Mayor), the Mayor’s Executive Assistant, various City Commissioners and various Information Technology Department staff.  The record contains the personal information of several City of Vaughan employees, namely, their name, employment history and information relating to their views of another individual about the individual.

 

Even if it is determined that the information relates to these identifiable City employees in a professional capacity, it is the City of Vaughan’s position that this information still qualifies as personal information as the information reveals something of a personal nature about the individuals.  One of the purposes of the report was to attempt to determine if and how [the] emails were accessed from the Vaughan servers.  The record contains the comments and observations made by some City employees that relate to other identifiable individuals.

 

…

 

These individuals are identified by name and position.  The Vaughan residents are identified by name.  It is reasonable to assume that these Vaughan residents can be identified if this record is disclosed. 

 

The appellants submit that:

 

• the definition of “personal information” does not include “who” an individual has communicated with as falling within the definition;

 

• the individuals named in the record appear only in a professional capacity.  While the report may contain views of some individuals of another individual, these remarks are made in a professional capacity;

 

• the subject of the audit was not in relation to an individual’s personal capacity, such as mileage claims incurred in their professional capacity.  Accordingly, the record does not reveal information of a personal nature; and

 

• the information gathered in the report relates to employees and their actions in the course of their employment.

 

Decision and Analysis

 

As noted above, the records at issue consist of an audit report, summary report and letter of engagement.  The City’s position is that all of the information contained in the records relating to individuals qualifies as “personal information” for the purposes of section 2(1) of the Act.  In my view, the information contained in the records fall under two categories:

 

1.      Information relating to individuals not employed by the City; and

2.      Information relating to individuals employed by the City or audit team.

 

I will first consider whether the information relating to individuals not employed by the City meets the definition of “personal information” and then will go on to consider the information relating to individuals employed by the City or audit team.  For the purposes of this order, the term “employees” will refer to individuals employed by the City, as well as its elected officials.

 

 

Information relating to individuals not employed by the City.

 

The information relating to four individuals not employed by the City is contained in the summary and audit reports.  Three of these individuals are identified as having exchanged emails with the Mayor.  Also identified is the subject heading of the email(s) each individual exchanged with the Mayor. I was not provided with any evidence that the subject of the emails could be described as forming part of these individuals’ “business, professional or official capacity” as opposed to their personal capacity.   Having regard to the records themselves, I am satisfied that the names of the three individuals identified as having exchanged emails with the Mayor, including the subject headings of the emails, constitutes their “personal information” as described in the definition of that term in section 2(1) of the Act.  Accordingly, I find that the information relating to these individuals comprising of their name along with other personal information qualifies as “personal information” within paragraph (h) of the definition in section 2(1). 

 

The other individual identified in the summary and audit report is the reporter who received a copy of the Mayor’s emails.  I am not satisfied that the information contained in the records relating to the reporter constitutes his “personal information” as the information is associated with him in his professional capacity and does not reveal something of a personal nature about him.  Only personal information qualifies for exemption under sections 14(1) and/or 38(b) of the Act.  Accordingly, these exemptions have no application to the information relating to the reporter.  The City has not claimed that any other exemption applies to this information.  Accordingly, I will order the City to disclose the portions of the records which identify the reporter.

 

Information relating to individuals employed by the City or audit team

 

As previously noted, the letter of engagement sets out the audit team’s understanding of the work to be completed and their proposed fees.  Several individuals employed by the City and the audit team are identified, by name along with their job position.  I am satisfied that the names of these individuals and any information relating to them contained in the letter of engagement relates to their business, professional or official capacity as opposed to some personal capacity.  As noted above, effective April 1, 2007, the Act was amended by adding section 2.1 which modified the definition of the term “personal information” by excluding an individual’s name, title, contact information or designation which identifies that individual in a “business, professional or official capacity”.  All of the requests relating to this appeal were filed after April 1, 2007.  In my view, the information identifying individuals in the letter of engagement does not qualify as “personal information” within the meaning of the definition in section 2(1).  Accordingly, the exemption at section 14(1) and/or 38(b) can not apply to this information.  As the City has not claimed that any other exemptions apply to the letter of engagement, I will order the City to disclose a copy of the letter, in its entirety, to the appellants.

 

Turning now to the information contained in the summary and audit reports.  The City submits that the information contained in these records relating to its employees constitute their employment history or contains personal information relating to their views about other employees.  The City’s position is that any information provided by its employees to the audit team qualifies as personal information as the purpose of the audit was to determine how and if the emails were accessed from the City’s servers.  As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be “about” the individual [Orders P-257, P-427, P-1412, P-1621, R-980015, MO-1550-F, PO-2225].  Following the analysis set forth in Order PO-2225 the first question I must ask is: “in what context do the names of the individuals appear”?  The second question I must ask: "is there something about the particular information at issue that, if disclosed, would reveal something of a personal nature about the individual"?  Even if the information appears in a business context, would its disclosure reveal something that is inherently personal in nature?

