Information and Privacy Commissioner, Ontario, Canada

Commissaire à l’information et à la protection de la vie privée, Ontario, Canada

ORDER PO-3474

Appeal PA13-529

Carleton University

March 31, 2015

Summary: Carleton University (the university) received a request under the Freedom of Information and Protection of Privacy Act  (the Act ) for copies of campus security reports related to the requester. The university denied access to these reports, and relied on the discretionary exemption in section 20 (threat to safety or health), read in conjunction with section 49 (a) of the Act . This order upholds the university’s decision.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, 2(1) (definition of personal information), 49(a), 20.

OVERVIEW:

[1] Carleton University (the university) received a request under the Freedom of Information and Protection of Privacy Act  (FIPPA  or the Act ) for copies of campus security reports related to the requester.

[2] The university located several responsive records and denied access to them, relying on the discretionary law enforcement exemption in section 14(1)  of the Act .

[3] The requester, now the appellant, appealed that decision.

[4] During mediation, the appellant advised that he believed that additional records should exist. He noted that the university confirmed that it found several university Special Constable Occurrence Reports, but his request was for all information related to him. He confirmed with the mediator that his request should also include his academic transcript and any video surveillance the university may have of him. He referred to one specific incident about which he thought the university may have a surveillance video.

[5] The mediator raised the possible application of sections 49(a) and 49(b) to the records at issue with the university, since they appear to contain personal information about the appellant. The university subsequently confirmed that it wished to rely on section 49 (a) of the Act , in conjunction with section 14(1). The university also confirmed that it wished to rely on the discretionary personal privacy exemption in section 49 (b) of the Act  with respect to portions of the records identified in the first decision.

[6] Accordingly, sections 49(a) and 49(b)¹ were added to the issues on appeal.

[7] The mediator also advised the university that the appellant stated his request should also include his academic transcript and any video surveillance the university may have of him. The university advised that after ongoing communication with the appellant that the initial request was defined as a request for recent Carleton University Special Constable Occurrence Reports related to him.

[8] The university agreed to expand the scope of the request to include the appellant’s academic transcript and a copy of the surveillance video in question. After a subsequent search, the university located the requester’s academic transcript and a video and several still images taken from a security camera. The university issued a second decision and disclosed the academic transcript and the still images, in full, to the appellant. Access to the video was denied in its entirely in accordance with section 49(a), in conjunction with section 14(1) , and section 49 (b) of the Act .

[9] Subsequently, upon further review the university decided to add section 20 (danger to health and safety) of the Act  as a reason for denying access to all the withheld records. The university issued a third decision to the requester indicating this.

[10] As the university first raised the possible application of the discretionary exemption in section 20 in its third decision, the late raising of a discretionary exemption was added to the issues on appeal.

[11] As mediation did not resolve the appeal, this file was transferred to the adjudication stage of the appeals process where an adjudicator conducts an inquiry. I sent a Notice of Inquiry, setting out the facts and issues in this appeal, to the university seeking its representations. I received representations from the university, which I sent to the appellant along with a Notice of Inquiry. The appellant did not provide representations in response. Portions of the university’s representations were withheld due to confidentiality concerns.

[12] In its representations, the university withdrew its reliance on the law enforcement exemptions in section 14(1); therefore, this exemption is no longer at issue in this appeal.

[13] In this order, I find that the records are exempt under section 20, read in conjunction with section 49(a).

RECORDS:

[14] The records at issue are Carleton University Special Constable occurrence reports and one (two part) surveillance video.

ISSUES:

1. A. Do the records contain personal information as defined in section 2(1) and, if so, to whom does it relate?
2. B. Should the university be allowed to raise the discretionary threat to safety or health exemption in section 20 late?
3. C. Does the discretionary threat to safety or health exemption at section 20, read in conjunction with section 49(a), apply to the information at issue?
4. D. Did the institution exercise its discretion under exemption at section 20, read in conjunction with section 49(a)? If so, should this office uphold the exercise of discretion?

