INTERIM ORDER MO-3561-I

Appeal MA14-18-2

Kingston Police Services Board

February 13, 2018

Summary: The Kingston Police Services Board (the police) received a request under the Municipal Freedom of Information and Protection of Privacy Act  (the Act ) for access to information pertaining to a “CPIC and Security check”. In Order MO-3239, the adjudicator did not uphold the application of the section 52(3)3 exclusion (labour relations or employment related information) claimed by the police and ordered them to provide an access decision to the appellant with respect to any responsive records. The police issued an access decision relying on a number of exemptions to deny access to the responsive records, in full. At mediation, the appellant challenged the reasonableness of the police’s search for responsive records. In the course of adjudication, an individual consented to the disclosure to the appellant of any of her information that may appear in the records. In addition, the police took the position that another institution had a greater interest in some of the responsive records. In this order, the adjudicator upholds the reasonableness of the police’s search for responsive records and orders that the consenting individual’s information be disclosed to the appellant, along with other information that only relates to him. The adjudicator also finds that only certain information qualifies for exemption and that the police have failed to establish that another institution has a greater interest in some of the records. Finally, the adjudicator defers the consideration of whether the remaining personal information of other identifiable individuals that may appear in the records may qualify for exemption under section 38 (b) of the Act  (personal privacy).

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. M.56 , as amended, sections 2(1), 7(1), 8(1)(c), 8(1)(e), 8(1)(i), 8(1)(k), 8(1)(l), 13, 17, 18(4), 38 (a) and 38 (b).

Orders Considered: MO-1698, MO-3239 and PO-2582.

OVERVIEW:

[1]  The Kingston Police Services Board (the police) received a request under the Municipal Freedom of Information and Protection of Privacy Act  (the Act  or MFIPPA ) for access to information pertaining to a “CPIC and Security check”. The request was for:

… all documents, searches with respect to my application for CPIC and security check and reasons for a negative result. This was made for a [named company] position to clean at the Kingston Police Station. Also want criteria used in decision making process.

[2]  The police identified records that were responsive to the request and initially relied on the exclusion at section 52(3) 3 of the Act  (labour relations or employment information) to deny access to them, in full. In Order MO-3239, I did not uphold the application of the section 52(3)3 exclusion and ordered the police to provide an access decision to the appellant with respect to any responsive records.

[3]  The police then issued their access decision letter. Relying on section 38(a) (discretion to refuse requester’s own information), in conjunction with sections 7(1) (advice or recommendations), 8(1)(c), 8(1)(e), 8(1)(i) and 8(1)(k) (law enforcement) as well as 13 (danger to health or safety) of the Act , the police denied access to the responsive records, in full.

[4]  The appellant appealed the police’s decision denying access.

[5]  At mediation, the appellant maintained that additional responsive records ought to exist. Accordingly, the reasonableness of the police’s search for responsive records was added as an issue in the appeal.

[6]  Mediation did not resolve the appeal and it was moved to the adjudication stage of the appeals process where an adjudicator conducts an inquiry under the Act .

[7]  I commenced my inquiry by sending the police and an affected party a Notice of Inquiry setting out the facts and issues in the appeal. The police provided responding representations but asked that they be withheld due to confidentiality concerns. The affected party consented to the disclosure to the appellant of any of her information that appeared in the records. I then issued a sharing decision upholding the police’s claim of confidentiality with respect to only a specific portion of their representations.

[8]  I subsequently sent a Notice of Inquiry to the appellant along with the non-confidential representations of the police. The appellant advised that he would not be making any submissions in response but instead would “rely on all submissions and representations that [he] had made in the past”.

[9]  At paragraphs 19 to 21 of Order MO-3239, I summarized the appellant’s representations that he made in the appeal in the following way:

In his representations, the appellant sets out his work history which involved working as a police officer and in jails, federal institutions and Police stations as well as internationally. He states that one of the jobs he held required that he obtain a high level security clearance. He submits that:

I had full access to all secure and restricted areas in all of these places, and was privy to all sensitive reports and files.

I had access to the Corrections Canada computer system as well as the provincial court computer system. I also had access to CPIC.

He submits that in the course of his former employment, he attended at the police station “for meetings and presentations and was granted entry to secure areas”.

He concludes his representations by further submitting:

I am surmising that there is information on CPIC that resulted in a negative decision. People’s lives and careers have been dramatically affected by unproven and false allegations or circumstances that are on or remain on police computers. I feel vulnerable, my reputation ruined, and my livelihood affected by what the police will not release.

