ORDER MO-3557

Appeal MA15-319 & MA16-44

Housing Services Corporation

January 31, 2018

Summary: Housing Services Corporation (HSC) received a multi-part request for records under the Municipal Freedom of Information and Protection of Privacy Act , including for a named employee’s employment agreements and expenses. HSC disclosed some information to the requester. Some employment agreement and expense information HSC withheld under sections 10 (third party information), 11 (economic and other interests) or 14 (personal information), or as not responsive to the request. An affected party and the requester appealed HSC’s decision. HSC’s decision is upheld.

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. M.56 , as amended, sections 11(c), 11(d), 14, 2 (definition of “personal information”), 21(1).

Orders and Investigation Reports Considered: Orders PO-2842, PO-2905, MO-3339, Interim Order PO-1694-I, PO 3624.

Cases Considered: Merck Frosst Canada Ltd. v Canada (Health), 2012 SCC 3 (CanLII).

OVERVIEW:

[1]  This order considers two related appeals arising from a request for employment agreements and expense information for a named Housing Services Corporation (HSC) employee.

HSC received a request under the Act for access to, among other items:

1. All contracts given to a named employee by HSC or its subsidiaries between specified dates;
2. All expenses incurred by the named employee in any roles within HSC and/or its subsidiaries between specified dates; (together, the “contract and expense records”)

[2]  HSC granted access to some contract and expense records. Some HSC withheld under sections 10 (third party information), 11(c) and (d) (economic and other interests), 12 (solicitor-client privilege), and 14 (personal privacy) of the Act. In addition, some information in the contract and expense records HSC withheld as not responsive to the request.

[3]  The requester appealed HSC’s decision.

[4]  During mediation of the requester’s appeal, HSC decided to disclose some information in the contract and expense records it had initially withheld. It notified an affected party under section 21 of the Act about the proposed disclosure. The affected party objected to any additional disclosure of contract and expense information, arguing that the information is the affected party’s personal information and HSC should therefore withhold it under section 14 of the Act.

[5]  The affected party also objected to the disclosure of information to the requester that had already occurred. The affected party submits that HSC should have notified her under section 21 of the Act before disclosing any records responsive to the requester’s original 8-part request.

[6]  HSC issued a further revised decision dated December 16, 2015 (“latest decision”) granting access to information in the contract and expense records, while continuing to withhold some information as not responsive and some under sections 10, 11(c) and (d) and 14 of the Act. HSC no longer relied on section 12 of the Act to withhold any information in the contract and expense records.

[7]  The affected party appealed HSC’s latest decision.

[8]  During mediation, the requester narrowed the scope of their appeal to the withheld information in the contract and expense records, and decided not to seek any information in the contract and expense records withheld under section 10 of the Act.

[9]  Mediation did not resolve all of the issues so the affected party and requester’s appeals moved to adjudication. Given the common issues between the appeals, I issued one Notice of Inquiry for both appeals. The inquiry began by inviting representations from HSC and the affected party.

[10]  The affected party’s representations consented to HSC disclosing the contract responsive to the request for employment agreements, except for the affected party’s personal address. HSC has advised me it subsequently disclosed the employment contract in accordance with this consent, so I do not need to consider that record further in this order.

[11]  HSC’s representations also proposed to disclose the names of expense approvers wherever their signatures appeared in the responsive records, thereby revealing who approved the listed expenses.

[12]  I invited the requester to provide representations in response to the non-confidential representations of HSC and the affected party and the issues set out in a Notice of Inquiry. The affected party’s and HSC’s representations were also exchanged and they both provided further representations in response.

[13]  This order upholds HSC’s latest decision regarding the records and HSC’s decision to disclose the names of signatories in the expense records.

RECORDS:

[14]  As noted above, HSC advised me it has disclosed the record responsive to the request for employment contracts in accordance with the affected party’s consent. Therefore, the only remaining issues relate to the expense records not already disclosed to the requester. Comprising 130 pages of records numbered 6-1 to 6-130, these records contain invoices, receipts, credit card statements and expense reports for HSC credit cards (the “expense records”).

[15]  HSC states that it provided the affected party with a HSC credit card and authorized her to incur certain business expenses on behalf of HSC, including meals with HSC's clients and business partners and travel to business events. The affected party also used HSC credit cards for some personal expenses. HSC states that the affected party was required to reimburse personal expenses incurred.

[16]  HSC received a monthly statement from the credit card issuer detailing the charges incurred on the card. HSC states it required the affected party to submit an expense report with supporting receipts for those expenses. HSC reviewed the submitted receipts and expense report to verify the expenses. HSC would then pay the credit card issuer for the business expenses.