 

With respect to the first question, I am satisfied that the information contained in the summary and audit reports relates to these individuals in a professional or business context only.  As already stated, the records were prepared by the audit team as a result of their investigation into how and if the emails in question were accessed from the City’s servers.  In my view, the information gathered and prepared by the audit team relates to a professional or business context.  As a result of my finding, the next question I must ask is there something particular about this information that if disclosed, would reveal something of a personal nature about the individuals.

 

Previous orders of this office have held that information about an individual in his or her professional or employment capacity does not constitute that individual’s personal information where the information relates to their employment responsibilities or position unless the information about the individual involves an evaluation of his or her performance as an employee or an investigation into his or her conduct. (Order MO-2197) 

 

Having regard to the representations of the parties and the records themselves, I am of the view that the only the portions of the records, if disclosed would reveal something of a personal nature about an individual employed by the City, is the information which refers to an individual’s
e-mail habits, vacation or lawyer or reveals the audit team’s comments about some employees.

 

With respect to the information referring to the email habits of an individual, though the habits described relate to the individual’s use of one of the City’s computers, I am satisfied that the email habits of this individual are described in such a manner as to reveal something of a personal nature about this individual.  Accordingly, I find that this information meets paragraph (h) of the definition of “personal information”. 

 

I am also satisfied that disclosure of the portions of the records which identify an employee’s lawyer or describes where and for how long another employee went on vacation would reveal something of a personal nature about these individuals.  Accordingly, I am satisfied that this information qualifies as “personal information” under paragraph (h) of the definition of that term.

 

Finally, I am satisfied that the audit team’s comments about some individuals employed by the City, if disclosed, would reveal something of a personal nature about these individuals.  In making my decision, I considered whether the audit team’s comments and the information they relied upon to form their opinion would reveal something of a personal nature about the employees in question.  In Order P-1023, Adjudicator Laurel Cropley ordered partial disclosure of the draft and final reports of a quality assessment review of the Ministry of Health’s Audit Branch.  The Ministry of Health submitted that disclosure of the record would constitute an unjustified invasion of privacy although the reports did not refer to individual’s names but their job position.  In that Order Adjudicator Cropley stated:

 

Any audit of a government department will likely impact on the individuals working in that department, either favourably or unfavourably.  In these situations, an employee cannot expect to maintain complete anonymity with respect to the results of this kind of review.

 

In my view, the extent to which a record describing the audit results can be found to contain the personal information of an individual depends on the focus of the audit and the nature of the information pertaining to the individual, which has been included in the audit results.

 

I have reviewed the records.  In most cases, the comments contained in the records relate to the organization of the Branch and reflect on the quality of work produced by the Branch in general.  In my view, although this may reflect, in a general sense, on the performance of individuals within the department, this does not constitute the personal information of any particular individual employed in the Branch.  I find, therefore, that these portions of the records do not qualify as personal information.  Because the invasion of privacy exemption only applies to exempt personal information from disclosure, it follows that this section is not applicable to exempt this information from disclosure.  To disclose such information would not constitute an unjustified invasion of personal privacy.

 

In some cases, however, the comments in the records appear to be directed at the individual holding the position referred to in the records and reflect the views or opinions of the auditors about this person.  These comments essentially amount to an assessment of this individual's performance. In my view, it is possible to identify the individual by reference to this position.

 

It has been established in previous orders of the Commissioner that where information contained in a record pertains to an evaluation of an employee's performance or an investigation into his or her conduct, these references are considered to be the individual's personal information.  Accordingly, I find that the portions of the records which I have highlighted in yellow, on the copies of the records sent to the Ministry, contain the personal information of the individual referred to by title. [Emphasis in Original]

 

I agree with Adjudicator Cropley’s approach and adopt it for the purposes of this order.  Accordingly, in order to determine whether the audit team’s comments and/or the information they relied upon to make their assessment would reveal something of a personal nature about the individuals in question, I must look at the focus of the audit and the nature of the information contained in the records relating to these individuals.

 

With respect to the focus of the audit, there is no dispute that the audit sought answers to the question as to how and if the Mayor’s e-mails were accessed from the City’s servers.  Having regard to the purpose of the audit, I am satisfied that the focus of the audit was not to review any employee’s conduct or performance.