…

I was not seeking employment with the police force and the records must not be excluded from the Act .

[10]  In this order, I uphold the reasonableness of the police’s search for responsive records and order that the consenting individual’s information be disclosed to the appellant, along with other information that only relates to him. I also find that certain information qualifies for exemption under section 38(a), in conjunction with sections 8(1)(c), 8(1)(i) and 8(1)(l), but that no other exemptions claimed by the police would apply. I defer the consideration of whether the remaining personal information of other identifiable individuals that may appear in the records may qualify for exemption under section 38 (b) of the Act  (personal privacy). Finally, I determine that the police have failed to establish that another institution has a greater interest in some of the records.

RECORDS:

[11]  The records at issue include a Records Check Form, emails, Intelligence/Database Checks Form, Screen Shot, Occurrence Summaries and General Occurrence Reports.

ISSUES:

1. Did the institution conduct a reasonable search for records?
2. Do the records contain “personal information” as defined in section 2(1) and, if so, to whom does it relate?
3. Does the discretionary exemption at section 38(a) in conjunction with sections 7(1), 8(1)(e), 8(1)(i), 8(1)(k), 8(1)(l) and/or 13 apply to the information at issue?
4. Did the institution exercise its discretion under section 38(a)? If so, should this office uphold the exercise of discretion?

DISCUSSION:

Preliminary Issue

[12]  In their representations, for the first time, the police submitted that some of the responsive records were created by other agencies (both law enforcement and non-law enforcement agencies), and that, relying on section 18(4)  of the Act , those agencies have a greater interest in the records. The police add that those agencies should be consulted before any information is disclosed.

[13]  Section 18 reads:

(1) In this section,

“institution” includes an institution as defined in section 2 of the Freedom of Information and Protection of Privacy Act.

(2) The head of an institution that receives a request for access to a record that the institution does not have in its custody or under its control shall make reasonable inquiries to determine whether another institution has custody or control of the record, and, if the head determines that another institution has custody or control of the record, the head shall within fifteen days after the request is received,

(a) forward the request to the other institution; and

(b) give written notice to the person who made the request that it has been forwarded to the other institution.

(3) If an institution receives a request for access to a record and the head considers that another institution has a greater interest in the record, the head may transfer the request and, if necessary, the record to the other institution, within fifteen days after the request is received, in which case the head transferring the request shall give written notice of the transfer to the person who made the request.

(4) For the purpose of subsection (3), another institution has a greater interest in a record than the institution that receives the request for access if,

(a) the record was originally produced in or for the other institution; or

(b) in the case of a record not originally produced in or for an institution, the other institution was the first institution to receive the record or a copy of it.

(5) Where a request is forwarded or transferred under subsection (2) or (3), the request shall be deemed to have been made to the institution to which it is forwarded or transferred on the day the institution to which the request was originally made received it.

[14]  To begin, I pause to note that the police do not identify which institutions might have a greater interest in the records, nor exactly which records they claim these unnamed institutions have a greater interest in.

[15]  That said, section 18(4) identifies the circumstances where another institution may have a greater interest in identified records; however, it specificially applies to circumstances where an institution has transferred a request under section 18(3). The police have not transferred the request under section 18(3) and therefore section 18(4) has no application in this appeal.

[16]  I now turn to the other issues in the appeal.

Issue A:  Did the institution conduct a reasonable search for records?

[17]  Where a requester claims that additional records exist beyond those identified by the institution, the issue to be decided is whether the institution has conducted a reasonable search for records as required by section 17. ^[1] If I am satisfied that the search carried out was reasonable in the circumstances, I will uphold the institution’s decision. If I am not satisfied, I may order further searches.

[18]  The Act  does not require the institution to prove with absolute certainty that further records do not exist. However, the institution must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. ^[2] To be responsive, a record must be "reasonably related" to the request. ^[3]

[19]  A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records which are reasonably related to the request. ^[4]

[20]  A further search will be ordered if the institution does not provide sufficient evidence to demonstrate that it has made a reasonable effort to identify and locate all of the responsive records within its custody or control. ^[5]

[21]  Although a requester will rarely be in a position to indicate precisely which records the institution has not identified, the requester still must provide a reasonable basis for concluding that such records exist. ^[6]

The representations of the police

[22]  The police submit that their Freedom of Information and Protection of Privacy Coordinator (the FOIC) conducted the search for responsive records and that no additional responsive records exist.

