ORDER PO-2842

 

Appeal PA08-165

 

University of Ottawa

 

BACKGROUND:

 

Created by an act of Parliament in 1977, the Social Sciences and Humanities Research Council of Canada (SSHRC) is a federal agency that promotes and supports university-based research and training on social, cultural and economic issues. According to the SSHRC website, SSHRC’s grant and fellowship programs and policies enable “knowledge sharing and collaboration across research disciplines, universities and all sectors of society.”

 

This appeal is one of several related appeals with this office, in which similar requests were submitted to Ontario universities under the Freedom of Information and Protection of Privacy Act  (the Act ). The first of the orders issued with respect to these appeals – Order PO-2836 (Wilfrid Laurier University) – was released on October 28, 2009.

 

NATURE OF THE APPEAL:

 

The requester submitted the following request under the Act  to the University of Ottawa (the University):

 

E-mail communications between, on the one hand, a member of Social Sciences and Research Council of Canada (SSHRC) Selection Committee No. 15 (2007/8 competition) from U of Ottawa [named individual and email address] and, on the other hand, SSHRC officials (their list may include but is not limited to: [four individuals’ email addresses], other members of this committee and other interlocutors in which my name … is mentioned. The period covered: October 15, 2007 – April 18, 2008. …

 

The University issued a decision letter to the requester stating that if there are any records responsive to the request, they are not in the custody or under the control of the University. The University explained that such records,

 

…pertain to activities and communications undertaken under the jurisdiction of the [SSHRC]. At the invitation of SSHRC, faculty members of the University … serve on SSHRC’s standard research grants selection committees. Therefore, all documents obtained or created by the faculty members in connection with the activities are not in the control or custody of the University… 

 

The University advised the requester that if there are any responsive records, such records would be in the custody or under the control of the SSHRC and covered under the federal  Access to Information Act  [R.S. 1985, c. A-1 ]. The University provided the requester with the name of the access to information coordinator with SSHRC.

 

The requester (now the appellant) appealed the University’s decision to this office, which appointed a mediator to try to resolve the issues between the parties. Resolution of the appeal through mediation was not possible, and it was transferred to the adjudication stage of the appeal process, where it was assigned to me to conduct an inquiry.

 

I sent a Notice of Inquiry outlining the facts and the issues to the University, initially, in order to seek representations, which I received. I also received correspondence from the appellant. Next, I sent a modified Notice of Inquiry, along with a complete copy of the University’s representations to the appellant in order to seek his submissions on the issue of custody or control, which I received.

 

In both the University’s and the appellant’s Notices of Inquiry, I stated the following:

 

A record found to be in the custody or control of an institution may or may not be subject to the Act  pursuant to section 65  of the Act  (see Orders PO-2693 and PO-2694). The question of whether records in the custody or under the control of the University are excluded from the application of Act pursuant to section 65 (including subsections 65(8.10) – 65(10)) is a matter that will be dealt with at a later stage of this inquiry, if necessary.

 

Similarly, the question of whether records in the custody or under the control of the University may contain personal information pursuant to section 21  of the Act , or be subject to another exemption, are matters that would be dealt with at a later stage of the inquiry, if necessary.

 

Upon review of the appellant’s representations, I determined that it was necessary to invite reply representations from the University. Accordingly, I sent a copy of the appellant’s non-confidential representations to the University and subsequently received its reply submissions.

 

DISCUSSION:

CUSTODY OR CONTROL

 

Section 10(1)  of the Act  identifies that the issue of whether or not a record is in the custody or under the control of an institution (in this case, the University) is the initial threshold for determining whether that record is subject to the Act . Records in the custody or under the control of the University may be exempt from disclosure, or may be excluded from the scope of the Act  under section 65 . These determinations only arise for records found to be in the University’s custody or under its control under section 10(1).

 

Section 10(1) states, in part:

 

Every person has a right of access to a record or a part of a record in the custody or under the control of an institution unless . . .

 

Under section 10(1), therefore, the Act  applies only to records that are in the custody or under the control of an institution.

 

The courts and this office have applied a broad and liberal approach to the custody or control question [Ontario (Criminal Code Review Board) v. Ontario (Information and Privacy Commissioner), [1999] O.J. No. 4072 [“Ontario (Criminal Code Review Board)”]; Canada Post Corp. v. Canada (Minister of Public Works) (1995), 30 Admin. L.R. (2d) 242 (Fed. C.A.) [“Canada Post”], and Order MO-1251].