[17]  The expense records comprise the credit card statements, expense reports and supporting receipts for the period of the request.

[18]  The affected party is appealing HSC’s decision to disclose to the requester information in the expense records that HSC has not already disclosed but proposed in its latest decision to disclose. I note that this proposed additional disclosure by HSC includes information that it previously withheld under section 12. HSC’s representations confirm that it is no longer relying on section 12 to withhold any information.

[19]  HSC continues to withhold some information in the expense records under sections 10, 11(c) and (d) and 14 of the Act and some information in the expense records it considers is not responsive to the request.

[20]  Except for the information withheld under the section 10 exemption (third party information), the requester is appealing HSC’s decision to withhold information in the expense records.

[21]  The affected party also submits that HSC should have notified her under section 21 of the Act before disclosing any records responsive to the requester’s initial 8-part request.

ISSUES:

The issues in this appeal are:

1. Does the withheld information in the expense records contain “personal information” as defined in section 2(1)?
2. Does the mandatory exemption at section 14(1) apply to any personal information in the expense records?
3. Does the discretionary exemption at section 11 apply to information in the expense records withheld by HSC?
4. Did HSC exercise its discretion under section 11? If so, should I uphold the exercise of discretion?
5. Is the information HSC withheld as not responsive in the expense records responsive to the request?
6. Did HSC comply with the notice requirements in section 21(1) of the Act?

Preliminary Issue: Are the expense records misleading or not responsive to the request?

[22]  The affected party’s representations raise concerns that the records will be misleading if disclosed without further explanation or context. For example, the affected party states she incurred some expenses on behalf of others, but this is not apparent from the format of the records. The affected party suggests that HSC should take steps to provide clarification or explanation of responsive information it disclosed or intends to disclose. The affected party does not identify any particular obligations under the Act that would require HSC to take such steps.

[23]  HSC’s response to this issue, in summary, is that its only obligations are to search for and disclose records.

[24]  I am satisfied that HSC does not have any obligations under the Act that require it to provide clarification or explanation of the records at issue. As HSC notes in its representations, the affected party has complete freedom to comment publically on the contents of any records disclosed under the Act. I note that nothing precludes HSC from responding to questions, providing additional commentary, or clarifying any misunderstanding that may arise from use or reproduction of information disclosed under the Act. However, I am satisfied that HSC does not have any obligation under the Act to take any of these additional steps.

[25]  The affected party also suggests that some of the expense records are not responsive to the request. The affected party submits the responsive records contain two types of expense forms: credit card statements from the card issuer and personal expense forms. The affected party suggests the personal expense forms are not responsive.

[26]  HSC disagrees with the affected party. HSC refers to the relevant wording of the request (above) and submits that both the credit card forms and the expense claim forms comprise part of the records of "expenses incurred." It submits that, to the extent they are business records, the forms are responsive to the request. HSC also notes that the requester's reply representations confirm that the request includes expense forms.

[27]  I agree with HSC’s approach, which accords with the well-established principle that institutions should adopt a liberal interpretation of a request to achieve the purpose and spirit of the Act, with any ambiguity in the request resolved in a requester’s favour.

[28]  The affected party also submits that HSC treated a named corporation’s expenses as responsive though it was not a subsidiary of HSC. However, in the conclusion to her main representations, the affected party is equivocal about the status of the named corporation, stating it is “unclear whether [named corporation] was a subsidiary.” HSC responds that the named corporation was a HSC subsidiary during the period of the request and therefore falls within the scope of the request. Absent evidence from the affected party to support her submission, I have considered all records relating to the named corporation responsive.

Preliminary issue: Expense authority signatures

[29]  HSC withheld employee signatures in the expense records. HSC says the withheld signatures are those of HSC employees who approved business related expenses.

[30]  HSC cites previous orders that found signatures constitute personal information. However, recognising the public importance of accountability for public expenses, HSC has added to the records the individual’s name in each instance in the expense records where their signature appears. HSC proposes to disclose this name information to the requester in lieu of disclosing the individual’s signature. HSC submits this disclosure of expense approvers names permits a full accounting for its financial activities.

[31]  The requester’s representations accept HSC’s proposal to disclose names rather than signatures. The affected party’s representations also express support for disclosing information that shows that others approved the expenses incurred.

