ORDER PO-3666

Appeal PA15-652

McMaster University

November 10, 2016

Summary: The issue in this appeal is whether emails sent to or by an Associate Professor (the professor) are in the custody or control of McMaster University (the university). The professor was retained by a third party to provide expert testimony in a court proceeding and the requested emails pertain to the professor’s appearance in the court proceeding. In this order, the adjudicator finds that the records are not in the university’s custody or control, because they do not relate to the university’s mandate and functions and they do not relate to the professor’s work responsibilities. The appeal is dismissed.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, section 10(1).

Orders and Investigation Reports Considered: MO-2993.

Cases Considered: City of Ottawa v. Ontario, 2010 ONSC 6835 (Div. Ct.), leave to appeal refused (March 30, 2011), Doc. M39605 (C.A.).

OVERVIEW:

[1]  This order disposes of the sole issue raised as a result of an appeal of an access decision made by McMaster University (the university) in response to a request made under the Freedom of Information and Protection of Privacy Act  (the Act ). The request was for access to a named Associate Professor’s (the professor) incoming and outgoing emails over a specified time period relating to a court action between Hamilton Health Services Corporation and Brant Child and Family Services.

[2]  The university issued an access decision to the requester, advising that it did not have custody or control over the requested records and that, alternatively, the records are excluded under section 65(8.1)(a) (research exclusion) of the Act .

[3]  The requester (now the appellant) appealed the university’s decision to this office. During the mediation of the appeal, the university advised the mediator that the requested records are not within its custody or control because they do not relate to matters in which it was involved and that the professor was not acting as a representative of the university with respect to these matters. The appellant advised the mediator that she disagreed, because the professor has spoken on behalf of the university at a panel discussion hosted by the university on the subject matter of the request. In turn, the university indicated that it hosts various panels and discussions and that the speakers at these panels are serving as experts, but not as university representatives.

[4]  The appeal then moved to the adjudication stage of the appeals process, where an adjudicator conducts an inquiry. I sought and received representations from both parties. Representations were shared in accordance with this office’s Practice Direction 7. In its representations, the university withdrew its claim with respect to the exclusion in section 65(8.1)(a).

[5]  For the reasons that follow, I find that the requested records are not under the university’s custody or control. Consequently, there is no right of access to the records under the Act . I dismiss the appeal.

DISCUSSION:

[6]  The sole issue in this appeal is whether the university has custody or control of the requested emails. In making this determination, the starting point is section 10(1)  of the Act , which reads in part:

Every person has a right of access to a record or a part of a record in the custody or control of an institution unless . . .

[7]  Under section 10(1) , the Act  applies only to records that are in the custody or under the control of an institution. A record will be subject to the Act  if it is in the custody or under the control of an institution; it need not be both. [1] A finding that a record is in the custody or control of an institution does not necessarily mean that a requester will be provided access to it. [2] A record within an institution’s custody or control may be excluded from the application of the Act under one of the provisions in section 65, or may be subject to a mandatory or discretionary exemption founds in sections 12 through 22 and 49.

[8]  The courts and this office have applied a broad and liberal approach to the custody or control question. [3] Based on this approach, this office has developed a list of factors to consider in determining whether or not a record is in the custody or control of an institution, as follows. [4] The list is not intended to be exhaustive. Some of the listed factors may not apply in a specific case, while other unlisted factors may apply.

• Was the record created by an officer or employee of the institution? [5]
• What use did the creator intend to make of the record? [6]
• Does the institution have a statutory power or duty to carry out the activity that resulted in the creation of the record? [7]
• Is the activity in question a core, central or basic function of the institution? [8]
• Does the content of the record relate to the institution’s mandate and functions? [9]
• Does the institution have physical possession of the record, either because it has been voluntarily provided by the creator or pursuant to a mandatory statutory or employment requirement? [10]
• If the institution does have possession of the record, it is more than bare possession? [11]
• Does the institution have the authority to regulate the record’s content, use and disposal? [12]
• To what extent has the institution relied on the record? [13]
• How closely is the record integrated with other records held by the institution? [14]
• What is the customary practice of the institution and similar institutions in relation to the possession or control of records of this nature, in similar circumstances. [15]

[9]  In determining whether records are in the custody or control of an institution, the above factors must be considered contextually in light of the purpose of the legislation. [16]

[10]  In Canada (Information Commissioner) v. Canada (Minister of National Defence), [17] the Supreme Court of Canada adopted the following two-part test on the question of whether an institution has control of records that are not in its physical possession:

• Do the contents of the document relate to a departmental matter?
• Could the government institution reasonably expect to obtain a copy of the document upon request?