[23]  They explain:

… In his request, [the appellant] identified that he was requesting "criteria used in decision making process..." referring to the negative result in the decision to grant [the appellant] access to the Kingston Police station. During the mediation process, it was again identified that [the appellant] was looking for written policies on the vetting process. … In his report, the Mediator has identified that the appellant was looking for "written policies, checklists or score sheets related to background checks..." It would be [the FOIC’s] belief that these are NOT the records being sought by the appellant but rather the appellant is seeking records relating to "written policies, checklists or score sheets" related to the evaluation by the Kingston Police of his suitability for access to the Kingston Police building.

In any event, [the FOIC] personally conducted searches for both "written policies, checklists, or score sheets" on both the vetting process as well as on background checks. During his searches, [the FOIC] met with the Human Resources Director and inquired about the existence of such records. The Director was not aware of the existence of such records. [The FOIC] also consulted with the Office of the Chief of Police (who administers the policies and procedures of the Kingston Police) and they were not aware of the existence of such records. [The FOIC] undertook a search of the Kingston Police Services Board Policy Manual and a search of the Kingston Police General Orders. No further responsive records were located.

[24]  The police submit that the FOIC is a skilled and knowledgeable employee who consulted with other members of the police who might have knowledge of the existence of further responsive records, however, no further responsive records were located.

[25]  The appellant provided no representations on the reasonableness of the police’s search for responsive records.

Analysis and finding

[26]  As set out above, the Act  does not require the institution to prove with absolute certainty that further records do not exist. In order to satisfy its obligations under the Act , the institution must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records within its custody and control. I find that, based on the enquiries and searches made by the FOIC, the police have made a reasonable effort to locate records responsive to the request, even broadening the scope of its search to ensure that any possible responsive records were located.

[27]  Accordingly, I find that the police have conducted a reasonable search for records responsive to the appellant’s request at issue in this appeal.

Issue B:  Do the records contain “personal information” as defined in section 2(1) and, if so, to whom does it relate?

[28]  In order to determine which sections of the Act  may apply, it is necessary to decide whether the record contains “personal information” and, if so, to whom it relates. That term is defined in section 2(1) as follows:

“personal information” means recorded information about an identifiable individual, including,

(a)  information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(b)  information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

(c)  any identifying number, symbol or other particular assigned to the individual,

(d)  the address, telephone number, fingerprints or blood type of the individual,

(e)  the personal opinions or views of the individual except if they relate to another individual,

(f)  correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

(g)  the views or opinions of another individual about the individual, and

(h)  the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

[29]  The list of examples of personal information under section 2(1) is not exhaustive. Therefore, information that does not fall under paragraphs (a) to (h) may still qualify as personal information. ^[7]

[30]  Sections 2(2.1) and 2(2.2) also relate to the definition of personal information. These sections state:

(2.1) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

(2.2) For greater certainty, subsection (2.1) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling.

[31]  To qualify as personal information, the information must be about the individual in a personal capacity. As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be “about” the individual. ^[8]

[32]  Even if information relates to an individual in a professional, official or business capacity, it may still qualify as personal information if the information reveals something of a personal nature about the individual. ^[9]

[33]  To qualify as personal information, it must be reasonable to expect that an individual may be identified if the information is disclosed. ^[10]

[34]  The police submit that the personal information in the records includes the name, date of birth, sex, address, telephone number, marital status, and the views and opinions of the appellant as well as those of other identifiable individuals.

[35]  I have reviewed the responsive records located by the police and find that they contain the personal information of the appellant as well as the personal information of other identifiable individuals that fall within the scope of the definition of personal information set out at section 2(1)  of the Act .

Issue C:  Does the discretionary exemption at section 38(a) in conjunction with sections 7(1), 8(1)(c), 8(1)(e), 8(1)(i), 8(1)(k) and/or 13 apply to the information at issue?

[36]  Section 36(1) gives individuals a general right of access to their own personal information held by an institution. Section 38 provides a number of exemptions from this right.

[37]  Section 38(a) reads:

A head may refuse to disclose to the individual to whom the information relates personal information,

if section 6, 7, 8, 8.1, 8.2, 9, 10, 11, 12, 13 or 15 would apply to the disclosure of that personal information.

[38]  Section 38 (a) of the Act  recognizes the special nature of requests for one’s own personal information and the desire of the legislature to give institutions the power to grant requesters access to their personal information. ^[11]

[39]  In this case, the police rely on section 38(a) in conjunction with sections 7(1), 8(1)(c), 8(1)(e), 8(1)(i), 8(1)(k) and 13 to deny access to the responsive records.

[40]  I will first address the possible application of section 7(1).