Factors relevant to determining “custody or control”

 

Based on the above approach, this office has developed a list of factors to consider in determining whether or not a record is in the custody or control of an institution, as follows [Orders 120, MO-1251, PO-2306 and PO-2683]. The list is not intended to be exhaustive. Some of the listed factors may not apply in a specific case, while other unlisted factors may apply.

 

• Was the record created by an officer or employee of the institution? [Order P-120]

 

• What use did the creator intend to make of the record? [Orders P-120 and P-239]

 

• Does the institution have a statutory power or duty to carry out the activity that resulted in the creation of the record?  [Order P-912, upheld in Ontario (Criminal Code Review Board) v. Ontario (Information and Privacy Commissioner), above]

 

• Is the activity in question a “core”, “central” or “basic” function of the institution? [Order P-912]

 

• Does the content of the record relate to the institution’s mandate and functions? [Orders P-120 and P-239]

 

• Does the institution have physical possession of the record, either because it has been voluntarily provided by the creator or pursuant to a mandatory statutory or employment requirement? [Orders P-120 and P-239]

 

• If the institution does not have possession of the record, is it being held by an officer or employee of the institution for the purposes of his or her duties as an officer or employee? [Orders P-120 and P-239]

 

• Does the institution have a right to possession of the record? [Orders P-120 and P-239]

 

• Does the institution have the authority to regulate the record’s use and disposal?  [Orders P-120 and P-239]

 

• Are there any limits on the use to which the institution may put the record, what are those limits, and why do they apply to the record?

 

• To what extent has the institution relied upon the record? [Orders P-120 and P-239]

 

• How closely is the record integrated with other records held by the institution? [Orders P-120 and P-239]

 

• What is the customary practice of the institution and institutions similar to the institution in relation to possession or control of records of this nature, in similar circumstances? [Order MO-1251]

 

Representations

 

According to the University, there are two explanations why the records responsive to the appellant’s request are not in its custody or under its control: first, because the SSHRC is a federal agency that functions completely independently and with no connection to the University, all responsive records fall outside the University’s purview; and second, the “special nature” of the University’s email accounts system.

 

While acknowledging that the courts and this office have applied a broad and liberal approach to the issue of custody or control, the University submits that the unique circumstances, including the university context in which it arises, render this appeal distinguishable from those leading to past orders and cases such as Ontario (Criminal Code Review Board) v. Ontario (Information and Privacy Commissioner), [1999] O.J. No. 4072, and Canada Post Corp. v. Canada (Minister of Public Works) (1995), 30 Admin. L.R. (2d) 242 (Fed. C.A.).

 

With respect to SSHRC, the University provides the following submission based on information available on the SSHRC website:

 

The SSHRC is a separate entity governed by federal legislation. It is the federal entity responsible for promoting and supporting advance[d] scholarly research and research training in the Social Sciences and Humanities in Canada through grants and fellowship programs. … SSHRC obtains funds through an annual parliamentary vote and reports to Parliament through the Minister of Industry. The Council functions as an arm’s length agency and has full authority to determine its priorities, policies and programs, and to make funding decisions. … Please refer to the following website for additional information [address provided].

 

The University’s representations on the factors this office typically reviews in determining custody or control can be summarized as follows:

 

•         as a federal agency, SSHRC is subject to the federal  Access to Information Act  and the Privacy Act and the request is properly made under the federal regime;

•         as the records were created by and for the SSHRC committee in question, the use to which the creator intended to put the records is unknown to the University;

•         any activity conducted by SSHRC or any record created as a result of such activity is not related to, or the result of, any statutory power or duty of the University;

•         the University has no supervisory or managerial role over the SSHRC committee;

•         the records do not relate to the mandate of the University, but rather relate to the fulfilment of SSHRC’s mandate; and

•         the mere fact that the named professor chose to use her “@uottawa.ca” email account to communicate for SSHRC matters does not mean that these personal email communications stem from a core, central or basic function of the University.

 

The University’s representations contain a detailed history of the genesis of its email system, and the development of email in the university context more generally. The University argues that university email systems are distinct from traditional government and business institutions in purpose, use and administration. According to the University,

 

[T]he unique history and nature of [the] email system, and its integral role in the academic culture of the University, make it impossible for the University to assert custody or control over all email for all purposes. There are material technical limitations which give the email account holder a unique measure of control over their email messages that is not typically found in government or business institutions.

