ORDER PO-3962

Appeal PA18-3

Treasury Board Secretariat

June 5, 2019

Summary: The appellant submitted an access request pursuant to the Freedom of Information and Protection of Privacy Act  to the Treasury Board Secretariat  (the board) for specific information about Ontario’s ONe-key online access system. The board denied access to portions of a report about the business case and the financial cost of the ONe-key program, citing the discretionary exemption in section 15(b) (relations with other governments). The board denied access to portions of another record, claiming that these portions are not responsive to the request.

In this order, the adjudicator upholds the board’s decision that the information at issue in Record 1 is exempt by reason of section 15(b) and that the information at issue in Record 3 is not responsive to the request.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, sections 15(b) and 24.

OVERVIEW:

[1]  The appellant submitted an access request pursuant to the Freedom of Information and Protection of Privacy Act  (FIPPA  or the Act ) to the Treasury Board Secretariat  (the board) for records related to Ontario’s ONe-key program that allows the public to communicate securely with online government services. The request read in part, as follows:

Records of particular interest are the following:

• General background of ONe-Key and how it works

• Business case or similar government analysis that led to the implementation of this portal (decision-making material)

• Financial cost to implement the ONe-Key architecture

I am not interested in all the draft versions of documents, only the final versions or latest draft (approved or unapproved). I am not interested in the back and forth email correspondences of staff, thought I am interested in the final emails as it relates to the financial cost to implement the ONe-Key architecture or business case (if they exist).

….

I am only seeking the final decision-making documents and financial cost to implement the ONe-Key architecture.

[2]  The board later requested clarification from the appellant, which he provided as follows:

1. The final or latest draft of the business case or similar decision-making material for the ONe-Key system
2. Records which outline the [initial estimated cost of the program and the actual final] financial cost to implement the ONe-Key system

[3]  The board issued a final access and fee decision. It indicated that three records had been located in response to the request. Its decision was to grant partial access, citing sections 14(1) (law enforcement), 15 (relations with other governments), 18(1) (economic and other interests) and 21(1) (personal privacy).

[4]  The appellant appealed both the fee and the exemptions listed in the access decision.

[5]  During the mediation stage, the board explained its search and the parties agreed on a fee, thereby resolving the fee issue. The board then provided the appellant with a severed copy of the records, as per its access decision.

[6]  With respect to the sections 15 and 18(1) exemptions claimed by the board, it clarified that it was relying upon sections 15(b) and 18(1)(c) and (d). The board also advised that that pages 1 to 9 and 11 to 31 of Record 3 are not responsive to the request, and it issued a revised access decision accordingly.

[7]  As further mediation was not possible, the appeal proceeded to the adjudication stage, where an adjudicator may conduct an inquiry. I began the inquiry by seeking the board’s representations on all three of the records at issue and the representations of other governments on the information relating to them in Record 1.

[8]  In its representations, the board withdrew its reliance on the exemptions in sections 14(1)(i), 18(1)(c) and (d), and 21(1). Therefore, these exemptions are no longer at issue, which means that all of Record 2 and certain portions of Records 1 and 3 are no longer subject to exemption claims. As well, one province consented to disclosure of the information relating to it in Record 1.

[9]  The board issued a supplementary decision letter to the appellant disclosing all of Record 2, as well as all of the information from Record 1, except for that of the other governments that opposed disclosure of their information, two provinces, Provinces A and B. The board maintained its claim to the application of section 15(b) to the withheld portions of Record 1.

[10]  I then provided the appellant with the representations of the board and Provinces A and B. Portions of Province B’s representations were withheld due to confidentiality concerns. The appellant did not provide representations in response.

[11]  In this order, I uphold the board’s decision that the information at issue in Record 1 is exempt by reason of section 15(b) and that the information at issue in Record 3 is not responsive to the request.