Representations

[11]  The university advises that the professor who is the subject matter of the request is one of the founders of a particular specialized program at the university. The university further advises that in September of 2014, Hamilton Health Sciences Corporation submitted a court application pursuant to section 40(4) of the Child and Family Services Act, naming Brant Child and Family Services, and later, the parents of the child to whom the application related, as well as Six Nations of the Grand River Child and Family Services Department as respondents. The court hearing involved a hospital seeking a court order to apprehend and treat a child. The professor was retained in her personal capacity as an expert witness by certain respondents for the hearing and testified at the hearing. [18]

[12]  The university’s position is that the appellant is seeking access to the professor’s personal emails in relation to the court proceedings, on the grounds that they may be contained in a university issued email account or stored on a university server or computer even though the records are not in the university’s custody or control.

[13]  The university submits that individual email account holders maintain a reasonable expectation of privacy with respect to their university issued email accounts and that it does, as a matter of practice, permit individuals to use their accounts for purposes other than university-related matters, such as personal use or in relation to other professional undertakings. In addition, the university states that it does not have an unlimited and general right to access the email content of its faculty regardless of whether the emails are stored on university servers or email accounts, unless they are related to the university’s undertaking.

[14]  The university cites the case of City of Ottawa v. Ontario [19] to support its position and argues that, in that case, the city permitted its employees to use its email system for personal purposes, subject to monitoring at any time without the knowledge of the users. The stated purpose of the access was to monitor for security breaches and non-compliance with city policies and procedures, and for network management purposes.  The access request was for emails related to an employee’s volunteer work on the Board of Directors of a Children’s Aid Society. The city refused the request on the basis that these emails were not related to the employee’s duties. [20]

[15]  The university states that this office concluded that the city had custody or control of the emails because the city had physical possession of them on its server, as well as the authority to monitor and regulate the email system. On judicial review, the Divisional Court overturned the adjudicator’s decision and held that the city did not have custody or control of the employee’s personal information simply by virtue of such communications being transmitted and stored on its computers and servers.

[16]  The university also cites the two-part test articulated by the Supreme Court of Canada in National Defence, [21] arguing that the requested emails do not relate to a university undertaking or to the professor’s employ with the university. The university states:

Any correspondence to or from [the professor] in relation to the subject matter of the requested records is her personal correspondence relating to her retainer as an expert witness, and is not correspondence in any way whatsoever related to a University undertaking or her position as an associate professor with the University. The subject matter of the requested records simply does not relate to matters in respect of which McMaster has an interest or was involved.

Moreover, given that the requested email correspondence relates to [the professor’s] retention as an expert witness outside the scope of her employment with the University, the University has no authority to demand production of such correspondence and could not reasonably expect to obtain a copy upon request.

[17]  The appellant states that the professor is one of the original founders of a particular program at the university and that her research focuses on the subject matter of the specialized program. The appellant goes on to advise that the professor was retained as an expert witness in the court case to provide evidence on subjects that fall within the ambit of her expertise, and not as a private citizen. The professor, the appellant argues, was asked to testify and was found to be an expert in these subjects because of her position at the university. In addition, the appellant states that the professor took part in two public events that focused on the court case, one of which was organized and hosted by the program that the professor founded, where she currently works as a faculty member and researcher. The appellant submits that faculty members are expected to take part in public events, as set out in the university’s Code of Conduct for Faculty and in keeping with its mission statement.

[18]  The appellant goes on to state:

The emails I am seeking are directly related to [the professor’s] work as the founder of the [specific program] at McMaster, her job as associate professor and her research on aboriginal issues. As part of the McMaster code of conduct, she is expected to take part in community discussions about her work. She was also only asked to be part of those discussions and the court case because of her work for McMaster and her university qualifications. The content of the emails and the issues being discussed in court and in the events are directly related to the issues she teaches and researches at McMaster University. It is not in relation to unrelated professional undertakings or volunteer work. [22]

[19]  The appellant further argues that the university’s statement that it permits individuals to use their work email accounts for purposes other than university-related matters is in direct contravention of its published electronic communications policy, which states that email accounts are to be used to communicate on official university matters. The appellant then cites a number of past orders of this office to support her position. [23]

[20]  Lastly, the appellant submits that even though the records are in the custody or control of the university, it has the option of claiming exemptions that may apply, including the personal privacy exemption.

[21]  In reply, the university argues that the orders relied on by the appellant have little precedential value for the purposes of this appeal because they are distinguishable on the facts and all pre-date the National Defence and City of Ottawa decisions.

[22]  The university reiterates the two-part test articulated by the Supreme Court of Canada in National Defence. With respect to the first part of the test, the university submits that the emails at issue are standalone records, with no co-mingling of personal and institutional information. The university further states that it does not dispute that the professor’s expertise was the reason for her retention as an expert witness in the court proceeding that is the subject matter of the request. However, the professor’s credentials and areas of expertise do not create a nexus between the court proceeding and the university’s academic, scholarly and research mandates forming the core of its undertaking as an educational institution. The professor was retained by a third party to deliver a service, which was not an endeavour undertaken by her to further the university’s mandate. Similarly, the university argues, the professor’s participation in panel discussions after the conclusion of the court proceeding does not alter the fact that her involvement in the court proceeding was wholly unrelated to the university’s undertaking. Therefore, the university concludes that the records at issue do not relate to a departmental matter.