 

The University submits that there are approximately 50,000 “@uottawa.ca” accounts assigned to professors, administrators, students, alumni and other related third parties and these account holders use either the Exchange or Mailbox system. Regarding these two systems, the University submits:

 

The Exchange system is used by approximately 95% of staff and 25% of professors at the University. This email resides on University servers. … The University may only view or retrieve these email messages with the consent of the account holder, or if required or permitted to do so by law. Once the University provides a Professor an Exchange email account he or she has control over, and responsibility for the content of the email messages and is subject to University policy and law. The University simply provides the basic communication architecture and takes no responsibility for the content of email messages.

 

The Mailbox system is used by approximately 75% of professors and 5% of administrators. Individual Mailbox users may set up their email account such that it transfers their email messages to off campus sites (Hotmail, Yahoo, Rogers, etc.). For these people, the University never stores their email messages, the message is simply transited through the University system. The University has no technical ability to view or retrieve such messages. Presently, 13,000 of the 50,000 University email account holders use Mailbox in this way.

 

…

 

The history and broad base of users clearly demonstrates that the University has been treating email communication as multi-use since the inception of email as a communication tool. The architecture of the email systems at the University promotes communication in furtherance of the academic objectives of the University as well as communication between colleagues that may not be related to the academic mission of the University.

The University is very much like an ISP [internet service provider] in the way that it provides email to many stakeholders for varied purposes for almost 25 years.

 

Other than spam protection, the University does not filter incoming or outgoing email. The University does not retain an image of all email messages as is done by some business and government institutions.

 

The University notes that early users of email at the University found it useful for communicating with colleagues at other universities and there was no distinction made between business, research, or personal use. According to the University, the “technical and cultural realities” of its email system leave “little or no room” to assert custody or control over “personal email.” Arguing that it does not have an ownership interest in personal email communication by its professors, the University submits that personal email records are held by those individuals, not possessed by the University, and such records are not integrated with other University records. Only in very limited circumstances, the University submits, does the University have the right to regulate the content of such records and only when the University is notified by a third party that the content may be contrary to law. The University submits that only in such circumstances does it then consider the legal tools at its disposal to review and access such records.

 

The appellant maintains that each university whose representative sat on the SSHRC adjudication committee in question has custody and control over records of the type requested. The appellant states that in response to the access request he submitted to SSHRC under the federal  Access to Information Act , SSHRC responded that it has no custody or control over communications of members of SSHRC adjudication committees that are stored on the backup servers of the universities they represent. The appellant provided a copy of this response by SSHRC to his request under the federal  Access to Information Act .

 

The appellant submits that individuals do not join SSHRC committees of their own initiative, and are instead invited to do so by the responsible program officer. According to the appellant, individual members of SSHRC adjudication committees do not represent themselves, but rather their institutions as part of the SSHRC policy to ensure balanced representation by institution and province. The appellant maintains that since the official SSHRC committee lists includes each member’s institutional affiliation, the argument that “activities of SSHRC adjudicators shall be completely dissociated from their status [as] university employees is not tenable.” Further, the appellant submits that:

 

[A]cademic service is an integral part of duties of faculty members. For instance, Memorial University of Newfoundland Collective Agreement (Clause 3.01) states that “All Faculty Members have certain duties and responsibilities which derive from their positions as teachers and scholars with academic freedom. The professional duties and responsibilities of Faculty Members shall be an appropriate combination of: (a) undergraduate and graduate teaching; (b) research, scholarship, and creative and professional activities; (c) academic service, which  may include the application of the Faculty’s Member’s academic or professional competence or expertise in the community at large”. SSHRC regularly sends thank you letters to the universities to acknowledge the service provided by the committee’s members. These letters are usually addressed to the deans of faculties and schools represented by the adjudicators; they are taken into consideration when evaluating the faculty member’s performance. Last, but not least, if the activities under consideration were not an integral part of academic life, then the use of institution e-mail accounts for the purpose of communicating with other committee members and SSHRC officers would violate Policies Governing the Use of Information Technology. …

 

With respect to the factors relevant to determining custody or control, the appellant notes that the records were created by an employee of the University and represent the method of communication between that individual – a SSHRC committee member – and the responsible SSHRC officer, which in turn forms an “integral part” of the peer-review process. As to whether or not the University has a “statutory power or duty to carry out the activity that resulted in the creation of the record,” or if the record’s content relates to the University’s mandate and functions, the appellant submits that peer review is a necessary precondition of “the pursuit of learning through scholarship, teaching and research.”