RECORDS:

[12]  The following information is at issue:

Index of Records

Record #	Description	Pages at issue	Exemptions claimed
1	Business Case - Identification, Authentication and Authorization Feb. 14, 2007 - Version 6	21-25	15(b)
3	Service Overview Presentation Deck	1-9, 11-31	Non-responsive

ISSUES:

1. Does the discretionary relations with other governments exemption at section 15(b) apply to the information at issue in pages 21 to 25 of Record 1?
2. Did the institution exercise its discretion under section 15? If so, should this office uphold the exercise of discretion?
3. What is the scope of the request? Are pages 1 to 9 and 11 to 31 of Record 3 responsive to the request?

DISCUSSION:

Issue A: Does the discretionary relations with other governments exemption at section 15(b) apply to the information at issue in pages 21 to 25 of Record 1?

[13]  Section 15 states in part:

A head may refuse to disclose a record where the disclosure could reasonably be expected to,

(b) reveal information received in confidence from another government or its agencies by an institution;

and shall not disclose any such record without the prior approval of the Executive Council.

[14]  Section 15 recognizes that the Ontario government will create and receive records in the course of its relations with other governments. The purpose of section 15(b) is to allow the Ontario government to receive information in confidence, thereby building the trust required to conduct affairs of mutual concern. [1]

[15]  The institution must provide detailed evidence about the potential for harm. It must demonstrate a risk of harm that is well beyond the merely possible or speculative although it need not prove that disclosure will in fact result in such harm. How much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences. [2]

[16]  If disclosure of a record would permit the drawing of accurate inferences with respect to information received from another government, it may be said to “reveal” the information received. [3]

[17]  For section 15(b) to apply, the institution must show that:

1. the records reveal information received from another government or its agencies; and
2. the information was received by an institution; and
3. the information was received in confidence. [4]

[18]  The board states that the relevant information was compiled in September 2006 by the National CIO [5] Subcommittee on Information Protection (NCSIP), which is a forum among the federal, provincial and municipal governments that addresses security concerns within government. It states that the board prepared the majority of Record 1; however, with the exception of the board’s own responses, the columns that appear in Appendix D are either i) the actual responses to the various questions posed to other governments, or ii) a summary of pertinent parts of the responses from other governments.

[19]  The board submits that, as a member of the NCSIP, it received the information directly from the other provincial governments. In the alternative, even if it did not receive the information directly from the other provincial governments, it did receive the information indirectly from them through the NCSIP.

[20]  The board states that Record 1 relates to the business case and the financial cost of the ONe-key program, which provides a common approach across government to reliably identify, authenticate and authorize (IAA) access to online government services. With this credential, members of the public can communicate securely with online government services. It states that ONe-key authenticates access to twenty-two (22) applications across many sectors, some of which have very sensitive data involving children, immigration and social assistance.

[21]  The board states that it also considered options outside of developing its own solution with the primary alternate option being the ePass solution, which had been developed by the federal government for a similar purpose. Prior to adopting the ONe-key program, the board sought out feedback from other provinces on the ePass system.

[22]  The board states that Record 1:

1. identifies a need for this type of service;
2. canvases available options, including the federal ePass system;
3. proposes an option along with supporting rationale; and
4. develops an implementation plan for that option.

[23]  The board states that Appendix D (pages 21-25 of Record 1) sets out the responses that the board received from the other governments, including their policy and planning objectives with respect to ePass, as well as budgeting and cost implications. It states that this information was shared in confidence and would have negative implications for relations between Ontario and the relevant provinces if it were disclosed. It states that disclosure could also hinder the general ability of the provinces to work collaboratively on security concerns.

[24]  Province B provided both confidential and non-confidential representations. [6] It states that it provided its responses about its plans regarding citizen service access to a joint federal-provincial-territorial working group. It states that the board, also a member of this group, received a copy of Province B’s responses.

[25]  Province B states that the information it provided was:

• communicated to the board on the basis that it was confidential and that it was to be kept confidential;
• treated consistently in a manner that indicates a concern for its protection from disclosure by Province B prior to being communicated to the board;
• not otherwise disclosed or available from sources to which the public has access; and
• prepared for a purpose that would not entail disclosure.