[32]  There is no doubt that the names of the approvers, in context, is business information not personal information. Therefore, as the parties all support disclosure of these names, and the names are not personal information, I order HSC to disclose this name information, without deciding the issue of the signatures. I will not consider the signatures further in this order.

DISCUSSION:

A. Does the withheld information in the expense records contain “personal information” as defined in section 2(1) and, if so, to whom does it relate?

[33]  To determine which sections of the Act may apply, it is necessary to decide whether the record contains “personal information” as defined in the Act.

[34]  HSC submits that expenses for personal items charged to an HSC credit card and paid for by the individual incurring the expenses (“personal expense information”) is personal information.

[35]  The personal expense information withheld includes the description of the personal expense, the amount of the expense and the total amount owing for the credit card statement in question (to prevent total monthly personal expense amounts being calculated).

[36]  HSC submits that personal expenses were never intended to be business expenses and that HSC never paid for them. HSC says the credit card receipts and the expense forms taken together confirm that personal items were not claimed as business expenses.

[37]  HSC submits that the personal expense information is personal information under the Act. It notes that the definition of personal information in paragraph (b) includes "information relating to [ .. ] financial transactions in which the individual has been involved" which it submits includes personal expenses. It also cites Order PO-2905, which found that personal expenses constituted personal information under paragraph (b).

[38]  HSC submits the personal expenses in the expense records are personal information because they relate entirely to amounts incurred in a personal capacity. It submits there is no public element to these expenses and disclosing them would be an invasion of privacy.

[39]  The requester submits that the fact that personal expenses, though repaid, were incurred on a corporate credit card means the information is not personal information. The requester cites Order PO-2842, where an employee’s personal records were found to be in the custody or control of his employer, in support of its submission.

[40]  HSC responds that Order PO-2842 dealt only with the threshold issue of custody and control over records held by an institution that were personal in nature, not the issue here, which is whether the information is personal information. HSC submits that the orders cited by the requester are consistent with their approach, because HSC accepts that it has custody and control of the records. HSC’s position is that the personal expenses are personal information and that it would be an unreasonable invasion of personal privacy to disclose them.

Analysis

[41]  I agree with HSC’s submission that the personal expense information is personal information of the person incurring the expense for the purpose of the Act. I am also satisfied that this conclusion is consistent with Order PO-2842. The excerpt from that order cited by the requester deals with the question of custody and control of records of a personal nature, not the issue of whether the information is personal information. As HSC submits, it accepts that it has custody and control over the records, but maintains that the personal expenses are personal information.

[42]  As I have found that the personal expenses are personal information of the person incurring the expense, I will now consider whether disclosing the personal expense information would be an unreasonable invasion of personal privacy under section 14(1) of the Act.

B. Does the mandatory exemption at section 14(1) apply to the personal information in the expense records?

[43]  Since the personal expense information constitutes personal information, HSC must withhold it unless it falls under a specific exception in section 14(1) of the Act.

[44]  HSC submits that the information is exempt from disclosure under section 14(1). The requester submits that the personal expenses are corporate records and therefore not personal information. The requester did not address whether section 14 applies to the personal expenses.

[45]  Section 14(1)(f) permits disclosure of the personal expenses if it would not be an unjustified invasion of personal privacy. Section 14(3) lists presumptive invasions.

[46]  Section 14(2) contains other factors relevant to whether disclosure is an unjustified invasion, though those factors are not exhaustive.

[47]  HSC submits that section 14(3)(f) applies to the personal expenses. Section 14(3)(f) applies to information that "describes an individual's finances, income, assets, liabilities, net worth, bank balances, financial history or activities, or creditworthiness". HSC submits that previous orders have found that personal expenses and purchases can fall under section 14(3)(f). HSC submits that the personal expenses are purchases for a personal purpose.

[48]  The affected party’s representations support HSC’s position that personal expenses incurred and repaid should not be disclosed, though the affected party does not refer to specific provisions of section 14(3). [1]

Analysis

[49]  I am satisfied that the personal expenses fall within the scope of the section 14(3)(f) presumption. In reaching this conclusion I have considered Order PO-2905. That order involved a request for information about an expense that was initially treated as a business expense, but the employee later personally repaid, after determining the expense was not a legitimate business expense. Order PO-2905 found that the section 14(3)(f) presumption did not apply because the transaction had initially been treated as a business transaction. HSC submits the personal expenses at issue were never treated as business expenses and all personal expenses were paid by the employee, so there is a clear demarcation between personal and business expenses, unlike Order PO-2905.