[23]   Turning to the second part of the test, the university argues that absent a reasonable expectation of access to a record by the university being established, part two of the test fails. The university states that the appellant claims that its email policy precludes personal use of emails which, in turn, places all emails generated from university emails accounts within its custody or control. The university argues that while its email policy is brief, it is erroneous to suggest that the policy either expressly or implicitly precludes the personal use of university issued email accounts. As a result, the university permits individuals the reasonable personal use of its email accounts, so long as the account holder uses the email account in a reasonable manner. The university goes on to argue that because it permits reasonable personal use of its email accounts, it has no reasonable expectation of compelling individuals, including the professor, to produce their personal emails upon request.

Analysis and finding

[24]  As previously stated, the courts and this office have applied a broad and liberal approach to the custody or control question. As well, a record will be subject to the Act  if it is in the custody or under the control of an institution.

[25]  I have carefully reviewed the parties’ representations in this case, and I find that the university does not have custody or control of the records that the appellant has requested. Records held by the university in connection with the professor’s duties as a professor are covered by the Act and subject to any applicable exemptions. However, as was held by the Divisional Court in the City of Ottawa case, records that were not related to an employee’s duties were found not to be in the city’s custody or control. Applying the principles set out by the Divisional Court to this appeal, I find that the communications relating to the professor’s appearance as an expert witness in a trial do not relate to her duties as a professor at the university. While I accept that the professor’s expertise is the result of her academic background, qualifications and ongoing research and learning, I agree with the university that this expertise does not “create a nexus between the court proceeding and the university’s academic, scholarly and research mandates forming the core of its undertaking as an educational institution.”

[26]  In other words, the requested records relate to a court appearance that was not mandated by the university and does not relate to the university’s functions. In addition, the court appearance does not relate to the professor’s responsibilities at the university.

[27]  The appellant argues that because the university’s electronic communications policy does not permit the use of email for purposes other than university-related matters, all emails on its server are in the university’s custody and control.

[28]   The appellant provided this office with a copy of the university’s Electronic Communications policy [24] which states, in part:

University Technology Services maintains McMaster University email system that provides email services to McMaster community. McMaster email accounts are to be used to communicate on official university matters.

Any copyright violations, commercial advertising, email harassment, chain letters, SPAMing, etc., are strictly forbidden and will be considered as a violation of this policy and will result in the immediate shutdown of the source email account or a mailing list.

It is [the] email account holder’s responsibility to keep the account in good standing, not give out passwords, hold responsibility for any activity originating from that account and use the email account in ways that are responsible, ethical and professional.

As part of normal system management, the university collects various types of data. This includes, but is not limited to, login/logout times, types of access, amount and size of messages sent and received, excluding the content of those messages, and amount of resources used. . .

. . .

UTS may be asked to disclose information from an individual’s electronic files or email account without the individual’s authorization and it will do so only upon:

• A written request from a University Manager or Officer co-signed or authorized by the appropriate Vice President.

• A search warrant.

[29]  I accept the university’s argument that the above policy does not preclude the personal use of emails on its servers. The Divisional Court considered a policy similar to this one in City of Ottawa, stating:

Understandably, employers who allow employees to use their electronic servers for personal matters will typically have policies to ensure that these electronic media are not being used in a manner that is inappropriate or illegal or that compromises the security of the entire system.

Employers from time to time may also need to access a filing cabinet containing an employee’s personal files. That does not make the personal files of the employee subject to disclosure to the general public on the basis that the employer has some measure of control over them. The nature of electronically stored files makes the need for monitoring more pressing and the actual monitoring more frequent, but it does not change the nature of the documents, nor the nature of the City’s conduct in relation to them. It does not, in my view, constitute custody by the City, within the meaning of the Act .

[30]  The findings of the Divisional Court have been followed in subsequent orders of this office. For example, in Order MO-2993, Assistant Commissioner Sherry Liang found that a similar email communication policy, in which limited and occasional personal use of IT resources was permitted, did not establish that an institution’s employee’s personal records created on the institution’s IT resources formed part of the institution’s record-holdings for the purposes of the Act . I adopt and apply the approach taken in Order MO-2993 to the circumstances in this appeal.

[31]  As previously stated, this office has developed a list of factors to be considered in determining whether or not a record is in the custody or control of an institution. Applying those factors to the requested records, I find that: the creator(s) of the records intended for them to be used in relation to the court proceeding; the university did not have a statutory power or duty to carry out the activity that resulted in the creation of the records; the records do not relate to a core, central or basic function of the university; the records do not relate to the university’s mandate and functions; and the university has not relied on the records. I further find that the requested records are similar to the type of records found not to be in the custody or control of the city in City of Ottawa, and are, therefore not in the university’s custody or control.

ORDER:

I find that the records are not in the custody or control of the university. The appeal is dismissed.

Original Signed By:		November 10, 2016
Cathy Hamilton
Adjudicator