[26]  In this regard, Province B states that its information in the records is by custom and prior jurisprudential authority, normally expected to attract a qualified veil of confidentiality, unless the party that has provided the information consents to its release. According to Province B, this custom preserves effective collaboration, which requires frank and open discussion by the involved parties. [7]

[27]  Province B submits that to permit or to require the disclosure of advice given by officials, either to other officials or to ministers, and the disclosure of confidential deliberations within the public service on policy options, [8] would erode its ability to formulate and to justify its policies.

[28]  Province A states that its information in Record 1 is draft information and was provided by it to Ontario in confidence. As such, it submits that any disclosure could harm open discussions, deliberations, consultations and decision-making between Ontario and Province A.

Analysis/Findings

[29]  Record 1 is a draft document entitled “Identification, Authentication & Authorization for Citizens and Business Accessing [name of two provincial government electronic systems].” Withheld from this record is Provinces A and B’s information in “Appendix D – Provinces Response to IAA [9] Questionnaire.” As described by the board, this information responds to the following five areas of questioning posed by Ontario to the other governments:

• Question 1 deals with the potential adoption of the federal ePass system.
• Question 2, and the various sub-questions, addresses the actual operation of a potential IAA system in that province that would use the federal ePass system.
• Question 3 specifically asks whether the relevant province has engaged in discussions with the federal government about using the ePass system.
• Question 4, and the various sub-questions, addresses proof of concept work that the other government has undertaken with respect to the ePass system.
• Question 5 solicits information from the other governments about how they could collaborate to ask the federal government to create a standard IAA and the use of ePass.

[30]  I agree with the board that the intergovernmental collaboration set out in Record 1 on confidential security concerns is the type of information consistent with the purpose for the exemption in section 15(b) is designed to protect. I also agree with the board that the specific nature of the withheld portions of Record 1 reflects the importance of protecting the ability of Ontario to receive information in confidence from other governments.

[31]  Based on my review of the information at issue in Record 1, I find that this is the type of information that is expected to be provided in confidence under section 15(b).

[32]  I find that disclosing the information at issue in Record 1 could reasonably be expected to reveal information that the board received in confidence from Provinces A and B as part of the board's participation in the NCSIP.

[33]  Therefore, I find that disclosure of the information at issue in Record 1 could reasonably be expected to reveal information the board received in confidence from Provinces A and B. [10] Accordingly, subject to my review of the board’s exercise of discretion, this information is exempt under section 15 (b) of the Act .

Issue B: Did the institution exercise its discretion under section 15? If so, should this office uphold the exercise of discretion?

[34]  The section 15 exemption is discretionary and permits an institution to disclose information, despite the fact that it could withhold it. An institution must exercise its discretion. On appeal, the Commissioner may determine whether the institution failed to do so.

[35]  In addition, the Commissioner may find that the institution erred in exercising its discretion where, for example,

• it does so in bad faith or for an improper purpose
• it takes into account irrelevant considerations
• it fails to take into account relevant considerations.

[36]  In either case this office may send the matter back to the institution for an exercise of discretion based on proper considerations. [11] This office may not, however, substitute its own discretion for that of the institution [section 54(2)].

[37]  Relevant considerations may include those listed below. However, not all those listed will necessarily be relevant, and additional unlisted considerations may be relevant: [12]

• the purposes of the Act , including the principles that
• information should be available to the public
• individuals should have a right of access to their own personal information
• exemptions from the right of access should be limited and specific
• the privacy of individuals should be protected
• the wording of the exemption and the interests it seeks to protect
• whether the requester is seeking his or her own personal information
• whether the requester has a sympathetic or compelling need to receive the information
• whether the requester is an individual or an organization
• the relationship between the requester and any affected persons
• whether disclosure will increase public confidence in the operation of the institution
• the nature of the information and the extent to which it is significant and/or sensitive to the institution, the requester or any affected person
• the age of the information
• the historic practice of the institution with respect to similar information.