DISCUSSION:

A. Do the records contain personal information as defined in section 2(1) and, if so, to whom does it relate?

[15] In order to determine which sections of the Act  may apply, it is necessary to decide whether the record contains personal information and, if so, to whom it relates. That term is defined in section 2(1) as follows:

personal information means recorded information about an identifiable individual, including,

(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

(c) any identifying number, symbol or other particular assigned to the individual,

(d) the address, telephone number, fingerprints or blood type of the individual,

(e) the personal opinions or views of the individual except if they relate to another individual,

(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

(g) the views or opinions of another individual about the individual, and

(h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

[16] The list of examples of personal information under section 2(1) is not exhaustive. Therefore, information that does not fall under paragraphs (a) to (h) may still qualify as personal information.²

[17] Sections 2(3) and (4) also relate to the definition of personal information. These sections state:

(3) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

(4) For greater certainty, subsection (3) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling.

[18] To qualify as personal information, the information must be about the individual in a personal capacity. As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be about the individual.³

[19] Even if information relates to an individual in a professional, official or business capacity, it may still qualify as personal information if the information reveals something of a personal nature about the individual.⁴

[20] To qualify as personal information, it must be reasonable to expect that an individual may be identified if the information is disclosed.⁵

[21] The university submits that the occurrence reports contain personal information, namely the employee numbers, dates of birth, ages, home addresses and home phone numbers of certain identifiable employees of the university. Furthermore, it states that student names are also found in the reports. It states that

It is important to note that as the students may have been working at the time the incidents took place these were jobs designated for students who wish to work part-time while completing their studies full time on campus. This information does not equate to information in a professional, official or business capacity but simply personal information.

Analysis/Findings

[22] I have reviewed the records and note that they all contain the personal information of the appellant and other individuals. In particular, the records contain personal information relating to:

• • the views of the appellant and other individuals [paragraphs (e) and (g)];
• • the ages and dates of birth of the appellant and other individuals involved in the incidents in the reports [paragraph (a)];
• • the student number of the appellant [paragraph (c)]; and,
• • the home addresses and personal telephone numbers of the appellant and other individuals [paragraph (d)].

[23] The records also contain the names and identifying numbers for a number of individuals other than the appellant, identified in the records as their Stu/Emp ID. Based on my review of the records, these individuals do not appear to be students, nor do they appear to be interacting with the appellant in a personal capacity. As well, the records contain the names and the Cadre numbers of the university’s special constables.

[24] I find that the names and numbers that identify the individuals other than the appellant in the records do so in an official or business capacity and is not personal information. This information does not reveal something of a personal nature about them and is not personal information within the meaning of that term in FIPPA. The personal privacy exemption in section 49(b) cannot apply to these names and numbers as they do not constitute personal information.

[25] In addition, the videos contain footage of the appellant and other identifiable individuals. These other individuals are students appearing in the videos in their personal capacity, as well as university staff acting in an official capacity. The video footage of the other students in their personal capacity is these individual’s personal information, while the footage of the university staff is not their personal information.

[26] Although the information in the records includes information that is not the personal information of other individuals, the information may still be exempt under section 20, read in conjunction with section 49(a), which the university has claimed to apply to all of the records at issue.

[27] As the records contain the personal information of the appellant and other individuals, I will now consider whether the university should be allowed to claim the discretionary exemption in section 20, read in conjunction with section 49(a). If necessary, I will also consider whether the discretionary exemption in section 49(b) applies to the personal information in the records.

B. Should the university be allowed to raise the discretionary threat to safety or health exemption in section 20 late?

[28] The Code of Procedure (the Code) provides basic procedural guidelines for parties involved in appeals before this office. Section 11 of the Code addresses circumstances where institutions seek to raise new discretionary exemption claims during an appeal. Section 11.01 states:

In an appeal from an access decision an institution may make a new discretionary exemption within 35 days after the institution is notified of the appeal. A new discretionary exemption claim made within this period shall be contained in a new written decision sent to the parties and the IPC. If the appeal proceeds to the Adjudication stage, the Adjudicator may decide not to consider a new discretionary exemption claim made after the 35-day period.

[29] The purpose of the policy is to provide a window of opportunity for institutions to raise new discretionary exemptions without compromising the integrity of the appeal process. Where the institution had notice of the 35-day rule, no denial of natural justice was found in excluding a discretionary exemption claimed outside the 35-day period.⁶

[30] In determining whether to allow an institution to claim a new discretionary exemption outside the 35-day period, the adjudicator must also balance the relative prejudice to the institution and to the appellant.⁷ The specific circumstances of each appeal must be considered individually in determining whether discretionary exemptions can be raised after the 35-day period.⁸

[31] The parties were asked to consider the following:

1. 1. Whether the appellant has been prejudiced in any way by the late raising of a discretionary exemption. If so, how? If not, why not?
2. 2. Whether the institution would be prejudiced in any way by not allowing it to apply an additional discretionary exemption in the circumstances of this appeal. If so, how? If not, why not?
3. 3. By allowing the institution to claim an additional discretionary exemption, would the integrity of the appeals process been compromised in any way? If so, how? If not, why not?

