Information and Privacy Commissioner, Ontario, Canada

Commissaire à l’information et à la protection de la vie privée, Ontario, Canada

ORDER MO-2999

Appeal MA13-138-2

Toronto Police Services Board

January 20, 2014

Summary: The requester sought access to any information about him that the police had placed on the Canadian Police Information Centre (CPIC) database. The police denied access to the responsive record, citing the discretionary law enforcement exemptions in sections 8(1)(c) and 8(1)(l), read in conjunction with section 38(a), and the discretionary personal privacy exemption in section 38(b). During adjudication of the appeal, the appellant withdrew his request for access to the CPIC-specific access codes and the personal information of other identifiable individuals in the record, and the police disclosed additional information to him. This order does not uphold the police’s decision to deny access to the remaining information under section 38(b) or sections 8(1)(c) and 8(1)(l), read in conjunction with section 38(a).

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. M.56 , as amended, sections 2(1) (definition of personal information), 8(1)(c), 8(1)(l), 38(a), 38(b).

BACKGROUND:

[1] The Toronto Police Services Board (the police) received a request under the Municipal Freedom of Information and Protection of Privacy Act  (MFIPPA  or the Act ) for the following:

1. 1. A copy of any information that the Toronto Police Service has placed on the Canadian Police Information Centre (CPIC) database in respect of, or in relation to [name of requester].
2. 2. A copy of all notes, reports and any other documentation created by: [four named police officers] in respect of, or in relation to, the [date] incident detailed in Toronto Police Service occurrence report [number].
3. 3. A copy of all notes, reports and any other documentation created by [named officer] in respect of, or in relation to, the [date] incident detailed in Toronto Police Service occurrence report [number].

[2] The police issued a decision granting partial access to the records. Access was denied to the withheld portions of the records pursuant to the discretionary law enforcement exemptions in sections 8(1)(c) and 8(1)(l), read in conjunction with section 38(a), and the discretionary personal privacy exemption in section 38(b). In addition, some portions of the records were withheld as they were deemed to be non-responsive to the request.

[3] The requester (now the appellant) appealed the police’s decision to deny access to the withheld portions of the record.

[4] During mediation, the appellant explained that he had originally made a request to the police for information related to a specific incident. The police referred the appellant to the Royal Canadian Mounted Police (RCMP) for access to the information he had requested from the RCMP’s CPIC database. The RCMP then denied access to the records. The appellant appealed this decision to the Office of the Privacy Commissioner of Canada (OPCC). The OPCC ruled that although the CPIC system is operated by the RCMP, each participating agency retains control of the information it has entered into the CPIC database.

[5] The appellant then submitted the request described above to the police. The appellant told the mediator that he is not interested in pursuing access to the information withheld from the occurrence report or the police officers’ notebooks. He is seeking access to any information about him that the police submitted to the CPIC database, only.

[6] No further mediation was possible and the file was transferred to the adjudication stage of the appeals process where an adjudicator conducts an inquiry. I sent a Notice of Inquiry, setting out the facts and issues in this appeal, seeking the representations of the police initially. The police provided the appellant with further disclosure of the record in a supplementary decision letter. They also provided representations in response to the Notice of Inquiry.

[7] I sent a copy of the police’s representations to the appellant, less a portion of one sentence that contains confidential information. The appellant provided representations in response. In his representations, the appellant stated that he is not seeking access to any personal information about any other person. He also stated that he did not wish to receive access to the CPIC-specific access codes in the record.

[8] In this order, I do not uphold the police’s decision under section 38(b) and do not uphold their decision under sections 8(1)(c) and 8(1)(l), read in conjunction with section 38(a), with respect to the remaining information at issue in the record.

RECORD:

[9] Taking into account the additional disclosures and the appellant’s clarifications, the information remaining at issue is found in five severances of a one-page CPIC report.

ISSUES:

1. A. Does the record contain personal information as defined in section 2(1) and, if so, to whom does it relate?
2. B. Does the discretionary exemption at section 38(a), in conjunction with the sections 8(1)(c) and 8(1)(l) exemptions, apply to the information at issue?
3. C. Does the discretionary exemption at section 38(b) apply to the information at issue?

