ORDER PO-3300

Appeal PA12-392

Ministry of Natural Resources

January 30, 2014

Summary: The appellant sought access to records relating to all verbal and written communication between the Ministry of Natural Resources and an identified company regarding the granting of a contract to the company, including timelines, deliverables and maps. The ministry granted access to some records and denied access to others, either in whole or in part, claiming the application of the mandatory exemptions in sections 17(1) (third party information) and 21(1) (personal privacy) and the discretionary exemptions in sections 13(1) (advice or recommendations), 14(1)(l) (facilitate commission of an unlawful act), 18(1) (economic and other interests) and 19 (solicitor-client privilege) of the Act. In this order, the adjudicator upholds the ministry’s decision, in part, and determines that the exemptions in sections 18(1), 19 and 21(1) apply to the records for which they were claimed. The adjudicator also determines that the exemptions in sections 13(1) and 17(1) apply to some of the information at issue. Lastly, the adjudicator upholds the ministry’s exercise of discretion. The ministry is ordered to disclose some of the records at issue to the appellant.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, sections 2 (definition of personal information), 13(1), 17(1), 18(1), 19 and 21(1).

Orders and Investigation Reports Considered: PO-2435.

OVERVIEW:

[1] The Ministry of Natural Resources (the ministry) operates a number of provincial parks in Ontario through Ontario Parks. These parks are open to the public for a variety of activities, including camping. The Park Reservation and Registrations Service (the PRRS) is jointly managed by the Land & Resource Cluster (LRC) and Ontario Parks. The PRRS provides services relating to provincial parks, including the use of an integrated reservation/accounting tool used to streamline park reservations, which features:

• • a staffed call centre;
• • an internet reservation website;
• • software to process the reservation, issue permits and account for revenues;
• • computers at the call centre and park level;
• • an ongoing helpdesk; and
• • a telecommunications network to move data between the call centre/internet and each provincial park.

[2] The existing PRRS commenced following an RFP process. The ministry entered into an agreement with the first ranked vendor, the requester, to develop and implement the service. According to the ministry, several problems began to emerge with the service and eventually the ministry terminated its agreement with the requester and entered into another agreement with the second ranked vendor. The ministry, the requester and the second ranked vendor are currently engaged in civil litigation in relation to the termination of the agreement.

[3] This order disposes of the issues raised as a result of a decision made by the ministry in response to an access request under the Freedom of Information and Protection of Privacy Act  (the Act ) for records relating to:

A copy of any and all records in regards to the present contract between MNR and [a named company] including any verbal, written exchanges and/or meeting between MNR and [the named company] in relation to the discussion, negotiation and finalization of the contract between MNR and [the named company].

Any and all records in relation to any verbal or written exchanges and/or meetings in regards to the delivery timelines, deliverables, maps and other information provided to [the named company] by MNR and any information on the [named company’s] campground management implementation including timelines, planned and revised during a specified time period.

[4] The ministry identified responsive records and notified four affected parties to obtain their views regarding disclosure of the records.

[5] Two affected parties provided their consent to partial disclosure, while the remaining two affected parties did not respond to the ministry.

[6] After considering the response from the affected parties, the ministry issued a decision, granting access to some records, in whole or in part. Other records were withheld, in full. The ministry claimed the application of the mandatory exemptions in section 21(1) (personal privacy) and 17(1) (third party information), and the discretionary exemptions in sections 13(1) (advice or recommendations), 14(1)(l) (facilitate commission of an unlawful act), 18(1) (economic and other interests) and 19 (solicitor client privilege) of the Act .

[7] The requester, now the appellant, appealed the ministry’s decision to this office.

[8] During the mediation of the appeal, the appellant advised that he was not seeking access to information that is clearly an affected party’s personal information, such as personal email addresses or phone numbers. Consequently, the personal information such as personal email addresses and phone numbers is no longer at issue and will not be disclosed to the appellant. The appellant also advised, however, that he was seeking access to information that may state when a ministry employee was on vacation, as this information may be of interest to him.

[9] The appeal then moved to the adjudication stage of the appeals process, where an adjudicator conducts an inquiry under the Act . I sought representations from the ministry, the appellant and three affected parties. I received representations from the ministry and one affected party, but not the appellant. Representations were shared in accordance with this office’s Practice Direction 7.

[10] During the inquiry, the ministry issued a supplementary decision letter to the appellant in which it revised its claim with respect to the exemption in section 19, and disclosed further records to the appellant.

[11] For the reasons that follow, I uphold the ministry’s decision, in part, and order it to disclose certain records to the appellant. I also uphold the ministry’s exercise of discretion.

RECORDS:

[12] The records consist of faxes, emails, letters, notes, test results, schedules, project reviews, and records described by the ministry as documents.