Section 7(1)

[41]  Section 7(1) states:

A head may refuse to disclose a record where the disclosure would reveal advice or recommendations of an officer or employee of an institution or a consultant retained by an institution.

[42]  The purpose of section 7 is to preserve an effective and neutral public service by ensuring that people employed or retained by institutions are able to freely and frankly advise and make recommendations within the deliberative process of government decision-making and policy-making. ^[12]

[43]  “Advice” and “recommendations” have distinct meanings. “Recommendations” refers to material that relates to a suggested course of action that will ultimately be accepted or rejected by the person being advised, and can be express or inferred.

[44]  “Advice” has a broader meaning than “recommendations”. It includes “policy options”, which are lists of alternative courses of action to be accepted or rejected in relation to a decision that is to be made, and the public servant’s identification and consideration of alternative decisions that could be made. “Advice” includes the views or opinions of a public servant as to the range of policy options to be considered by the decision maker even if they do not include a specific recommendation on which option to take. ^[13]

[45]  “Advice” involves an evaluative analysis of information. Neither of the terms “advice” or “recommendations” extends to “objective information” or factual material.

[46]  Advice or recommendations may be revealed in two ways:

• the information itself consists of advice or recommendations
• the information, if disclosed, would permit the drawing of accurate inferences as to the nature of the actual advice or recommendations. ^[14]

[47]  The application of section 7(1) is assessed as of the time the public servant or consultant prepared the advice or recommendations. Section 7(1) does not require the institution to prove that the advice or recommendation was subsequently communicated. Evidence of an intention to communicate is also not required for section 7(1) to apply as that intention is inherent to the job of policy development, whether by a public servant or consultant. ^[15]

[48]  Section 7(2) creates a list of mandatory exceptions to the section 7(1) exemption. If the information falls into one of these categories, it cannot be withheld under section 7.

The representations of the police

[49]  The police submit that the section 7(1) exemption only applies to one record as well as certain information on a second record and they provide confidential and non-confidential representations in support of their position. I find below that the second record qualifies for exemption under section 8(1)(c) in conjunction with section 38(a) so it is not necessary to address the information in that record that the police claim is also subject to section 7(1).

[50]  In their non-confidential representations, they submit:

The appellant applied for a position as a cleaner with [an identified company]. As part of the contract, the [police] maintain the right to vet prospective cleaners who might be given access to the building. Further the [police] may refuse access to the secure areas (i.e. non-public areas) of the building to prospective cleaners. Ultimately, the decision whether to hire or not to hire the prospective employee remains entirely with [the company]. This company may hire whoever they wish but only vetted staff will be granted access to the Kingston Police station.

Analysis and finding

[51]  In my view, with respect to the first record, the recipient of the information takes it out of the scope of section 7(1). Accordingly, I find that section 7(1) in conjunction with section 38(a) does not apply.

[52]  I will now address the possible application of other exemptions claimed by the police.

Sections 8(1)(c), 8(1)(e), 8(1)(i), 8(1)(k) and 8(1)(l)

[53]  Sections 8(1)(c), 8(1)(e), 8(1)(i), 8(1)(k) and 8(1)(l), read:

A head may refuse to disclose a record if the disclosure could reasonably be expected to,

(c)  reveal investigative techniques and procedures currently in use or likely to be used in law enforcement;

(e)  endanger the life or physical safety of a law enforcement officer or any other person;

(i)  endanger the security of a building or the security of a vehicle carrying items, or of a system or procedure established for the protection of items, for which protection is reasonably required;

(k)  jeopardize the security of a centre for lawful detention;

(l)   facilitate the commission of an unlawful act or hamper the control of crime; or

[54]  The term “law enforcement” is used in several parts of section 8, and is defined in section 2(1) as follows:

“law enforcement” means,

(a)  policing,

(b)  investigations or inspections that lead or could lead to proceedings in a court or tribunal if a penalty or sanction could be imposed in those proceedings, or

(c)  the conduct of proceedings referred to in clause (b)

[55]  Generally, the law enforcement exemption must be approached in a sensitive manner, recognizing the difficulty of predicting future events in a law enforcement context. ^[16]

[56]  It is not enough for an institution to take the position that the harms under section 8 are self-evident from the record or that the exemption applies simply because of the existence of a continuing law enforcement matter. ^[17] The institution must provide detailed and convincing evidence about the potential for harm. It must demonstrate a risk of harm that is well beyond the merely possible or speculative although it need not prove that disclosure will in fact result in such harm. How much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences. ^[18]

Preliminary matter – section 8(1)(l): police operational codes

[57]  A long line of orders [19] has found that police operational codes qualify for exemption under section 8(1)(l), because of the reasonable expectation of harm from their release. I make the same finding here. As a result, I find that the police operational codes (including the “ten” codes) qualify for exemption under section 38(a) in conjunction with section 8(1) (l) of the Act .