 

With respect to the nature of the information contained in the records, I am satisfied that only the audit team’s comments, if disclosed, would reveal something of a personal nature of the employees in question.  It appears that the comments made by the audit team were made in support of one of their recommendations to the City.  I have carefully reviewed this portion of the records which is located in the summary report, and find that it reflects the views or opinions of the audit team about certain individuals.  In my view, disclosure of this information would reveal something of a personal nature about these employees.  Accordingly, I find that this information falls within the ambit of “personal information” as described in the definition of that term in section 2(1).  However, for the reasons stated below, I am not satisfied that the information relating to these employees, such as their name, position, views, opinions or description of any actions they took in response to the incident qualifies as “personal information”.

 

I find that the remaining information relating to individuals employed by the City, including any information the audit team may have relied upon to make their assessment does not meet the definition of “personal information”.  In my view, disclosure of this information in the absence of the audit team’s comments does not reveal something of a personal nature about individuals employed by the City.  The City’s position is that all of the information contained in the records relating to its employees forms these individual’s employment history and/or reveals information relating to their views of other employees (paragraphs (b), (g) and (h) of section 2(1)).  I disagree and find that the remaining information merely identifies individuals employed with the City by their name and describes their professional roles and day-to-day use of the City’s servers.  In several instances, the employees describe their understanding of the job duties performed by other employees.  They also describe their understanding of the City’s response to the incident including any actions they performed in the course of their employment in response to the incident.  In my view this information, whether it was gathered by the individual directly or by one of their co-workers, does not reveal something about a personal nature about the individual as it relates primarily to their professional role as an employee of the City.  Further, any opinions these individuals may have shared with the audit team appear to have been given in their professional capacity and cannot be described as “personal information”. (Order P-1409)

 

With respect to the information relating to the City’s Information Technology staff, it appears that the entire team was interviewed and asked to share their views, if any, about how the emails ended up in the public domain and their recollection of the incident.  As a result, some of the information contained in the summary and audit reports refer to their thoughts and views about what happened.  Again, those interviewed describe their understanding of the City’s response including any actions they performed in the course of their employment in response to the incident.  The City submits that this information qualifies as “personal information” as the purpose of the collection of the information was to determine how and if the e-mails were accessed from the City’s servers.  In my view, this information relates solely to the individual’s expertise.  As a member of the City’s Information Technology department, these individuals have expert knowledge relating to the City’s servers.  Accordingly, the audit team sought their opinions as to how the e-mails could have been accessed.  It was also the audit team’s responsibility to gather information as to what steps where taken by the City after the incident.  I find that this information relates solely to these individual’s professional, official or business capacity and thus does not qualify as their “personal information”.

 

In summary, I find that the following information contained in the summary and audit reports, including the charts attached to the audit report, constitutes “personal information” as described in the definition of that term in section 2(1) of the Act:

 

• Information identifying three individuals, not employed by the City, indicated as having exchanged emails with the Mayor, including the subject headings of these e-mails;
• The audit team’s comments about some employees;
• The  details of an employee’s vacation;
• Information relating to the e-mail habits of an employee; and
• The identity of an employee’s legal representative.

 

As stated above, the exemptions at sections 14(1) and/or 38(b) can only apply to “personal information”. Since the City has not claimed that further exemptions apply to the remaining information, I will order the City to disclose the information I found does not constitute “personal information” to the appellants.    

 

Do the records contain the personal information of the appellants?

 

As identified above, there are five different appellants in these five joined appeals.  Four of these appellants are not identified in the records at issue.  In my view, their personal information is not contained in the records.  Accordingly, for those four appeals, I will review whether the disclosure of the personal information relating to other individuals qualifies for exemption under section 14(1) of the Act.

 

However, the fifth appellant is identified in some portions of the records, and is in fact one of the individuals whose personal information is contained in the records.  As a result, with respect to this requester’s appeal, I will review whether the disclosure of the personal information relating to other individuals qualifies for exemption under section 38(b) of the Act.  As previously stated, section 38(b) of the Act recognizes the special nature of requests for one’s own personal information and the desire of the legislature to give institutions the power to grant requesters access to their personal information.

 

PERSONAL PRIVACY

 

General Principles

 

Section 36(1) of the Act gives individuals a general right of access to their own personal information held by an institution.  Section 38 provides a number of exemptions from this right.  Under section 38(b), where a record contains personal information of both the requester and another individual, and disclosure of the information would constitute an “unjustified invasion” of the other individual’s personal privacy, the institution may refuse to disclose that information to the requester.