[50]  I agree with the distinction HSC makes between the personal expenses at issue and the expense at issue in Order PO-2905. I am satisfied that if details of personal expenses reimbursed by the employee are disclosed, it will reveal the financial activities of the employee, so the section 14(3)(f) presumption applies to the personal expenses.

[51]  Once established, a presumed unjustified invasion of personal privacy under section 14(3) can only be overcome if section 14(4) or the “public interest override” at section 16 applies. [2] There is no suggestion that section 14(4) applies and the public interest override was not raised by the parties. I therefore find that disclosure of the personal expense information is an unjustified invasion of personal privacy under section 14(1)(f) of the Act. I uphold HSC’s decision to withhold this information.

1. Does the discretionary exemption at section 11 apply to information withheld by HSC in the expense records?

[52]  Section 11 is a discretionary exemption that permits HSC to withhold information where disclosure could reasonably be expected to prejudice the economic interests of an institution or the competitive position of an institution; (section 11(c)) or where disclosure could reasonably be expected to be injurious to the financial interests of an institution (section 11 (d)).

[53]  The information withheld by HSC under section 11 comprises credit card account information, including HSC credit card numbers.

[54]  HSC submits that disclosing the withheld credit card information would expose HSC's private financial information to the public in a way that creates a risk that the information could be used by a third party to steal from HSC or the credit card issuer.

[55]  HSC provides documentary evidence of the risk of credit card fraud and that keeping account information private is an essential part of preventing such fraud. HSC also submits that disclosing account information is contrary to best practices in financial information security guidance supplied by credit card issuers. It provides documentary support for the credit card issuer’s advice on this issue.

[56]  Neither of the other parties addressed section 11.

[57]  I am satisfied based on HSC’s submissions and my review of the information that section 11(c) and (d) applies to the withheld credit card account information.

C. Did HSC exercise its discretion under section 11? If so, should this office uphold the exercise of discretion?

[58]  The section 11 exemption is discretionary, and permits HSC to disclose information, despite the fact that it could withhold it. HSC must exercise its discretion. On appeal, I may determine whether HSC failed to do so.

[59]  I am satisfied that HSC appropriately exercised its discretion to withhold information under section 11.

[60]  HSC submits that it considered the purposes of the Act, the interests of the exemption and the benefits of public disclosure, among other considerations. It elaborates that disclosure of the credit card account information at issue would expose HSC to a real and substantial risk of fraud or identity theft that would enable the misuse of public funds and resources if it eventuated. It submits there is little to no benefit in releasing the information. HSC cites Order MO-3339 in support of its position, which found that disclosing similar information would not assist in shedding any light on an institution’s activities.

[61]  In the circumstances, I uphold HSC’s exercise of discretion.

D. Is the information HSC withheld as not responsive in the expense records responsive to the request?

[62]  HSC withheld some information in the records as not responsive on the basis that the expenses were not incurred by the employee named in the request. It submits that it is evident that the information withheld as non-responsive relates to other individuals because the other individuals responsible for the expenses are identified in the records.

[63]  The requester objects to notes made on expense forms being withheld as not responsive. The requester submits that if a page of an expense form is responsive, the information on that page should be considered responsive, unless an identified exemption applies to the information. The requester suggests that the notes may provide valuable context to the expenses.

[64]  In its reply representations, HSC submits that information withheld as not responsive are personal expenses and do not relate to the request for the named employee’s expenses incurred in any of the employee’s roles at HSC.

[65]  HSC also submits that information treated as not responsive, if responsive, would contain personal information in the form of personal expenses that would be exempt from disclosure under section 14.

[66]  I have reviewed the information withheld as not responsive. I am satisfied that it is outside the scope of the request. In one instance (record 6-1) the information withheld as not responsive contains expenses of the named employee but that are outside the date range of the request. In all other instances the withheld information relates to expenses incurred by other individuals. Where notes have been withheld as not responsive, those notes are outside the scope of the request because they do not relate to the expenses of the employee named in the request.

E. Did HSC comply with the notice requirements set out in section 21(1) of the Act?

[67]  HSC disclosed some records responsive to the requesters original 8-part request without providing notice to the affected party under section 21 of the Act. The affected party submits that she had an interest in all of the records responsive to the request and that HSC therefore ought to have invited her input prior to disclosing any records.

[68]  The question is whether HSC should have notified the affected party before it disclosed any records responsive to the requester’s original 8-part request.