[58]  Accordingly, any records that may be disclosed to the appellant as a result of this order will have those operational codes withheld.

[59]  I will now address the balance of the information at issue.

Section 8(1)(c): investigative techniques and procedures

[60]  In order to meet the “investigative technique or procedure” test, the institution must show that disclosure of the technique or procedure to the public could reasonably be expected to hinder or compromise its effective utilization. The exemption normally will not apply where the technique or procedure is generally known to the public. ^[20] The techniques or procedures must be “investigative”. The exemption will not apply to “enforcement” techniques or procedures. ^[21]

8(1)(e): life or physical safety

[61]  A person’s subjective fear, while relevant, may not be enough to justify the exemption. ^[22] The term “person” is not necessarily limited to a particular identified individual, and may include the members of an identifiable group or organization. ^[23]

Section 8(1)(i): security of a building, vehicle, system or procedure

[62]  Although this provision is found in a section of the Act  dealing specifically with law enforcement matters, it is not restricted to law enforcement situations and can cover any building, vehicle or system which requires protection. ^[24]

Section 8(1)(k): security of a centre for lawful detention

[63]  This exemption applies if the disclosure of the records could reasonably be expected to jeopardize the security of a centre for lawful detention.

The representations of the police

[64]  The police submit that they are a law enforcement agency that routinely engages in the investigation of possible violations of law.

[65]  They submit that any successful applicant for employment as a cleaner in the police station would have access to areas which are highly restricted and that there are greater security concerns in a police station compared to other areas of employment.

[66]  They submit:

For example, the Kingston Police station has a detention area where arrested persons are detained - the Kingston Police have security concerns similar to Penal Institutions. While firearms are secured within the building, there are nonetheless a significant number of firearms stored within the building - the Kingston Police have security concerns similar to an armory. The Kingston Police maintain a large quantity of highly sensitive personal information as well as highly sensitive investigative files. Finally, the Kingston Police are responsible for storing and maintaining continuity on evidence that has or will be presented in court. The Kingston Police must have a high degree of confidence in any person having access to these restricted areas.

[67]  The police acknowledge that the appellant was not going to be their direct employee, however:

… if the appellant was successful in obtaining employment with [an indentified company], he or she would be working in the non-public (secure) areas of the Kingston Police station. The Kingston Police retained the right to refuse access to any employee that [the identified company] might hire if the Kingston Police deemed that the results of the vetting process found that the prospective employee was not suitable - taking into consideration the greater security concerns.

It should also be understood that Police Agencies are very real targets - generally by organized criminal groups - of infiltration, surveillance, sabotage and counter-intelligence. As such, the personnel vetting process is the first line of defence against infiltration, surveillance, sabotage and counter-intelligence.

[68]  The police submit that the vetting process allows them to identify persons who may be a direct threat to the safety and security of Canadian Police Officers (as well as civilian police employees) or who may present a threat to the integrity/security of Police investigations or who may present a threat to the safety/security of the Kingston Police station as a place of detention. They submit that the vetting process also allows the police to identify prospective persons who might be vulnerable to coercion.

[69]  They explain:

Some examples of how groups/individuals have conducted infiltration, surveillance and counter­intelligence follow. Recently, in the international news was the escape of two convicts from the Clinton Correctional Facility in northern New York. These escapees, it has been alleged, were assisted by a civilian employed in the prison as well as by a guard. In 2002, the head of the Quebec Provincial Police Association reported that at least 4 people with access to Police databases were charged that year with selling information to the Hell's Angels. In 2007, the Kingston Police charged an employee with breaching confidentiality by sharing information illicitly and for personal gain.

[70]  The police submit that by releasing the requested responsive records, they would be revealing the processes and procedures used in vetting personnel potentially being granted access to the restricted areas of the Police station.

[71]  They submit:

It is a very real concern that by knowing how people are vetted for access, a skilled and resourceful person (or group) could work to thwart that vetting process and thereby gain access to the secure areas of the Police station. In a very real sense, the first line of defence for the Kingston Police station is the vetting process for persons being granted access to the Police station.