 

If the information falls within the scope of section 38(b), that does not end the matter.  Despite this finding, the institution may exercise its discretion to disclose the information to the requester.  This involves a weighing of the requester’s right of access to his or her own personal information against the other individual’s right to protection of their privacy.  

 

Under section 14, where a record contains personal information only of an individual other than the requester, the institution must refuse to disclose that information unless disclosure would not constitute an “unjustified invasion of personal privacy”.

 

In both these situations, sections 14(1) to (4) provide guidance in determining whether the unjustified invasion of personal privacy threshold is met.

 

Sections 14(1)(a), (b), (c),  (d)

 

Sections 14(1)(a) through (e) provides exceptions to the personal privacy exemption; if any of these exceptions apply, the information cannot be exempt from disclosure under section 14(1) and/or 38(b).

 

One of the appellants claims that the exceptions at sections 14(1)(a), (b), (c) and (d) apply to the circumstances of this appeal.  All of the appellants claim that the exception at section 14(1)(f) applies.  These sections read:

 

A head shall refuse to disclose personal information to any person other than the individual to whom the information relates except,

 

(a)        upon the prior written request or consent of the individual, if the record is one to which the individual is entitled to have access;

 

(b)        in compelling circumstances affecting the health or safety of an individual, if upon disclosure notification thereof is mailed to the last known address of the individual to whom the information relates;

 

(c)        personal information collected and maintained specifically for the purpose of creating a record available to the general public;

 

(d)       under an Act of Ontario or Canada that expressly authorizes the disclosure;

 

(f)        if the disclosure does not constitute an unjustified invasion of personal privacy.

 

In my view, section 14(1)(a) does not apply to the circumstances of this appeal.  In making my decision, I note that I was not provided with any evidence demonstrating that any of the individuals named in the records consented to the release of information I found qualifies as “personal information”.  In fact, in her representations, the appellant who raised this exception advises that, to her knowledge, none of the individuals identified in the records have consented to the release of their information. 

 

With respect to section 14(1)(b), my view is that this section speaks to compelling circumstances where the health or safety of an individual is at risk unless that individual is notified of the existence of certain information.  The representations of the appellant who raised the possible application of section 14(1)(b) do not provide evidence demonstrating that the health and safety of an individual is at risk unless that same individual is notified of the existence of the information at issue.  Accordingly, I find that section 14(1)(b) does not apply to the circumstances of this appeal. 

 

Turning now to section 14(1)(c), one of the appellants submits that the audit report was “specifically created for the purposes of examining the highly publicized breach of an email system that contains data belonging to the public.”  For section 14(1)(c) to apply to the circumstances of this appeal, there must be evidence that the personal information at issue was collected and maintained for the specific purpose of making it available to the public.  In this regard, the appellant failed to provide evidence demonstrating that the records at issue are publicly available or were specifically created and maintained for the purpose of creating a record that is available to the public.  As a result, I find that section 14(1)(c) has no application to this appeal.

 

Finally, the phrase “under an Act of Ontario or Canada that expressly authorizes the disclosure” in section 14(1)(d) closely mirrors the phrase “expressly authorized by statute” in section 28(2) of the Act, which is the equivalent of section 38(2) of the Freedom of Information and Protection of Privacy Act (the provincial Act) [Order PO-1933].  This office has stated the following with respect to the latter phrase in section 38(2) of the provincial Act:

 

The phrase “expressly authorized by statute” in subsection 38(2) of the Act requires either that specific types of personal information be expressly described in the statute, or a general reference to the activity be set out in the statute, together with a specific reference to the personal information to be collected in a regulation made under the statute i.e, in a form or in the text of the regulation [Compliance Investigation Report I90-29P].

 

For the exception at section 14(1)(d) to apply, there must be evidence that an Act of Ontario and/or Canada expressly authorizes disclosure of the personal information at issue in this appeal.  The appellant argues that the duties and responsibilities of council, officers and employees pursuant under the Municipal Act expressly authorizes the disclosure of the information at issue to “ensure accountability and transparency of operations”.  I have carefully reviewed the provisions of the Municipal Act referred to by the appellant and find that they do not expressly authorize the disclosure of the personal information at issue.  Accordingly, I find that sections 14(1)(d) does not apply in the circumstances of this appeal.

 

For the reasons stated above, I find that the exceptions at sections 14(1)(a), (b), (c) and (d) have no application to the circumstances of this appeal.  In my view, the only exception that could apply to this appeal is that found at section 14(1)(f) (disclosure does not constitute an unjustified invasion of privacy).  Accordingly, I will go on to determine whether the information at issue qualifies for exception to the general prohibition against disclosure in section 14(1) under section 14(1)(f) of the Act.