[69]  Section 21 sets out HSC’s obligation under the Act to provide notice of an access request:

A head shall give written notice in accordance with subsection (2) to the person to whom the information relates before granting a request for access to a record,

(a) that the head has reason to believe might contain information referred to in subsection 10 (1) that affects the interest of a person other than the person requesting information; or

(b) that is personal information that the head has reason to believe might constitute an unjustified invasion of personal privacy for the purposes of clause 14 (1)(f).

[70]  After providing a history of HSC and its funding sources, the affected party’s representations state:

I am of the firm opinion that any information prior to May 2013 should not have been released by HSC except for the expenses funded directly and clearly by the taxpayer through government funding. However it appears that the barn door is closed as HSC has already released information regarding $14,000 of expenses including those incurred in 2012.

[71]  The affected party goes on to submit that information already disclosed had “inherent fairness issues” that affected her and other third parties whose names appear in the expense records and should not have been released without giving her and other third parties an opportunity to provide input. The affected party says her reputation and finances were “irreversibly affected by the prior disclosure because the media accessed the materials”.

[72]  HSC responds that it did not disclose any personal information in the records prior to giving the affected party notice under section 21. HSC submits that to the extent the expense records at issue include personal information, all such information was withheld in the records responsive to the requester’s original 8-part request. It submits therefore that notice was not required until the requester sought disclosure of the withheld personal information.

[73]  In particular, HSC says the expense information disclosed to the requester comprised:

• receipts for corporate expenses
• corporate credit card statements; and
• expense claim forms for corporate expenses

[74]  HSC submits that this information is not personal information, but HSC's expenses that the affected party was authorized to charge to a HSC credit card. HSC submits that the only personal information in the expense records relates to personal expenses incurred by the affected party, which it withheld in the disclosed records.

[75]  HSC submits that the disclosed expense records do not reveal any personal information about the affected party such as her address, contact information or banking information.

[76]  HSC also cites previous orders that make clear that business expenses are not personal information.

Analysis

[77]  Section 21(1)(b) requires that HSC notify affected parties where it is contemplating disclosure of information HSC has reason to believe might constitute an unjustified invasion of personal privacy.

[78]  Order PO-1657 described the purpose of the equivalent notice provisions in the Freedom of Information and Protection of Privacy Act (FIPPA) [3] is:

to ensure that procedural fairness is accorded to individuals whose privacy interests may be at stake. Adherence to these provisions permits the subject individual to make representations as to whether or not the information should be disclosed and, if the head decides to disclose information, to appeal the matter to the Commissioner before disclosure actually takes place.

[79]  Interim Order PO-1694-I considered the threshold for notification under the notice provisions in FIPPA. The adjudicator expressed the view that use of the word “might” creates a low threshold for determining whether notification is required. Pertinent to this appeal, the adjudicator expressed the view that in order to trigger the notification, an institution must first have reason to believe that a record might contain one of the types of information listed in the section.

[80]  As noted in Order PO-3624, the Supreme Court of Canada, in Merck Frosst Canada Ltd. v Canada (Health), also considered the proper threshold for notification of a third party. It stated that disclosure without notice is only justified in clear cases where the institution concludes that there is no reason to believe that the record might contain exempted material. [4]

[81]  From my review of the records, I am satisfied that HSC acted in accordance with procedural fairness, satisfying the requirement for disclosure without notice in Interim Order PO-1694-I and Merck Frosst and complying with section 21(1) of the Act.

[82]  HSC had no reason to believe that the information it disclosed without notice might contain exempted material. The affected party objected to business expense information being disclosed without notice to her. It is well settled that business expense information is not personal information for the purposes of the Act. [5] I note that HSC also disclosed various financial statements, which also clearly do not contain any personal information. Therefore, as HSC submits, it did not disclose any personal information (of the affected party or any other potentially affected parties) prior to the affected party receiving notice under section 21(1).

[83]  Despite the low threshold for notice, I am satisfied that HSC was not required to notify the affected party under section 21(1) prior to disclosing the business expense information and financial statements. As no personal information was involved, no procedural fairness obligation arose with respect to the affected party. HSC appropriately discharged its section 21(1)(b) obligations to the affected party in the circumstances.

ORDER:

[84]  I order HSC to disclose to the requester by March 8, 2018, but not before March 5, 2018.

1. the additional information in the expense records it decided to disclose in its latest decision; and
2. the names of employees whose signatures appear in the responsive records approving the expense records.

[85]  I otherwise uphold HSC’s decision dated December 16, 2015 to withhold information in the expense records as not responsive to the request, or under sections 11(c), 11(d) or 14 of the Act.

Original Signed by:		January 31, 2018
Hamish Flanagan
Adjudicator