 

The appellant submits that the University has physical possession of, and the right to possess, records or “messages stored (and in some cases – deleted from) [its] back-up server.” In support of this argument, the appellant relies on “successful searches” identifying records at two post-secondary institutions in other provinces to which he submitted access requests.

 

The remainder of the appellant’s representations relate to his concerns about his SSHRC grant application and address matters beyond the scope of the present appeal.

 

In its reply representations, the University essentially reiterates the arguments relating to SSHRC being an institution in its own right that falls under federal legislation and the records created by an individual SSHRC committee member constituting personal email exchanges that are not in the University’s possession.

 

Analysis and Findings

 

For the reasons that follow, I find that records responsive to the appellant’s request are in the custody of the University within the meaning of section 10(1)  of the Act .

 

In setting out my reasons for decision in this appeal, I will refer to Order PO-2836. As noted in the introductory section, I issued Order PO-2836 recently to dispose of the issues in Appeal PA08-164, which related to the same appellant’s appeal of Wilfrid Laurier University’s decision that requested records of the same description were not in its custody or under its control.

 

In finding that Wilfrid Laurier University had custody of the responsive records for the purpose of section 10(1)  of the Act , I relied in part on the reasoning articulated by former Assistant Commissioner Tom Mitchinson in Order PO-1725. I set out an excerpt from Order PO-1725 with the following introduction:

 

In beginning my analysis of the issue before me, I would express my agreement with former Commissioner Sidney Linden that a broad and liberal interpretation to the issue of custody and control is important to give proper effect to the purposes and principles of the Act  [Order 120].

 

Past orders have specifically addressed the issue of custody or control over records located on an institution’s computer system. In Order PO-1725, former Assistant Commissioner Tom Mitchinson reviewed a decision by Cabinet Office regarding the electronic copy of the agenda of an employee in the Premier’s Office that contained both personal and professional appointments. While the institution admitted that it had “the general authority to dispose of the database containing the records,” it argued that the information in the records relating to the named employee’s “personal,” as opposed to his employment, activities, was not in its custody or under its control. The former Assistant Commissioner rejected this argument and found that all information in the electronic agenda was in the custody of the Premier’s Office since its entries – personal and professional – were created and stored on a computer system that was owned and maintained by the government and used for government business.

 

In my view, the following line of reasoning in Order PO-1725 provides a useful context for my findings in the present appeal:

 

My discussion will focus on whether or not the Premier’s Office has custody of these records. If I determine that the Premier’s Office has lawful custody of the records, that finding is sufficient to bring the records within the scope of section 10(1)(a) and under the jurisdiction of the Act .

 

Two broad principles emerge from the Commissioner’s orders dealing with the issue of custody. The first is that bare possession does not amount to custody, absent some right to deal with the records and some responsibility for their care and protection (Order P-239). The second principle is that “... physical possession of a record is the best evidence of custody, and only in rare cases could it successfully be argued that an institution did not have custody of a record in its actual possession” (Order 41).

 

In my view, there are a number of facts and circumstances surrounding the creation, possession and maintenance of the records at issue in these appeals which support the conclusion that they are in the custody of the Premier’s Office. All entries, whether they contain personal or professional information, were created and stored in the same database. This database is owned and maintained by the government on behalf of the Premier’s Office. This factor alone gives the institution both a right to deal with the records and a responsibility for their care and protection, in order to ensure the integrity of the database as a whole and of the information entered into it.

 

In addition, it is clear that the purpose for which the database exists is for use by employees attending to the business of the Premier’s Office. The capabilities of the database in permitting employees to make entries relating to personal matters… are normal features of most electronic calendar management databases and are not inconsistent with the institution’s lawful custody of the database and its contents, or with its responsibilities in relation to its records management functions. If an employee of a government institution voluntarily chooses to place information, whether personal or professional in nature, into a government maintained database, it is difficult to conceive how the record containing that information would fall outside the institution’s lawful custody, absent the most exceptional circumstances, which I do not find present here.