By sharing the responsive records, it would reveal investigative techniques and procedures and more specifically the manner in which persons are vetted for access to the Kingston Police station - what types of checks are performed, what databases are checked (both police and non-police databases), as well as what types of information are considered relevant to the vetting process. Further by revealing details respecting the vetting process, this is jeopardizing the life and physical safety of members of the [police] as well as of the general public. By revealing the details respecting the vetting process, the vetting process (which is already admittedly imperfect) could further be defeated. By defeating the vetting process, a person would have potential access to a detention facility, to an armory, and to a repository containing sensitive personal information as well as sensitive investigations.

[72]  The police submit that by sharing the responsive records and thereby revealing police investigative techniques and procedures used to vet a person for access to the building, information is being revealed that could be used for infiltration, surveillance, sabotage and counter-intelligence. They state that giving information which might assist to defeat the vetting process could “in a very real sense precipitate the harms articulated in sections 8(l)(e), 8(l)(i) and 8(1)(k)”.

Analysis and findings

[73]  The records at issue in this appeal include a Records Check Form, emails, Intelligence/Database Checks Form, Screen Shot, Occurrence Summaries and General Occurrence Reports. The Records Check Form was filled out by the appellant and would be familiar to many individuals who require a criminal records check as a condition of employment or volunteer work. Without revealing their content, except for the Intelligence/Database Checks Form and certain CPIC information codes contained in some of the pages of the records, there is nothing unique in the nature of the remaining information in the other records at issue. The records do pertain to the appellant but they do not, in my view, contain the type of information that falls within the scope of sections 8(1)(c), 8(1)(e), 8(1)(i) or 8(1)(k). In that regard, there is no assertion that the appellant himself will engage in the type of behavior that would give rise to the application of the section 8(1)(e) exemption. In addition, except for the CPIC access/transmission codes and query information discussed below, there are no plans, diagrams or security system information contained in the records that might be the basis for a section 8(1)(i) or 8(1)(k) claim. The records are simply the type of records that set out the appellant’s interactions with law enforcement. In all the circumstances, I am not satisfied on the representations provided by the police or the content of the records that, with the exception of the Intelligence/Database Checks Form and CPIC access/transmission codes and query information, they fall within the scope of sections 8(1) (c), 8(1) (e), 8(1) (i) or 8(1) (k) of the Act .

[74]  With respect to the Intelligence/Database Checks Form, I am satisfied that disclosing the information in the record would reveal an investigative technique or procedure, the disclosure of which could reasonably be expected to hinder or compromise its effective utilization. This form sets out the combination of the types of inquiries and/or searches that the police undertake before allowing individuals access to the station, which I accept houses firearms, sensitive personal information, individuals being held for a short period of time and criminal files. I am satisfied that the combination of the types of inquiries and/or searches conducted by the police as set out in the Intelligence/Database Checks Form is not generally known to the public. In my view, the information in the Intelligence/Database Checks Form falls within the scope of section 8(1)(c). Accordingly, I find that the Intelligence/Database Checks Form qualifies for exemption under section 38(a) in conjunction with section 8(1)(c).

[75]  I now turn to the CPIC information at issue.

[76]  CPIC is a computer database managed by the Royal Canadian Mounted Police. In Order PO-2582, adjudicator Diane Smith addressed an institution’s claim that the provincial equivalent of section 8(1)(i) applied to CPIC coding information. She wrote:

The Ministry [Ministry of Community Safety and Correctional Services] describes the CPIC system as a tool that assists the Canadian law enforcement community in combating crime by providing information on crimes and criminals. CPIC is operated by the Royal Canadian Mounted Police under the stewardship of the National Police Services, on behalf of the Canadian law enforcement community. The Ministry submits that unauthorized access to the CPIC system has the potential to compromise investigations and other law enforcement activities and the privacy and safety of individuals. The Ministry further submits that release of certain CPIC access/transmission codes has the potential to compromise the ongoing security of the CPIC system and facilitate unauthorized access to the CPIC system.

Upon review of the records, I agree with the Ministry that disclosure of those portions of the records claimed to be exempt pursuant to section 49(a) in conjunction with 14(1)(i), could reasonably be expected to endanger the security of the building and the integrity of the CPIC system. With respect to the CPIC coding information in particular, I agree with the findings of Senior Adjudicator David Goodis in Order PO-1921, where he found that disclosure of CPIC information relating to the codes required to access the CPIC database could lead to individuals abusing these communication tools, thus hampering the control of crime by causing harm to the CPIC system.