[32] The university provided both confidential and non-confidential representations on this issue. In its non-confidential representations, it submits that the appellant has not been prejudiced in any way by the late raising of section 20. The university states that it is seeking to protect the individuals who provided their personal views in the incident reports from further harm. It states it would not want to endanger the individuals mentioned in the reports and identified in the videos, as well as the university community, due to a procedural error on its part. It relies on Order P-1544, where Adjudicator Donald Hale spoke to the weight of section 20 saying:

In the circumstances of this appeal, and because of the sensitive nature of the information in these records, I am prepared to consider the application of these exemptions. I am not satisfied that the appellant will suffer any real prejudice should I do so. Particularly with respect to section 20 and because these records deal with very real security concerns, I am inclined to err on the side of caution to ensure that the health or safety of individuals is not put at risk through the disclosure of information which may properly qualify for exemption under these sections.

Analysis/Findings

[33] The university raised the application of section 20 during the mediation stage of the appeals process. The appellant had an opportunity to respond to the late raising of this exemption by the university when providing his representations in response to the Notice of Inquiry sent to him. He chose not to provide representations, however. I find that the integrity of the appeals process would not be compromised in any way by the addition of the section 20 exemption in the circumstances of this appeal. The late raising of section 20 did not slow or prevent progress in either the mediation or adjudication stages of the appeal.

[34] I find that the appellant has not been prejudiced by the late raising of the section 20 discretionary exemption. I further find that the university would be prejudiced by not allowing it to apply this additional discretionary exemption in the circumstances of this appeal, particularly as the records deal with security concerns that affect the university community.

[35] Therefore, I am allowing the university to raise the application of section 20, read in conjunction with section 49(a).

C. Does the discretionary threat to safety or health exemption at section 20, read in conjunction with section 49(a), apply to the information at issue?

[36] Section 47(1) gives individuals a general right of access to their own personal information held by an institution. Section 49 provides a number of exemptions from this right.

[37] Section 49(a) reads:

A head may refuse to disclose to the individual to whom the information relates personal information,

where section 12, 13, 14, 14.1, 14.2, 15, 16, 17, 18, 19, 20 or 22 would apply to the disclosure of that personal information.

[38] Section 49 (a) of the Act  recognizes the special nature of requests for one’s own personal information and the desire of the legislature to give institutions the power to grant requesters access to their personal information.⁹

[39] Where access is denied under section 49(a), the institution must demonstrate that, in exercising its discretion, it considered whether a record should be released to the requester because the record contains his or her personal information.

[40] Section 20 states:

A head may refuse to disclose a record where the disclosure could reasonably be expected to seriously threaten the safety or health of an individual.

[41] For this exemption to apply, the institution must provide detailed and convincing evidence about the potential for harm. It must demonstrate a risk of harm that is well beyond the merely possible or speculative although it need not prove that disclosure will in fact result in such harm. How much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences.¹⁰

[42] An individual’s subjective fear, while relevant, may not be enough to justify the exemption.¹¹

[43] The term individual is not necessarily confined to a particular identified individual, and may include any member of an identifiable group or organization.¹²

[44] The university provided both confidential and non-confidential representations on this issue. In its non-confidential representations, it states that disclosure of the records would be expected to seriously threaten the safety and health of not only members of the university community, but also the appellant himself. It states further that the appellant, a former student of the university, was banned from campus during this appeal process based on the incidents that are described in the requested records.

[45] The university relies on Order PO-1939, where Adjudicator Laurel Cropley stated:

... that a threat to safety as contemplated by section 20 is not restricted to an actual physical attack. Where an individual's behaviour is such that the recipient reasonably perceives it as a threat to his or her safety, the requirements of this section have been satisfied."

[46] Based on my review of the records and the university’s confidential and non-confidential representations, and in the absence of representations from the appellant, I find that disclosure of the records could reasonably be expected to seriously threaten the safety of individuals within the university community. The records concern these individuals’ interaction with the appellant and the university has provided detailed and convincing evidence in its confidential representations, as supported by the records, that the test in section 20  of the Act  has been met.