 

It is not enough for an institution to assert simply that the named employee has sole authority over access to the records, that there is no protocol in place governing their disposition during the employee’s tenure, or that the retention schedule does not specifically deal with these types of records. As the Divisional Court noted in Ontario (Criminal Code Review Board) v. Ontario (Information and Privacy Commissioner) (March 7, 1997), Toronto Doc. 283/95 (Ont. Div. Ct.), [aff’d 47 O.R. (3d) 201 (C.A.)], for example, the absence of evidence that an institution has actually exercised control over particular records will not necessarily advance the institution’s argument that it, in fact, has no control.  If it were otherwise, government institutions would be in a position to abdicate their information management responsibilities under the Act  by the simple device of failing to implement appropriate information management practices in respect of records in their lawful custody. So long as records are in an institution’s custody, that body must deal with them in accordance with all applicable laws, including the provisions of the Act .

 

I agreed with the reasoning in Order PO-1725 and adopted it for the purposes Order PO-2836. I adopt this same reasoning in the present order.

 

One of the University’s explanations for the purported absence of a right to deal with the records responsive to the appellant’s request rests on the assertion that SSHRC is a federal agency and an institution in its own right that operates under the federal  Access to Information Act . The University argues that the appellant’s request, therefore, is properly, and solely, made to that agency. The appellant, in turn, provided me with a copy of the decision letter he received after submitting his request to SSHRC under the federal statute, which essentially informed him that SSHRC did not have custody or control of “copies of e-mails stored on the backup servers of the universities…”

 

In my view, several points are worth making. First, my authority under Ontario’s  Freedom of Information and Protection of Privacy Act  clearly does not extend to commenting on the decision letter issued by the SSHRC regarding custody or control under the federal  Access to Information Act . Second, in my view, SSHRC’s decision under the federal statute and the arguments about SSHRC’s jurisdiction are not persuasive. It is possible for two institutions to each have custody or control over responsive records under two different access to information regimes. Ultimately, my finding that the University has custody of the responsive records is a threshold issue for proceeding under the Ontario Act, and does not affect the authority of the federal Information Commissioner to address any appeal of SSHRC’s decision, as may be required.

 

The University also sought to establish that the SSHRC activity of the named professor was not carried out pursuant to a statutory duty or power of the University, or in respect of its mandate, and that any records resulting from the activity could not therefore be said to relate to the University’s mandate or statutory obligations or powers. For the reasons that follow, I reject this argument, as I did in Order PO-2836.

 

The governance and administration of the University are described in An Act  respecting Université d'Ottawa (S.O. 1965, C.137). Section 4 of that statute contains its purpose statement, expressed in the following manner:

 

The objects and purposes of the University are,

 

(a) to promote the advancement of learning and the dissemination of knowledge;

 

(b) to further, in accordance with Christian principles, the intellectual, spiritual, moral, physical and social development of, as well as a community spirit among its undergraduates, graduates and teaching staff, and to promote the betterment of society;

 

(c) to further bilingualism and biculturalism and to preserve and develop French culture in Ontario.

 

Further, I note that the University’s mandate as described on its website echoes the theme of section 4, outlined above, being “to further knowledge and contribute to the common good.” Moreover, as the University stated in its representations, the design of its email system is intended to promote “communication in furtherance of the academic objectives of the University as well as communication between colleagues that may not be related to the academic mission of the University.”

 

 

In my view, there is adequate evidence before me to support a conclusion that the participation of a faculty member on a SSHRC committee is closely related to the University’s mandate, function, and statutory duty or power. In Order PO-2836, I wrote the following about the connection between the named professor’s SSHRC involvement and the context of such academic or scholarly pursuits, more generally:

 

According to the University’s enabling statute, The Wilfrid Laurier University Act, 1973 [as amended by Wilfrid Laurier University Amendment Act, 2001 S.O. 2001, c. 12], the objects of the University are “the pursuit of learning through scholarship, teaching and research within a spirit of free enquiry and expression.” In my view, this purpose statement may be viewed as representing the University’s “mandate.” Moreover, on the face of it, faculty involvement in SSHRC activities would appear to fit within that mandate. The University acknowledges that engaging in research and scholarly activities is a “core function”’ of the University and the work of its faculty members and also admits that faculty members are obligated under the Collective Agreement to engage in “scholarly activities, including research, as well as to engage in academic, professional and University community service.” However, the University then argues that research and scholarly activities involving “peer review for an external agency” are somehow removed from the realm of scholarly activities that fall within the core function or mandate of the University. In my view, this distinction between internal and external peer review activities is without merit. Rather, I find that the named professor’s SSHRC committee participation represents an activity going to the core or central function of the University notwithstanding the fact that it may be with an agency external to the University. I am similarly satisfied that the content of any records created incidentally through faculty participation on a SSHRC adjudication committee is related to the University’s scholarship and research mandate.