 

Section 14(1)(f): disclosure not an unjustified invasion of personal privacy

 

The factors and presumptions in sections 14(2), (3) and (4) help in determining whether disclosure would or would not be an unjustified invasion of personal privacy under section 14(1)(f).  Section 14(2) provides some criteria for determining whether the personal privacy exemption applies.  Section 14(3) lists the types of information whose disclosure is presumed to constitute an unjustified invasion of personal privacy.  Section 14(4) lists the types of information whose disclosure does not constitute an unjustified invasion of personal privacy.  None of the parties claim that the exclusions in section 14(4) apply in the circumstances of this appeal and I am satisfied that none apply.

 

If any of paragraphs (a) to (h) of section 14(3) apply, disclosure of the information is presumed to be an unjustified invasion of personal privacy under section 14. Once established, a presumed unjustified invasion of personal privacy under section 14(3) can only be overcome if section 14(4) or the “public interest override” at section 16 applies. [John Doe v. Ontario (Information and Privacy Commissioner) (1993), 13 O.R. (3d) 767].  If a presumed unjustified invasion of personal privacy is established under section 14(3), it cannot be rebutted by one or more factors or circumstances under section 14(2) [John Doe, cited above].  The City claims that the presumptions at sections 14(3) (d) and (g) apply to this appeal.

 

If no section 14(3) presumption applies, section 14(2) lists various factors that may be relevant in determining whether disclosure of personal information would constitute an unjustified invasion of personal privacy [Order P-239].  The City claims that the factors favouring non-disclosure at sections 14(2)(e), (f), (h) and (i) apply in the circumstances of this appeal.  The appellants claim that the factors favouring disclosure at sections 14(2)(a) and (d)  apply.

 

Section 14(3): presumptions

 

The City argues that the presumptions at sections 14(3)(d) and (g) apply to the personal information at issue in the records.  These sections read:

 

A disclosure of personal information is presumed to constitute an unjustified invasion of personal privacy if the personal information,

 

(d)       relates to employment or educational history;

 

(g)        consists of personal recommendations or evaluations, character references or personnel evaluations;

 

The appellants argue that the presumptions at sections 14(3)(d) and (g) do not apply to the circumstances of this appeal.  In support of its position that the presumptions at sections 14(3)(d) and (g) of the Act apply, the City repeats its submission that the records contain the “personal information” of every individual identified in the records.  However, I found that only some of the information identifying individuals contained in the summary and audit report qualifies as “personal information”.

 

In my view, the only personal information at issue that could be subject to the presumptions in sections 14(3)(d) and (g) is the information relating to an employee’s email habits and the audit team’s comments about some individuals.  The remaining personal information either does not relate to an individual employed by the City or relates to an employee’s vacation or lawyer.

 

For the presumption at section 14(3)(d) to apply the City has to demonstrate that this information forms part of the identifiable individual’s employment history with the City.  Previous orders of this office have found that information relating to a single event is insufficient to constitute “history”, while information about a series of events that occur during one’s employment may constitute “history” for the purposes of section 14(3)(d) (Order PO-2711).  Accordingly, whether this presumption applies to this information will turn on whether the information could be said to constitute the individual’s employment history with the City, as opposed to describing a single event.  There is no dispute among the parties that the audit was conducted to determine how and if the Mayor’s e-mails were accessed from the City’s servers or that the audit relates to a single incident.  In my view, there is no evidence before me which supports a position that information relating to an employee’s e-mail habits or the audit team’s comments describes a series of events making up these individuals’ work history at the City.  Having regard to the above, I find this information does not form part of an individual’s work history and as a result the presumption at section 14(3)(d) of the Act does not apply to this information.

 

Turning now to the presumption at section 14(3)(g), the terms “personal evaluations” or “personnel evaluations” refer to assessments made according to measurable standards [Order PO-1756].  Section 14(3)(g) creates a presumption concerning recommendations, evaluations or references about the identified individual in question rather than evaluations, etc., by that individual [Order P-171].  Having carefully reviewed the records, I am not satisfied that the personal information contained in the records which refers to individual’s email habits or the audit team’s comments amount to personal recommendations, evaluations, character references or personnel evaluations.  In making my decision, I note that the information relating to the email habits of an employee and the comments of the audit team do not refer to assessments made according to measurable standards.  For the reasons stated above, I find that section 14(3)(g) does not apply to the information at issue.

 

As I have found that the presumptions at section 14(3)(d) and (g) have no application, I must go on to consider the factors favouring disclosure and non-disclosure.