[77]  In Order MO-1698 Adjudicator Laurel Cropley addressed a request from an appellant to the Toronto Police Services Board for access to information about himself that is available “through the Police Reference Check Program.” The record at issue was a two-page CPIC printout. In making her determinations in that appeal, which dealt with the provincial equivalent of section 8(1) (l) of MFIPPA , she wrote:

I agree with the Police that previous orders of this office (for example, Order M-933 and my Order MO-1335) have established that disclosure of CPIC system code information, including transmission access codes, contained on a CPIC printout, could reasonably be expected to facilitate the commission an unlawful act, i.e., unauthorized use of the information contained in the CPIC system, under section 14(1)(l). I adopt the findings in these orders for the purpose of this appeal, and I find that the code information in the record is exempt.

However, I do not accept the submission of the Police that these orders stand for the proposition that the “substantive content” information on CPIC printouts is also exempt under section 14(1)(l). In fact, previous cases suggest that this kind of information is not exempt under the Act  where the person seeks his or her own CPIC information. For example, in Order MO-1288, former Adjudicator Holly Big Canoe rejected the argument of the Police that CPIC information had been provided in confidence for the purposes of the section 9 “relations with other governments” exemption:

The CPIC computer system provides a central repository into which the various police jurisdictions within Canada enter electronic representations of information they collect and maintain. Not all information in the CPIC data banks is personal information. That which is, however, deserves to be protected from abuse. Hence, a reasonable expectation of confidentiality exists between authorized users of CPIC that the personal information therein will be collected, maintained and distributed in compliance with the spirit of fair information handling practices. However, the expectation that this information will be treated confidentially on this basis by a recipient is not reasonably held where a requester is seeking access to his own personal information.

...

Accordingly, I find that there is no reasonable expectation of confidentiality in the circumstances of this appeal, where the appellant is the requester and the information at issue relates to the suspension of the appellant’s drivers licence and a history of his previous charges and convictions, the fact of which he must be aware.

In my view, the Police have not established that there is a reasonable expectation that disclosure of the substantive information (as distinct from the system code information), such as the appellant’s name, date of birth, age, and any criminal charges, criminal convictions, warrants, probations and drivers licence suspensions, as well as basic date information and the name of the contributing agency could facilitate the commission of an unlawful act or hamper the control of crime. While there may be unusual situations where this type of information should be withheld from a requester (such as where disclosure could reasonably be expected to cause harm to an individual), the Police have not identified any particular concerns of this nature here.

Therefore, I conclude that the non-CPIC system code information is not exempt under section 38(a), in conjunction with section 8(1) (l) of the Act .

[78]  In my view, there is great merit in the approach of Adjudicator Cropley. In all the circumstances, I find that while the CPIC access/transmission codes and query information falls within the scope of section 8(1)(i) as claimed by the police, the substantive information in the CPIC records that pertains only to the appellant does not fall within the scope of sections 8(1) (c), 8(1) (e), 8(1) (i) or 8(1) (k) of the Act . As a result, I find that section 8(1)(i), in conjunction with section 38(a) applies to the CPIC access/transmission codes contained in the CPIC records. Accordingly, any records that may be disclosed to the appellant as a result of this order will have those CPIC access/transmission codes withheld.

[79]  As a result, I find that the other remaining information at issue does not qualify for exemption under sections 8(1)(c), 8(1)(e), 8(1)(i) or 8(1)(k), in conjunction with section 38(a).

Section 13

[80]  Section 13 states:

A head may refuse to disclose a record whose disclosure could reasonably be expected to seriously threaten the safety or health of an individual.

[81]  For this exemption to apply, the institution must provide detailed and convincing evidence about the potential for harm. It must demonstrate a risk of harm that is well beyond the merely possible or speculative although it need not prove that disclosure will in fact result in such harm. How much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences. ^[25]

[82]  An individual’s subjective fear, while relevant, may not be enough to justify the exemption. ^[26]

[83]  The term “individual” is not necessarily confined to a particular identified individual, and may include any member of an identifiable group or organization. ^[27]

Analysis and finding

[84]  The police submit that the concerns that gave rise to their claiming sections  8(1) (e), 8(1) (i) or 8(1) (k) of the Act  are the basis for the claim that section 13 applies. For the same reasons as I have set out above, I am not satisfied that section 13 applies to the information remaining at issue that I have found not to qualify for exemption under sections 8(1)(c) and 8(1)(i) in conjunction with section 38(a).

Issue D:  Did the institution exercise its discretion under section 38(a)? If so, should this office uphold the exercise of discretion?

[85]  The section 38(a) exemption is discretionary, and permits an institution to disclose information, despite the fact that it could withhold it. An institution must exercise its discretion. On appeal, the Commissioner may determine whether the institution failed to do so.