ISSUES:

1. A: Do the records contain personal information as defined in section 2(1) and, if so, to whom does it relate?
2. B: Does the mandatory exemption at section 21(1) apply to the information at issue?
3. C: Does the mandatory exemption at section 17(1) apply to the records?
4. D: Does the discretionary exemption at section 18(1) apply to the records?
5. E: Does the discretionary exemption at section 19 apply to the records?
6. F: Does the discretionary exemption at section 13(1) apply to the records?
7. G: Did the institution exercise its discretion under sections 13(1), 18(1) and 19? If so, should this office uphold the exercise of discretion?

DISCUSSION:

Issue A: Do the records contain personal information as defined in section 2(1) and, if so, to whom does it relate?

[13] In order to determine which sections of the Act  may apply, it is necessary to decide whether the records contain personal information and, if so, to whom it relates. That term is defined in section 2(1) as follows:

personal information means recorded information about an identifiable individual, including,

(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

(c) any identifying number, symbol or other particular assigned to the individual,

(d) the address, telephone number, fingerprints or blood type of the individual,

(e) the personal opinions or views of the individual except if they relate to another individual,

(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

(g) the views or opinions of another individual about the individual, and

(h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.

[14] Sections 2(3) and (4) also relate to the definition of personal information. These sections state:

(3) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

(4) For greater certainty, subsection (3) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling.

[15] To qualify as personal information, the information must be about the individual in a personal capacity. As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be about the individual.¹

[16] Even if information relates to an individual in a professional, official or business capacity, it may still qualify as personal information if the information reveals something of a personal nature about the individual.²

[17] To qualify as personal information, it must be reasonable to expect that an individual may be identified if the information is disclosed.³

[18] The ministry submits that records A0163849, A0163852, A0163865, A0163869, A0164094, A0164221, A0164223, A0164637, A0164924, A0165018, A0166509, A0164505, A0164576, A0164920, A0166801, A0164507, A0164501, A0164534, A0164566, A0164603, A0164605, A0164812, A0164867, A0164566, A0164573 and A0165189 contain personal information in that they reveal identifiable ministry employees’ and a translator’s vacation plans and/or time away from their work with the ministry for personal reasons.⁴

[19] Based on the ministry’s representations and my review of the records above, the information that was withheld from the appellant and which remains at issue is information concerning vacation and/or personal time taken by a number of identifiable individuals. I have reviewed the records and find that information about the individuals’ vacation and/or personal time is recorded information about them and qualifies as their personal information. I make this finding despite the fact that the named individuals were acting in their professional capacity. I find that information about an individual’s vacation and/or personal time would reveal something of a personal nature about them.

[20] The ministry also claims that records A0164597, A0164600, A0164616, A0164627, A0165432, A0166782, A0165932, A0166703, A0166576 and A0165297 also contain personal information. In particular, the ministry submits that these records contain the name, address, arrival date, site number, payment method and billing date of customers who camped at provincial parks. I find that these records also contain the personal information of identifiable individuals. In particular, the information in these records contains their addresses, which falls within paragraph (d) of the definition of personal information in section 2  of the Act . In addition, the information about these identifiable individuals’ arrival date, site number, payment method and billing date would fall within paragraph (h) of the definition, because it reveals other personal information about them. Therefore, I find that the withheld information in these records qualifies as their personal information.

[21] I will now determine whether the portions of records that contain personal information are exempt from disclosure under section 21(1)  of the Act .

Issue B: Does the mandatory exemption at section 21(1) apply to the information at issue?

[22] Where a requester seeks personal information of another individual, section 21(1) prohibits an institution from releasing this information unless one of the exceptions in paragraphs (a) to (f) of section 21(1) applies.

[23] If the information fits within any of paragraphs (a) to (f) of section 21(1), it is not exempt from disclosure under section 21. The section 21(1)(a) to (e) exceptions are relatively straightforward. The section 21(1)(f) exception is more complex, and requires a consideration of additional parts of section 21.

[24] The factors and presumptions in sections 21(2), (3) and (4) help in determining whether disclosure would or would not be an unjustified invasion of privacy under section 21(1)(f).

[25] The ministry submits that the disclosure of information such as vacations or time away from the office for personal reasons is presumed to be an unjustifiable invasion of privacy, as it relates to one’s employment history. The ministry further states that even if the presumption does not arise, balancing the factors in section 21(2) and the circumstances of the request favour non-disclosure of the information at issue. The ministry goes on to argue that disclosure of the customer information at issue would constitute an unjustified invasion of privacy, given that there are no factors in section 21(2) favouring disclosure.