DISCUSSION:

A. Does the record contain personal information as defined in section 2(1) and, if so, to whom does it relate?

[10] In order to determine which sections of the Act  may apply, it is necessary to decide whether the record contains personal information and, if so, to whom it relates. That term is defined in section 2(1) as follows:

personal information means recorded information about an identifiable individual, including,

(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

(c) any identifying number, symbol or other particular assigned to the individual,

(d) the address, telephone number, fingerprints or blood type of the individual,

(e) the personal opinions or views of the individual except if they relate to another individual,

(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

(g) the views or opinions of another individual about the individual, and

(h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

[11] The list of examples of personal information under section 2(1) is not exhaustive. Therefore, information that does not fall under paragraphs (a) to (h) may still qualify as personal information.¹

[12] Sections 2(2.1) and (2.2) also relate to the definition of personal information. These sections state:

(2.1) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

(2.2) For greater certainty, subsection (2.1) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling.

[13] To qualify as personal information, the information must be about the individual in a personal capacity. As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be about the individual.²

[14] To qualify as personal information, it must be reasonable to expect that an individual may be identified if the information is disclosed.³

[15] The police state that the record contains the names, addresses, dates of birth and other identifying information about the appellant and another individual.

[16] The appellant submits that the record contains his personal information.

Analysis/Findings

[17] Based on my review of the record, I find that it contains the personal information of the appellant as described above by the police, namely his name, address, date of birth and other identifying information about him. It also contains the name, address and date of birth of another identifiable individual.

[18] The appellant states that he is not seeking access to any personal information about any other individual. Accordingly, this information, which is found at the second last severance on the record, is not at issue in this appeal.

B. Does the discretionary exemption at section 38(a), in conjunction with the sections 8(1)(c) and 8(1)(l) exemptions, apply to the information at issue?

[19] Section 36(1) gives individuals a general right of access to their own personal information held by an institution. Section 38 provides a number of exemptions from this right.

[20] Section 38(a) reads:

A head may refuse to disclose to the individual to whom the information relates personal information,

if section 6, 7, 8, 8.1, 8.2, 9, 10, 11, 12, 13 or 15 would apply to the disclosure of that personal information.

[21] Section 38 (a) of the Act  recognizes the special nature of requests for one’s own personal information and the desire of the legislature to give institutions the power to grant requesters access to their personal information.⁴

[22] Where access is denied under section 38(a), the institution must demonstrate that, in exercising its discretion, it considered whether a record should be released to the requester because the record contains his or her personal information.

[23] In this case, the institution relies on section 38(a), in conjunction with sections 8(1)(c) and 8(1)(l). These sections read:

8(1) A head may refuse to disclose a record if the disclosure could reasonably be expected to,

(c) reveal investigative techniques and procedures currently in use or likely to be used in law enforcement;

(l) facilitate the commission of an unlawful act or hamper the control of crime.

[24] The term law enforcement is used in several parts of section 8, and is defined in section 2(1) as follows:

law enforcement means,

(a) policing,

(b) investigations or inspections that lead or could lead to proceedings in a court or tribunal if a penalty or sanction could be imposed in those proceedings, or

(c) the conduct of proceedings referred to in clause (b)

[25] Generally, the law enforcement exemption must be approached in a sensitive manner, recognizing the difficulty of predicting future events in a law enforcement context.⁵

[26] Except in the case of section 8(1)(e), where section 8 uses the words could reasonably be expected to, the institution must provide detailed and convincing evidence to establish a reasonable expectation of harm. Evidence amounting to speculation of possible harm is not sufficient.⁶

[27] It is not sufficient for an institution to take the position that the harms under section 8 are self-evident from the record or that a continuing law enforcement matter constitutes a per se fulfilment of the requirements of the exemption.⁷

[28] The police state that protecting computerized databases from unlawful access is an ever-present and growing concern and argue that disclosure of this type of information could compromise the security of the CPIC system. The query format of the printouts could instruct an unauthorized person as to how information is retrieved and stored on the CPIC system. Unauthorized use of this database constitutes a criminal offence, and for this reason, providing query formats to any individual not authorized to use this system, could assist the commission of an unlawful act, should the CPIC system be penetrated.