 

In my view, the circumstances of the present appeal are analogous to those that were before me in Order PO-2836, and I will apply those findings here. Accordingly, in this appeal, I am satisfied that faculty participation in SSHRC committee work is provided for in the University’s enabling statute and also fits in with the University’s mandate and core function. Moreover, as I stated in Order PO-2836, any attempt to distinguish between a professor’s intra-University academic and scholarly activities and those engaged in externally with SSHRC is, in my view, both artificial and unsustainable.

 

The University provided a very detailed description of the two systems predominantly in use by the majority of users with “@uottawa.ca” email accounts. The University explained that the Exchange system is used by approximately 95% of staff and 25% of professors, while the Mailbox system is used by approximately 75% of professors and 5% of administrators.  In the case of the former (Exchange), the University states that emails created through its use reside on University servers while the latter (Mailbox) system permits users to set up their email account so that messages are simply “transited” through the University system, and are never stored.

 

What is remarkable about this description, in my view, is that the University did not specify which system the named faculty member uses or whether the use of one system is mutually exclusive of the other. Moreover, it appears from a review of the University’s Computing and Communications Services web pages that “MS Exchange is the University’s centrally managed email and calendaring server” and is offered to “Employees only” while “Mailbox is the centrally managed email server intended for use by students and alumni,” although it is available to employees.

 

Notwithstanding the University’s efforts to distinguish between the two systems, in the absence of evidence that the named professor uses only the Mailbox (or transiting) system, the fact remains that the University has the right to regulate or access “@uottawa.ca” email accounts, which is the email address suffix identified in this request. The University acknowledges that it can view and retrieve messages from its servers, although it includes the proviso that it can do so only with the “consent of the account holder, or if required or permitted to do so by law.” The University also acknowledges that professors using an Exchange email account are informed that its use is subject to University policy and law. One example of that would be the University’s User Code of Conduct for Computing Resources, which is reviewed in greater detail below.

 

In Order PO-2836, I found that Wilfrid Laurier University had lawful custody of records created by the named professor’s use of university email for SSHRC communications, in part, “through the normal course of overseeing the administration and management of its computer system, including its server and databases.” I also addressed the implications of Wilfrid Laurier University’s IT Use Policy for the determination of custody or control as follows:

 

The University’s computer system is in place to facilitate learning and the pursuit of scholarly research activities. The University’s IT Use Policy specifically provides for the use of IT resources by faculty “in support of their teaching, research and administrative activities.” It also clearly contemplates disciplinary action for unauthorized or inappropriate use of those resources. In the present appeal, therefore, I am satisfied that the University’s ability to monitor its computer resources and network under the terms of its IT Use Policy accords it the corresponding right to regulate all records on its computer system, notwithstanding that it may choose not to do so in circumstances where the use is said to be “authorized,” as in this case. As the Divisional Court stated in Ontario (Criminal Code Review Board) (cited above), the mere fact that an institution has not exercised control over particular records in the past “will not necessarily advance the institution’s argument that it, in fact, has no control.” Therefore, regardless of the fact that the University chose not to exercise control through regulation of the named professor’s use of University IT resources for SSHRC email communications, it does not follow that the email records are outside the University’s custody or control.

 

In this appeal, the University presented no specific representations on its User Code of Conduct for Computing Resources (the User Code of Conduct), but I note that this is a policy to which all users of all email accounts (and computing resources) are subject. It is also available on the University’s Computing and Communications Services web pages, and I have reviewed it. Moreover, I note that the University’s User Code of Conduct contains provisions similar to those in place at Wilfrid Laurier University as regards the use of computing resources. For example, the computing resources at the University “are intended to support its educational and research activities.” In addition, and significantly, in my view, violations of the User Code of Conduct may result in disciplinary measures, including “removal of material from an account or computing resource and [suspension of] access to an account…”.