[26] With respect to the presumption in section 21(3)(d) (employment history), past orders of this office have found that information which reveals the dates on which former employees are eligible for early retirement, the start and end dates of employment, the number of years of service, the last day worked, the dates upon which the period of notice commenced and terminated, the date of earliest retirement, entitlement to and the number of sick leave and annual leave days used and restrictive covenants in which individuals agree not to engage in certain work for a specified duration has been found to fall within the section 21(3)(d) presumption.⁵

[27] I am not persuaded by the ministry’s argument that reference to an individual’s one-time vacation would on its own qualify as information that would reveal their employment history. I find, therefore, that the presumption in section 21(3)(d) does not apply in this appeal.

[28] If no section 21(3) presumption applies, section 21(2) lists various factors that may be relevant in determining whether disclosure of personal information would constitute an unjustified invasion of personal privacy.⁶

[29] I have considered the factors in section 21(2) and find that there are no factors either favouring disclosure or non-disclosure of the individuals’ vacation and/or personal time to the appellant. I make the same finding with respect to the personal information of the ministry’s customers. Because the section 21(1) exemption is mandatory, and there are no factors favouring disclosure, I uphold the exemption and the ministry’s decision with respect to the personal information contained in the records. Consequently, those portions of records that were withheld under section 21(1) will not be disclosed to the appellant.

Issue C: Does the mandatory exemption at section 17(1) apply to the records?

[30] The ministry submits that disclosure of certain other records⁷ either in whole or in part, would give rise to a reasonable expectation of the harm identified in sections 17(1)(a) and/or 17(1)(c) of the Act . Sections 17(1)(a) and (c) state:

A head shall refuse to disclose a record that reveals a trade secret or scientific, technical, commercial, financial or labour relations information, supplied in confidence implicitly or explicitly, where the disclosure could reasonably be expected to,

(a) prejudice significantly the competitive position or interfere significantly with the contractual or other negotiations of a person, group of persons, or organization;

. . .

(c) result in undue loss or gain to any person, group, committee or financial institution or agency;

[31] Section 17(1) is designed to protect the confidential informational assets of businesses or other organizations that provide information to government institutions.⁸ Although one of the central purposes of the Act  is to shed light on the operations of government, section 17(1) serves to limit disclosure of confidential information of third parties that could be exploited by a competitor in the marketplace.⁹

[32] For section 17(1) to apply, the institution and/or the third party must satisfy each part of the following three-part test:

1. 1. the record must reveal information that is a trade secret or scientific, technical, commercial, financial or labour relations information; and
2. 2. the information must have been supplied to the institution in confidence, either implicitly or explicitly; and
3. 3. the prospect of disclosure of the record must give rise to a reasonable expectation that one of the harms specified in paragraph (a), (b), (c) and/or (d) of section 17(1) will occur.

Part 1: type of information

[33] The ministry submits that the information at issue is the technical and/or commercial information of the affected party. These types of information listed in section 17(1) have been discussed in prior orders:

Technical information is information belonging to an organized field of knowledge that would fall under the general categories of applied sciences or mechanical arts. Examples of these fields include architecture, engineering or electronics. While it is difficult to define technical information in a precise fashion, it will usually involve information prepared by a professional in the field and describe the construction, operation or maintenance of a structure, process, equipment or thing.¹⁰

Commercial information is information that relates solely to the buying, selling or exchange of merchandise or services. This term can apply to both profit-making enterprises and non-profit organizations, and has equal application to both large and small enterprises.¹¹ The fact that a record might have monetary value or potential monetary value does not necessarily mean that the record itself contains commercial information.¹²

Financial information refers to information relating to money and its use or distribution and must contain or refer to specific data. Examples of this type of information include cost accounting methods, pricing practices, profit and loss data, overhead and operating costs.¹³

[34] With respect to its assertion that the records contain commercial information, the ministry states that the records relate to the affected party’s offer to provide services relating to the operation of a parks reservation system, including information about the performance of its services. The ministry concludes that the records describe the exchange of services for consideration, which qualifies as commercial information.

[35] The ministry also submits that the records contain technical information because they contain specific information relating to the technical implementation of the services provided by the affected party. In particular, the ministry states that the records describe discussions of the affected party’s software, its capabilities and its implementation.

[36] The affected party provided a list of the records, or portions thereof, which it argues should not be disclosed, claiming the application of section 17(1). The affected party advises that it entered into a commercial agreement with the ministry regarding the implementation of the PRRS. In particular, the affected party processes customers’ credit card payments and refunds through its online card payment gateway. The records, the affected party argues, contain the technical specifications regarding the operation and testing of the payment gateway system, which qualifies as technical information for purposes of section 17(1).

[37] I have reviewed the records, and I am satisfied that some of the records for which section 17(1) was claimed contain information that would constitute financial information for the purposes of section 17(1). These records contain information relating to money and its use or distribution. In particular, some of the records contain credit card information, account numbers, an invoice and tax information pertaining to the affected party.