[29] The police cite Order MO-1293, where Adjudicator Laurel Cropley writes:

Several previous orders of the office have upheld the application of the exemption in section 8(1)(l) (and its provincial equivalent in section 14(1)(l)) for the transmission access codes for the CPIC system (Orders M-933, M-1OO4 and P-1214)...

Accordingly, I am satisfied that the disclosure of the data base information could reasonably be expected to facilitate the commission of an unlawful act, that being the unauthorized use of the information contained in the CPIC system. I find, therefore, that these portions of the records qualify for exemptions under section 8(1)(l) and are exempt under section 38 (a) of the Act .

[30] The appellant states that he is not seeking access to the inner-workings of the CPIC’s database. He states that he is not seeking general access to CPIC-specific codes. However, if one or more of those codes contains personal information, or personal health information, about him, he believes that he has a right to know what personal information, or personal health information, about him is contained in the record.

Analysis/Findings

[31] For section 8(1)(c) to apply, the institution must show that disclosure of the investigative technique or procedure to the public could reasonably be expected to hinder or compromise its effective utilization. The exemption normally will not apply where the technique or procedure is generally known to the public.⁸ The exemption will not apply to enforcement techniques or procedures.⁹

[32] For section 8(1)(l) to apply, disclosure of the record could reasonably be expected to facilitate the commission of an unlawful act or hamper the control of crime.

[33] The police claim the section 8(1)(c) and (l) exemptions to withhold access codes and query formats. Concerning this information, I can only ascertain five access codes or query formats from my review of the record. These codes and query formats do not contain any information that identifies the appellant. Therefore, in accordance with the appellant’s representations, this information is not at issue.

[34] Other than the five access codes and query formats, I cannot locate any other information in the record that could be characterized as access codes and query formats. Accordingly, I find that sections 8(1)(c) and (l) do not apply to the remaining information at issue in the record.

[35] I will now consider whether the discretionary personal privacy exemption in section 38(b) applies to the information remaining at issue in the record. This information consists of the personal information of the appellant only, as he has indicated that he is not interested in receiving the personal information of other identifiable individuals.

C. Does the discretionary exemption at section 38(b) apply to the information at issue?

[36] Section 36(1)  of the Act  gives individuals a general right of access to their own personal information held by an institution. Section 38 provides a number of exemptions from this right.

[37] Under section 38(b), where a record contains personal information of both the requester and another individual, and disclosure of the information would constitute an unjustified invasion of the other individual’s personal privacy, the institution may refuse to disclose that information to the requester.

[38] If the information falls within the scope of section 38(b), that does not end the matter. Despite this finding, the institution may exercise its discretion to disclose the information to the requester. This involves a weighing of the requester’s right of access to his or her own personal information against the other individual’s right to protection of their privacy.

[39] Sections 14(1) to (4) provide guidance in determining whether the unjustified invasion of personal privacy threshold is met.

[40] If the information fits within any of paragraphs (a) to (e) of section 14(1), disclosure is not an unjustified invasion of personal privacy and the information is not exempt under section 38(b). If any of paragraphs (a) to (c) of section 14(4) apply, disclosure is not an unjustified invasion of personal privacy and the information is not exempt under sections 38(b). Neither paragraphs (a) to (e) of section 14(1) or section 14(4) apply in this appeal.

[41] In determining whether the disclosure of the personal information in the records would be an unjustified invasion of personal privacy under section 38(b), this office will consider, and weigh, the factors and presumptions in sections 14(2) and (3) and balance the interests of the parties.¹⁰

[42] In this appeal, the police rely on the presumption at section 14(3)(b). This section reads:

A disclosure of personal information is presumed to constitute an unjustified invasion of personal privacy if the personal information,

was compiled and is identifiable as part of an investigation into a possible violation of law, except to the extent that disclosure is necessary to prosecute the violation or to continue the investigation;

[43] The police state:

One has to consider the nature of the institution when assessing the need for protecting the privacy interests of individuals. The nature of law enforcement institutions, in great part, is to record information relating to unlawful activities, crime prevention activities, or activities involving members of the public who require assistance and intervention by the police

[44] The appellant indicates that he had an interaction with the police which resulted in the record’s creation.