 

 

 

 

Section 14(2): factors and considerations

 

If no section 14(3) presumption applies, section 14(2) lists various factors that may be relevant in determining whether disclosure of personal information would constitute an unjustified invasion of personal privacy [Order P-239]. 

 

The list of factors under section 14(2) is not exhaustive.  The institution must also consider any circumstances that are relevant, even if they are not listed under section 14(2) [Order P-99].

 

As noted above, the City claims that the factors favouring non-disclosure at paragraphs (e), (f), (h) and (i) apply in the circumstances of this appeal and the appellants claim that the factors favouring disclosure at sections 14(2)(a) and (d)  apply.  These sections read:

 

A head, in determining whether a disclosure of personal information constitutes an unjustified invasion of personal privacy, shall consider all the relevant circumstances, including whether,

 

(a)        the disclosure is desirable for the purpose of subjecting the activities of the institution to public scrutiny;

 

(d)       the personal information is relevant to a fair determination of rights affecting the person who made the request;

 

(e)        the individual to whom the information relates will be exposed unfairly to pecuniary or other harm;

 

(f)        the personal information is highly sensitive;

 

(h)        the personal information has been supplied by the individual to whom the information relates in confidence;

 

(i)         the disclosure may unfairly damage the reputation of any person referred to in the record.

 

14(2)(a):  public scrutiny

 

The City argues that disclosure of the personal information at issue is not desirable for the purposes of subjecting its activities to public scrutiny.  In support of its position, the City submits that the records do not consider the expenditure of public funds or public health and safety issues. 

 

The three appellants submitting representations agree that the factor at section 14(2)(a) of the Act applies to the circumstances of this appeal.  They submit that disclosure of the withheld records at issue would enable them to scrutinize the City’s response to allegations that its email system was compromised.  I am satisfied that the appellants have demonstrated that disclosure of information about the City’s review of its email system would serve to inform the public about the City’s activities and that there is a public demand for this information.  However, I am not satisfied that disclosure of the remaining personal information at issue would serve the purpose of subjecting the City’s activities to public scrutiny.  In my view, the information I will order the City to disclose to the appellants, including the terms of the audit team’s retainer set out in the letter of engagement and the audit team’s recommendations, already meets this purpose.  As a result, disclosure of this information will place the appellants in a position to better scrutinize the activities of the City in the manner in which it responded to the incident. 

 

Accordingly, I find that disclosure of the information I found constitutes the “personal information” of identifiable individuals would not meet the purpose of section 14(2)(a).  Accordingly, I find that this section has no application to the personal information at issue.

 

14(2)(d):  fair determination of rights

 

For section 14(2)(d) to apply, it must be establish that:

 

(1)        the right in question is a legal right which is drawn from the concepts of common law or statute law, as opposed to a non-legal right based solely on moral or ethical grounds; and

 

(2)        the right is related to a proceeding which is either existing or contemplated, not one which has already been completed; and

 

(3)        the personal information which the appellant is seeking access to has some bearing on or is significant to the determination of the right in question; and

 

(4)        the personal information is required in order to prepare for the proceeding or to ensure an impartial hearing

 

[Order PO-1764; see also Order P-312, upheld on judicial review in Ontario (Minister of Government Services) v. Ontario (Information and Privacy Commissioner) (February 11, 1994), Toronto Doc. 839329 (Ont. Div. Ct.)].

 

Two of the three appellants submitting representations take the position that the factor at section 14(2)(d) applies to the facts of this appeal.  One appellant makes reference to section 296(1) of the Municipal Act which sets out the City’s financial administration responsibilities.  However, the appellant did not provide submissions explaining how the City’s responsibilities under the Municipal Act support his position that the factor at section 14(2)(d) applies to the information at issue.

 

The only reference made in the appellants’ representations to a legal proceeding is the submission of one of the appellants that two individuals may be in a position to seek legal remedies against the City in relation to the circumstances arising from the audit.  However, the potential legal proceedings identified by this appellant do not concern her.  Accordingly, there is no evidence before me that the individuals making the request require the personal information at issue in order to prepare for a legal proceeding or ensure an impartial hearing.

 

In my view, the representations provided to me by the appellants fail to demonstrate that they are seeking access to the information to enforce a legal, as opposed to a non-legal right, and that the right is related to a proceeding which is either existing or contemplated, but not completed.  Finally, there is no evidence that the personal information at issue has some bearing on or is significant to the determination of the right in question.

 

Having regard to the above, I find that the factor at section 14(2)(d) has no application to the present appeal.