[86]  In addition, the Commissioner may find that the institution erred in exercising its discretion where, for example,

• it does so in bad faith or for an improper purpose
• it takes into account irrelevant considerations
• it fails to take into account relevant considerations.

[87]  In either case this office may send the matter back to the institution for an exercise of discretion based on proper considerations. ^[28] This office may not, however, substitute its own discretion for that of the institution. ^[29]

The representations of the police

[88]  The police take the position that they properly exercised their discretion. They state that as “articulated in the legislation, the decision to refuse a requester access to their own personal information should be limited and specific” and submit that:

Balanced against this right of access is recognition in the legislation that there are circumstances where it may be necessary to refuse a requester access to their own personal information.

…

The release of the responsive records would have no significant impact on the confidence of the public in the operations of the Kingston Police. The appellant has not articulated, nor do the Kingston Police believe, that there is a compelling public interest in the release of the responsive records - this is very much matter of personal concern to the appellant.

[89]  The police submit that based on a consideration of these factors, it is their position that, in the circumstances of this appeal, the weight given to the exemptions outweigh the appellant's right of access.

Analysis and finding

[90]  To begin, I would emphasize that my review of the exercise of discretion by the police relates only to the information in the records for which I have upheld the claims of section 38(a), in conjunction with sections 8(1)(c), 8(1)(i) and 8(1)(l).

[91]  In considering this issue, I am mindful of the competing interests in this appeal. In this respect, I am satisfied that police understood their obligation to balance the interests of the appellant and the interests reflected in the applicable exemptions.

[92]  Overall, and in view of the disclosure of the non-exempt information provided for by this order, I am satisfied that the reasons given by the police for their exercise of discretion in denying access under section 38(a) demonstrate that relevant factors were considered. In the circumstances, I find that the police exercised their discretion properly, and I uphold it.

Conclusion

[93]  I have concluded that only some of the information at issue qualifies for exemption under sections 8(1)(c), 8(1)(i) and 8(1)(l) in conjunction with section 38(a). Accordingly, I uphold the police’s decision to withold this information from disclosure. With the exception of certain information in the search results, the Occurance Summaries and the General Occurrence Reports, the balance of the information in the other records was provided by the appellant or the consenting affected party only and with appropriate severances under section 4(2)  of the Act  [30] , pertains to the appellant or the consenting affected party only. Accordingly, I will order that this information be disclosed to the appellant.

[94]  However, certain pages of the search results, the Occurrance Summaries and the General Occurrence Reports contain the personal information of the appellant as well as the personal information of other non-consenting identifiable individuals. I have highlighted this information in green on a copy of the pages of records that I have provided to the police along with a copy of this order. It does not appear that the police claimed the application of the section 38(b) exemption for personal privacy nor notified these non-consenting identifiable individuals at the request stage. Nor were these individuals notified in the course of adjudication.

[95]  In all the circumstances, as I have found that none of the exemptions claimed by the police apply to the information that I have highlighted in green on the search results, the Occurance Summaries and the General Occurrence Reports, I have decided to resolve the issue in the following manner. My decision here will be an interim order. I will defer making a determination with respect to the balance of the undisclosed information that I have not found to qualify for exemption [31] . In order provision 3 below, I will give the appellant an opportunity to notify me within 45 days whether he is seeking access to the balance of the undisclosed information that I have not found to qualify for exemption.

[96]  If the appellant does not wish to seek access to the undisclosed information that I have not found to qualify for exemption, no final order will be issued. However, if he confirms that he is seeking access to this information, I will make reasonable efforts to provide any individual whose interests may be affected by disclosure of their information with a Notice of Inquiry and give them an opportunity to submit representations on the issues set out therein.

ORDER:

1. I uphold the decision of the police to withhold the Intelligence/Database Checks Form, the police operational codes (including the “ten” codes) and the CPIC access/transmission codes.
2. I order the police to disclose the balance of the information, except the information that I have highlighted in green, on a copy of the pages of the records provided to the police along with a copy of this order, by sending it to him by March 21, 2018, but not before March 16, 2018.
3. The appellant should notify me by April 4, 2018 whether he is seeking access to the remaining undisclosed information that I have not found to qualify for exemption as contained in the search results, the Occurance Summaries and the General Occurrence Reports.
4. In order to ensure compliance with paragraph 2, I reserve the right to require the ministry to send me a copy of the pages of records as disclosed to the appellant.

Original Signed by:		February 13, 2018
Steven Faughnan
Adjudicator