[47] Accordingly, subject to my review of the university’s exercise of discretion, I find that the records are exempt by reason of section 20, read in conjunction with section 49(a).

D. Did the institution exercise its discretion under exemption at section 20, read in conjunction with section 49(a)? If so, should this office uphold the exercise of discretion? If so, should this office uphold the exercise of discretion?

[48] The sections 20 and 49(a) exemptions are discretionary and permit an institution to disclose information, despite the fact that it could withhold it. An institution must exercise its discretion. On appeal, the Commissioner may determine whether the institution failed to do so.

[49] In addition, the Commissioner may find that the institution erred in exercising its discretion where, for example,

• • it does so in bad faith or for an improper purpose
• • it takes into account irrelevant considerations
• • it fails to take into account relevant considerations.

[50] In either case this office may send the matter back to the institution for an exercise of discretion based on proper considerations.¹³ This office may not, however, substitute its own discretion for that of the institution.¹⁴

[51] Relevant considerations may include those listed below. However, not all those listed will necessarily be relevant, and additional unlisted considerations may be relevant:¹⁵

• • the purposes of the Act , including the principles that
  • o information should be available to the public
  • o individuals should have a right of access to their own personal information
  • o exemptions from the right of access should be limited and specific
  • o the privacy of individuals should be protected
• • the wording of the exemption and the interests it seeks to protect
• • whether the requester is seeking his or her own personal information
• • whether the requester has a sympathetic or compelling need to receive the information
• • whether the requester is an individual or an organization
• • the relationship between the requester and any affected persons
• • whether disclosure will increase public confidence in the operation of the institution
• • the nature of the information and the extent to which it is significant and/or sensitive to the institution, the requester or any affected person
• • the age of the information
• • the historic practice of the institution with respect to similar information.

[52] The university provided both confidential and non-confidential representations on this issue. In its non-confidential representations, it states that it took into consideration that individuals should have access to their own information, that exemptions to access should be limited and specific and that the head must consider the individual circumstances of the request. The university states that in this instance, it provided as much information as possible to the appellant to help satisfy his request, including his transcript, academic information and still images of the appellant from the Department of Safety.

Analysis/Findings

[53] It is clear from the university’s representations that the university took into account relevant factors, including the particular circumstances of the appellant’s case. I find that the university did not take into account irrelevant factors.

[54] Based on my review of the records and the university’s confidential and non-confidential representations, and in the absence of representations from the appellant, I find that the university exercised its discretion in a proper manner in denying access to the records under section 20, read in conjunction with section 49(a).

[55] Accordingly, I uphold the university’s decision to withhold the records under section 20, read in conjunction with section 49 (a) of the Act . Having found the records to be exempt from disclosure under section 20, read in conjunction with section 49(a), it is not necessary for me to review the possible application of section 49(b) to them.

ORDER:

I uphold the university’s decision and dismiss the appeal.

Original Signed by: Diane Smith Adjudicator

March 31, 2015

---

¹ Right of access to one’s own personal information.

² Order 11.

³ Orders P-257, P-427, P-1412, P-1621, R-980015, MO-1550-F and PO-2225.

⁴ Orders P-1409, R-980015, PO-2225 and MO-2344.

⁵ Order PO-1880, upheld on judicial review in Ontario (Attorney General) v. Pascoe, [2002] O.J. No. 4300 (C.A.).

⁶ Ontario (Ministry of Consumer and Commercial Relations v. Fineberg), Toronto Doc. 220/95 (Div. Ct.), leave to appeal dismissed [1996] O.J. No. 1838 (C.A.). See also Ontario Hydro v. Ontario (Information and Privacy Commissioner) [1996] O.J. No. 1669 (Div. Ct.), leave to appeal dismissed [1996] O.J. No. 3114 (C.A.).

⁷ Order PO-1832.

⁸ Orders PO-2113 and PO-2331.

⁹ Order M-352.

¹⁰ Ontario (Community Safety and Correctional Services) v. Ontario (Information and Privacy Commissioner), 2014 SCC 31 (CanLII) at paras. 52-4.

¹¹ Order PO-2003.

¹² Order PO-1817-R.

¹³ Order MO-1573.

¹⁴ Section 54(2).

¹⁵ Orders P-344 and MO-1573.