 

14(2)(e) and 14(2)(i):  pecuniary or other harm or unfair damage to reputation

 

The City takes the position that disclosure of the personal information at issue may taint the reputations of some individuals identified in the records.  In support of its position, the City argues that disclosure of the records would subject the individuals identified in the report to “further media scrutiny” which would result in further harm resulting in “significant personal distress”. 

 

For section 14(2)(e) to apply, the City must demonstrate that disclosure of the information at issue would result in the harm contemplated and explain why the harm would be unfair.  Similarly, for section 14(2)(i) to apply, the City must establish that disclosure may damage the reputation of the individual named in the record and explain why the damage would be unfair.

 

In my view, the City failed to adduce sufficient evidence in support of its position.  In particular, the City did not specify which individuals would face harm to their reputations or explain how this harm would be unfair under the circumstances.

 

Accordingly, I find that the factors at sections 14(2)(e) and (i) have no application in this appeal.

 

14(2)(f):  highly sensitive

 

To be considered highly sensitive, it must be found that disclosure of the personal information could reasonably be expected to cause significant personal distress to the subject individual [Order PO-2518].  Arguably, this factor is broader than the factors at sections 14(2)(e) and 14(2)(i)  (pecuniary or other harm or unfair damage to reputation) in that it does not require the City to explain how the contemplated harm would be unfair. 

 

In support of its position that the factor at section 14(2)(f) applies to the information at issue, the City, in its reply representations, states:

 

The media has reported on the events that relate to this record… Disclosure of this record could damage the reputation of some of the named City employees, the identifiable individual and the named Vaughan residents.  The named City employees, the identifiable individual and the named Vaughan residents could be subject to further media scrutiny.  Therefore, disclosure could reasonably be expected to cause significant personal distress to the named City employees, the identifiable individual and the named Vaughan residents.

 

Two of the three appellants providing representations submit that the factor at section 14(2)(f) does not apply to the records.  They argue that the factor at section 14(2)(f) cannot apply as the information relating to individuals contained in the record relates to these individuals in their professional, rather than their personal capacity.  However, I found that the following information contained in the summary and audit reports qualifies as “personal information”:

 

• Information identifying three individuals, not employed by the City, identified as having exchanged emails with the Mayor, including the subject headings of these e-mails;
• The audit team’s comments about some employees;
• The  details of an employee’s vacation;
• Information relating to the e-mail habits of an employee; and
• The identity of an employee’s legal representative.

 

I have carefully reviewed the records themselves along with the representations of the parties and am satisfied that disclosure of the above-referenced personal information to other individuals could reasonably be expected to cause significant personal distress to the subject individuals, as contemplated by section 14(2)(f).

 

With respect to the personal information relating to the three individuals identified as having exchanged emails with the Mayor and who are not employed by the City, I am satisfied that the information contained in the records relating to these individuals is highly sensitive given the circumstances leading to the City’s decision to retain the audit team to conduct a review of its email systems.  These individuals are identified in the records as a result of copies of emails between themselves and the Mayor landing on the doorstep of the former mayor during a recent municipal election.  Under the circumstances, I am satisfied that disclosure of their names, along with information describing the subject-heading of their e-mails, could reasonably be expected to cause these individuals significant personal distress if disclosed to other individuals.

 

Turning now to the information relating to the individuals employed by the City. As noted above, I found that the information relating to these individual(s) reveals something about a personal nature about them, though it also relates to them in their professional capacity.  Namely, the information which identifies an individual’s email habits, vacation or lawyer or reveals the audit team’s comments about some employees.  I have carefully reviewed this information and I am satisfied that the information relating to these individuals, if disclosed to other individuals, taking into consideration the continued media and community interest surrounding the incident, could reasonably be expected to cause these individuals significant personal distress. 

 

Accordingly, I find that the factor at section 14(2)(f) applies to the personal information at issue and give it significant weight in balancing the individuals’ privacy rights against the appellants’ right of access.  Having found that none of the factors raised by the appellants apply to the information at issue, it is not necessary for me to determine whether the factor at section 14(2)(h) (personal information has been supplied by the individual to whom the information relates in confidence) favouring non-disclosure also applies to the information.  In any event, the only personal information the factor at section 14(2)(h) could be subject to is the information which refers to an individual’s email habits and vacation as the remaining personal information at issue was not supplied by the individual to whom the information relates. 

 

Taking into consideration the factor at section 14(2)(f), I am satisfied that disclosure of the  personal information at issue to other individuals would constitute an unjustified invasion of personal privacy.

 

Findings

 

As identified above, there are five different appellants in these five joined appeals. 

 

For the four appellants whose personal information is not contained in the records, I find that the disclosure of the personal information at issue would constitute an unjustified invasion of personal privacy, and is exempt under section 14(1) of the Act.