 

In the circumstances, I am satisfied that the University’s ability to monitor its computer resources, network and servers under the terms of its User Code of Conduct accords it the corresponding right to regulate records on its computer system, notwithstanding that it may choose not to do so [see Ontario (Criminal Code Review Board) (cited above)]. Moreover, as I stated in Order PO-2836, although the University may not have exercised control through regulation of the named professor’s use of university computing resources for SSHRC email communications, it does not follow that the email records are outside the University’s custody or control.

 

Finally, I will address the University’s submission that it neither possesses, nor has the right to possess, the named professor’s “personal” email account or its contents. The University argues that the unique technical and cultural realities of the university context leave little to no room to assert custody or control over personal email communication. In Order PO-2836, I considered a similar argument presented by the institution in that appeal and stated,

 

The University also sought to establish that the named professor’s SSHRC email communications constitute “personal communication” and are not, therefore, in the University’s custody or control. In my view, if it was strictly necessary for me to distinguish between personal and professional (or employment) information, it seems more likely that the SSHRC-related email correspondence would be construed as being “professional communication.” In addition, I would refer back to the following finding in Order PO-1725, where former Assistant Commissioner Mitchinson stated:

 

All entries, whether they contain personal or professional information, were created and stored in the same database. This database is owned and maintained by the government on behalf of the Premier’s Office. This factor alone gives the institution both a right to deal with the records and a responsibility for their care and protection, in order to ensure the integrity of the database as a whole and of the information entered into it.

 

Moreover, as the former Assistant Commissioner also stated in Order P-267:

 

… it is not possible for an institution to remove records in its physical possession from the purview of the Act  by simply maintaining that they relate to political party [personal] activity. To do so would be inconsistent with the obligation of institutions to properly manage their record holdings in accordance with the intent of the Act .

 

I agree. In this appeal, the University cannot carve out an exception from the Act  for records otherwise in its lawful custody simply by asserting that they were created in the author’s personal capacity. Moreover, the purported absence of an entitlement on the University’s part to view, receive or exercise authority over the named professor’s SSHRC-related email correspondence for confidentiality reasons has no bearing on the issue of custody or control within the meaning of section 10(1)  of the Act . The use to which such correspondence could potentially be put by the University or others is, as previously suggested, not relevant in the context of this inquiry.

 

The reference in the last line of the excerpt from Order PO-2638, above, is to a statement I made earlier in that order regarding the nature of the determination of custody or control, namely that:

 

… my finding in this appeal does not have any bearing on the determination of access to the responsive records. The sole issue before me is whether the University has custody or control over the type of record requested by the appellant: emails created incidentally by a University faculty member’s participation on a SSHRC committee.

 

Similarly, and as noted on page 2 of this order, I advised the parties in the inquiry documentation that a finding that records are in the custody or under the control of the University does not necessarily result in the appellant gaining access to them. It may be the case that the records are excluded from the operation of the Act  pursuant to section 65 or, more specific to the university context, sections 65(8.1) – 65(10). Furthermore, a record in an institution’s custody or under its control and subject to the Act  may be withheld if it falls within one of the exemptions under sections 12 to 22. Section 21 exists, for example, to protect individuals from unjustified invasions of personal privacy resulting from disclosure of their personal information. However, these are not matters for determination at this point.

 

Therefore, for all of the foregoing reasons, I find that the University has both the right and responsibility to deal with any records which are responsive to the appellant’s request, and that such records are in the custody of the University for the purpose of section 10(1)  of the Act . As I have found that the named professor’s SSHRC-related emails are in the University’s custody, the University is required to deal with them in accordance with all applicable laws, including the provisions of the Act  [Order PO-1725].

 

 

ORDER:

 

1.            I order the University to issue a decision letter to the appellant regarding access to any responsive records in accordance with the provisions of the Act , treating the date of this Order as the date of the request.

 

2.            I order the University to provide me with a copy of the decision letter referred to in Provision 1 when it is sent to the appellant. This should be forwarded to my attention, c/o Information and Privacy Commissioner/Ontario, 2 Bloor Street East, Suite 1400, Toronto, Ontario M4W 1A8.

 

 

 

 

 

 

Original Signed By:_________________________                November 10, 2009                         

Daphne Loukidelis

Adjudicator