[38] Similarly, I find that the vast majority of the records at issue contain technical information, as described above. In particular, these records describe:

• • computer passwords, URL’s, hardware assets and data, source code information, remote access information, booking identification numbers, IP addresses;
• • reporting methodology, including incident reporting;
• • schematic diagrams of deployment specifications;
• • status reports and action items;
• • a data retention and disposal policy;
• • quality evaluation information;
• • threat risk assessments, security audits and vulnerability testing;
• • firewall, server information and host files;
• • test results;
• • functionality;
• • software solutions;
• • conference call numbers and passwords; and
• • project plans.

[39] This type of information qualifies as technical information for purposes of section 17(1), as it describes the operation or maintenance of a process, specifically the on-line reservation system, including the processing of customers’ payments.

[40] As all of the records for which this exemption was claimed contain either financial or technical information or both, part one of the three-part test has been met and I will go on to determine whether the information was supplied in confidence to the ministry by a third party.

Part 2: Supplied in confidence

[41] The requirement that it be shown that the information was supplied to the institution reflects the purpose in section 17(1) of protecting the informational assets of third parties.¹⁴

[42] Information may qualify as supplied if it was directly supplied to an institution by a third party, or where its disclosure would reveal or permit the drawing of accurate inferences with respect to information supplied by a third party.¹⁵

[43] In order to satisfy the in confidence component of part two, the parties resisting disclosure must establish that the supplier had a reasonable expectation of confidentiality, implicit or explicit, at the time the information was provided. This expectation must have an objective basis.¹⁶

[44] In determining whether an expectation of confidentiality is based on reasonable and objective grounds, it is necessary to consider all the circumstances of the case, including whether the information was:

• • communicated to the institution on the basis that it was confidential and that it was to be kept confidential;
• • treated consistently in a manner that indicates a concern for its protection from disclosure by the affected person prior to being communicated to the government organization;
• • not otherwise disclosed or available from sources to which the public has access; and
• • prepared for a purpose that would not entail disclosure.¹⁷

[45] The ministry submits that the information at issue was supplied to it in confidence and states:

The nature of the services provided to the PRRS would suggest that the information was supplied in confidence. There is a significant degree of confidentiality implicit in the process of developing and implementing the reservation system, particularly the technical aspects of it which is part of competitive industry. An examination of the records makes it clear by the candour of the discussion and the information provided that it was communicated in confidence. The records contain detailed technical information relating to the service provided dealing with communication protocols, validation protocols and functionality. The Ministry, in keeping with the norm for customers of this type of service, accepted it in confidence. Given the nature of the business sector in which the party operates, their implicit understanding was reasonable. Consequently, within the context of the exchange of records, there is an objective basis as required by past orders¹⁸ for an expectation of confidentiality with respect to the affected party’s information.

[46] The affected party who provided representations on the application of section 17 also submits that the commercial and technical information contained in the records in which it has an interest was supplied in confidence by it to the ministry. In regard to these records, the affected party further submits that the information was supplied to the ministry in confidence, in keeping with the norm for customers of this type of service, which accepted the information in confidence.

[47] The affected party goes on to state that a confidentiality provision in the contract between the ministry and it requires the ministry to keep any information disclosed to it by the affected party confidential. The information at issue, the affected party argues, was generated as a result of the contract and was supplied by it to the ministry with the expectation of confidentiality.

[48] Further, the affected party advises that it has not disclosed the information at issue to any party which has not been subject to confidentiality obligations and has consistently treated this information in a manner that indicates a concern for its protection from disclosure. Lastly, the affected party submits that the information at issue has not been otherwise disclosed and is not available from publicly accessible sources.

[49] Having reviewed the records and the representations from the ministry and an affected party, I am satisfied that they have provided sufficient evidence to demonstrate that the majority of the commercial and technical information contained in the records at issue was supplied by the affected party to the ministry, or that the information in the records meets the inferred disclosure exception, as its disclosure would reveal underlying non-negotiated information supplied by the affected party.

[50] However, I also find that the information at issue in several of the records was not supplied to the ministry by an affected party. Upon reviewing the records, it is clear that the information was either supplied to the affected party by the ministry, or shared amongst ministry staff only. Consequently, I find that the information in these records was not supplied to the ministry by a third party and, therefore, does not meet part two of the section 17(1) test. The ministry is claiming the application of the discretionary exemption in section 18 to all of these records except one, which I will consider below. Conversely, as there are no other exemptions being claimed with respect to record A0164444, I order the ministry to disclose it to the appellant.

[51] With respect to the remaining records, because of the nature of the information in these pages and based on the representations of the ministry and an affected party that describe how the information was treated, I find that the parties had a reasonably held expectation that this information was supplied in confidence. I find, therefore, that this information meets part two of the section 17(1) test and I will go on to consider whether any of the harms contemplated in part three of the test might apply to it.