[38]  The board states that in exercising its discretion under section 15 it took into account the above-noted considerations. It states that in responding to this access request, the board consulted representatives from the various impacted governments. It further states that where the relevant government consented to disclosure, the board determined that this information was not subject to an expectation of confidentiality on the part of the other governments and, as such, it should be disclosed.

[39]  The board also took into consideration that both Provinces A and B did not consent to disclosure in exercising its discretion under section 15 to preserve the confidentiality of those governments’ responses by severing the relevant information.

Analysis/Findings

[40]  I accept that the information at issue relates to the board’s confidential collaboration with other provinces on a matter of mutual concern, i.e. the best course of action for its IAA program. In doing so, the board used the questions in Record 1 and the answers from other governments to assess the potential for inter-provincial collaboration in relation to the ePass system as an alternative to developing an 'in-house' solution.

[41]  Given the nature of the information, the board determined that confidentiality obligations arose as a result of the other governments' responses. Absent the consent of Provinces A and B, the board determined that disclosing the confidential information at issue that was severed from Appendix D in Record 1 would have a negative impact on Ontario’s ability to collaborate in confidence with other governments on this or similar projects.

[42]  I find that in exercising its discretion, the board relied on the exemption in section 15(b) in an appropriately limited and specific manner with reference to the purpose of the exemption and only for information received from those jurisdictions from which it did not obtain consent to disclose. As such, I find that the board exercised its discretion to deny access in a proper manner, taking into account relevant considerations and not taking into account irrelevant considerations.

[43]  Accordingly, I am upholding the board’s exercise of discretion and find that the information at issue in Record 1 that relates to Provinces A and B is exempt under section 15(b).

Issue C: What is the scope of the request? Are pages 1 to 9 and 11 to 31 of Record 3 responsive to the request?

[44]  Section 24  of the Act  imposes certain obligations on requesters and institutions when submitting and responding to requests for access to records. This section states, in part:

(1) A person seeking access to a record shall,

(a) make a request in writing to the institution that the person believes has custody or control of the record;

(b) provide sufficient detail to enable an experienced employee of the institution, upon a reasonable effort, to identify the record;

. . .

(2) If the request does not sufficiently describe the record sought, the institution shall inform the applicant of the defect and shall offer assistance in reformulating the request so as to comply with subsection (1).

[45]  Institutions should adopt a liberal interpretation of a request, in order to best serve the purpose and spirit of the Act . Generally, ambiguity in the request should be resolved in the requester’s favour. [13]

[46]  To be considered responsive to the request, records must “reasonably relate” to the request. [14]

[47]  The board states that it sought clarification from the appellant regarding the exact scope of their initial request. Upon clarification, it states that the appellant specifically requested records related to:

1. The final or latest draft of the business case or similar decision making material for the ONe-key system.
2. Records which outline the [initial estimated cost of the program and the actual final] financial cost to implement the ONe-key system.

[48]  The board submits that pages 1 to 9 and 11 to 31 of Record 3 are not reasonably related to these two items and instead contain:

• specific information about the context for the proposed ONe-Key tool, functionality of the IT architecture and performance indicators for the program;
• recommendations from impacted stakeholders as well as potential clients for ONe-key; and,
• details on the enrollment and security protocols for the ONe-key program.

[49]  The board states that this information is not general information about the program; rather, this is specific information about the ONe-key infrastructure and client interface and is not reasonably related to the information specified in the clarified request.

Analysis/Findings

[50]  Based on my review of the board’s representations and the information at issue in Record 3, I agree with the board that this information is not reasonably related to the appellant’s request as clarified. The request as clarified sought specific information on the ONe-key decision-making and cost information.

[51]  Therefore, I find that pages 1 to 9 and 11 to 31 of Record 3 are not responsive to the appellant’s clarified request.

ORDER:

I uphold the board’s decision and dismiss the appeal.

Original Signed by:		June 5, 2019
Diane Smith
Adjudicator