 

For the fifth appellant, whose personal information is contained in the records, I find that the disclosure of the personal information of other individuals would constitute an unjustified invasion of personal privacy of those individuals, and is exempt under section 38(b) of the Act.  However, as identified above, some portions of the records contain the personal information of this appellant only, and I find that the disclosure of those portions of the records which contain the personal information of only this appellant would not constitute an unjustified invasion of personal privacy.  Accordingly, I will order the City to disclose to this appellant the portions of the records which contain only this appellant’s personal information.

 

For the sake of clarity, I will provide the City with two highlighted copies of the records with this order.  The first copy will indicate the portions of the records which are exempt from disclosure to be sent to the four appellants whose personal information is not contained in the records.  The second copy will indicate the portions of the records which are exempt from disclosure to be sent to the fifth appellant. 

 

PUBLIC INTEREST OVERRIDE

 

As noted above, one of the appellants raised the possible application of the public interest override at section 16 during mediation.  This appellant however did not provide representations in support of his position.  Section 16 reads:

 

An exemption from disclosure of a record under sections 7, 9, 10, 11, 13 and 14 does not apply where a compelling public interest in the disclosure of the record clearly outweighs the purpose of the exemption.

 

The City submits that the public interest override at section 16 has no application to the records.

 

For section 16 to apply, two requirements must be met.  First, there must be a compelling public interest in disclosure of the records.  Second, this interest must clearly outweigh the purpose of the exemption.

 

In considering whether there is a “public interest” in disclosure of the record, the first question to ask is whether there is a relationship between the record and the Act’s central purpose of shedding light on the operations of government [Order P-984].  Previous orders have stated that in order to find a compelling public interest in disclosure, the information in the record must serve the purpose of informing the citizenry about the activities of their government, adding in some way to the information the public has to make effective use of the means of expressing public opinion or to make political choices [Order P-984].

 

A public interest does not exist where the interests being advanced are essentially private in nature [Orders P-12, P-347, P-1439].  Where a private interest in disclosure raises issues of a more general application, a public interest may be found to exist [Order MO-1564].

 

A public interest is not automatically established where the requester is a member of the media [Orders M-773, M-1074].  The word “compelling” has been defined in previous orders as “rousing strong interest or attention” [Order P-984].  Any public interest in non-disclosure that may exist also must be considered [Ontario Hydro v. Mitchinson, [1996] O.J. No. 4636 (Div. Ct.)].

 

The existence of a compelling public interest is not sufficient to trigger disclosure under section 16.  This interest must also clearly outweigh the purpose of the established exemption claim in the specific circumstances.

 

For the same reasons I found that the factor at section 14(2)(a) of the Act has no application to the personal information remaining at issue, I find that the public interest override at section 16 also does not apply.  Though I am satisfied that the appellants’ interest in the records is not a private one, there is no evidence before me demonstrating that disclosure of the personal information I found exempt under the Act would serve the purpose of informing the public about the City’s activities, taking into account the information I will order the City to disclose to the appellants.  In my view, the information the City is to disclose to the appellants already informs the public about the City’s response to the incident.  As a result, I am not satisfied that disclosure of the remaining personal information would shed further light on the operations of the City. 

 

In any event, even if a compelling public interest in the disclosure of the information were to exist, for the section 16 override provision to apply, the compelling public interest must clearly outweigh the purpose of the personal privacy provisions of the Act.  In this case, the purpose of the exemptions at sections 14(1) and/or 38(b) is the protection of the privacy of individuals.  In my view, the interests raised by the appellants that may favour disclosure do not clearly outweigh the privacy interests of these individuals.

 

Having regard to the above, I find that the public interest override at section 16 does not apply in the circumstances of this appeal.

 

ORDER:

 

1.                  I order the City to disclose the portions of the records that I found are not exempt under the Act by January 7, 2009 but not before January 2, 2009.  For the sake of clarity, I have highlighted the portions of the records that should not be disclosed in the copies of the records enclosed with this Order.  The first copy of the records highlight the portions of the records that is to be withheld from the four appellants whose personal information is not found in the records.  The second copy of the records highlight the portions of the records that is to be withheld from the fifth appellant whose personal information is found in the records.

 

2.         I uphold the City’s decision to withhold the remaining portions of the records.

 

3.                  In order to verify compliance with this order, I reserve the right to require a copy of the information disclosed by the City pursuant to order provision 1 to be provided to me.

 

 

 

 

 

 

 

 

Original signed by:                                                                               November 28, 2008              

Jennifer James