[45] Even if no criminal proceedings were commenced against any individuals, section 14(3)(b) may still apply. The presumption only requires that there be an investigation into a possible violation of law.¹¹ The presumption can also apply to records created as part of a law enforcement investigation where charges are subsequently withdrawn.¹²

[46] In this appeal, the police were asked in the Notice of Inquiry whether the personal information was compiled and is identifiable as part of an investigation into a possible violation of law and to identify the law or legislative provision.

[47] The police did not respond to this question in their representations. Although at several points in their representations they assert that the record was created in connection with a police investigation, they do not identify the law or legislative provision that may have applied. In some circumstances, this information is self-evident from the record, but in this case I cannot ascertain from the record what possible violation of law was being investigated. As the presumption in section 14(3)(b) requires that the personal information was compiled and is identifiable as part of an investigation into a possible violation of law, I find that section 14(3)(b) does not apply to the information at issue in this appeal.

[48] Section 14(2) lists various factors that may be relevant in determining whether disclosure of personal information would constitute an unjustified invasion of personal privacy under section 38(b).¹³

[49] The list of factors under section 14(2) is not exhaustive. The institution must also consider any circumstances that are relevant, even if they are not listed under section 14(2).¹⁴

[50] The police did not provide representations on section 14(2).

[51] The appellant provided detailed representations as to why he believes that some of the personal information, including personal health information, about him provided by the police to the RCMP for entry into the CPIC’s database is incorrect. He requires access to the personal information that he seeks to correct.

[52] I accept the appellant’s representations as establishing relevant circumstances favouring disclosure of the remaining information at issue. Although the facts do not raise an issue of a fair determination of rights within the meaning of section 14(2)(d), as that section has been applied by this office, they do raise issues of fairness. The appellant believes that information about himself was placed in the CPIC database, to his detriment, and wishes to know precisely what information the police entered into that database.

[53] The remaining personal information in the record relates solely to the appellant. I find that the appellant has demonstrated relevant circumstances favouring disclosure of this information and, as neither sections 14(3) nor 14(4) apply, I find that this information is not exempt under section 38(b) and I will order it disclosed.

ORDER:

1. 1. I order the police to disclose all of the information in the record to the appellant by February 10, 2014, except for the following information which is to be withheld:
   • • access codes and query formats, and
   • • personal information of another individual.

     For ease of reference, I have provided the police with a copy of the record, highlighting the information to be withheld.

2. 2. I reserve the right to require the police to provide me with a copy of the record as disclosed to the appellant.

Original signed by: Diane Smith Adjudicator

January 20, 2014

---

¹ Order 11.

² Orders P-257, P-427, P-1412, P-1621, R-980015, MO-1550-F and PO-2225.

³ Order PO-1880, upheld on judicial review in Ontario (Attorney General) v. Pascoe, [2002] O.J. No. 4300 (C.A.).

⁴ Order M-352.

⁵ Ontario (Attorney General) v. Fineberg (1994), 19 O.R. (3d) 197 (Div. Ct.).

⁶ Order PO-2037, upheld on judicial review in Ontario (Attorney General) v. Ontario (Information and Privacy Commissioner), [2003] O.J. No. 2182 (Div. Ct.), Ontario (Workers’ Compensation Board) v. Ontario (Assistant Information and Privacy Commissioner) (1998), 41 O.R. (3d) 464 (C.A.).

⁷ Order PO-2040; Ontario (Attorney General) v. Fineberg.

⁸ Orders P-170, P-1487, MO-2347-I and PO-2751.

⁹ Orders PO-2034, P-1340.

¹⁰ Order MO-2954.

¹¹ Orders P-242 and MO-2235.

¹² Orders MO-2213, PO-1849 and PO-2608.

¹³ Order P-239.

¹⁴ Order P-99.