ORDER PO-3997

Appeal PA16-435

Ministry of the Solicitor General

October 10, 2019

Summary: In this order, the adjudicator finds that Twitter accounts appearing on a list of accounts blocked from an OPP-operated Twitter account qualify as “personal information” within the meaning of the Freedom of Information and Protection of Privacy Act  (the Act ), because it is reasonable in the circumstances to expect that individuals may be identified from this information. She upholds the ministry’s decision to deny access to the record, in full, under the mandatory personal privacy exemption at section 21(1)  of the Act .

Statutes Considered: Freedom of Information and Protection of Privacy Act , RSO 1990, c F.31 , as amended, sections 2(1) (definition of “personal information”) and 21(1); Freedom of Information and Protection of Privacy Act, RSA 2000, c F-25.

Orders and Investigation Reports Considered: Order F2019-02 (Office of the Alberta Information and Privacy Commissioner).

OVERVIEW:

[1]  The appellant made a request to the Ministry of the Solicitor General (formerly the Ministry of Community Safety and Correctional Services) (the ministry) under the Freedom of Information and Protection of Privacy Act  (the Act ) for the names of Twitter accounts and users that have been blocked from Twitter accounts operated or authorized by the Ontario Provincial Police (OPP), a division of the ministry.

[2]  The responsive record is a list of Twitter accounts that the OPP has blocked from its Twitter account @OPP_News. Blocked accounts are restricted from contacting, following or seeing tweets from the OPP’s Twitter account. The ministry denied access to the record, in full, initially on the basis of the discretionary exemption in section 14(1)(a) (law enforcement matter) and the mandatory exemption in section 21(1) (personal privacy) of the Act .

[3]  The appellant appealed the ministry’s decision to this office. After an attempt at mediation, the appeal was transferred to the adjudication stage. During the inquiry into this matter, the ministry provided representations that were shared with the appellant in accordance with this office’s Code of Procedure. The appellant declined to provide representations. However, he asked that the adjudicator consider a recent order issued by the Office of the Information and Privacy Commissioner of Alberta in relation to a request for similar information made to an Alberta institution (Alberta Education). In the Alberta decision, an adjudicator of that office concluded that the names of Twitter accounts blocked from the institution’s Twitter account did not qualify as personal information within the meaning of Alberta’s public sector access and privacy legislation. As a result, she found that the personal privacy exemption in the Alberta statute could not apply. She accordingly ordered disclosure of the requested information.

[4]  During the course of this office’s inquiry into this matter, the appeal file was transferred to me.

[5]  In this order, I find that the information at issue qualifies as personal information within the meaning of the Act , and is exempt from disclosure under section 21(1). As a result, I uphold the ministry’s denial of access to the record, and I dismiss the appeal.

RECORDS:

[6]  The record at issue is a list of Twitter accounts that the OPP has blocked from its Twitter account @OPP_News.

ISSUES:

1. Does the record contain “personal information” within the meaning of the Act and, if so, to whom does it relate?
2. If the record contains personal information, does the mandatory personal privacy exemption at section 21(1) apply?

DISCUSSION:

A. Does the record contain “personal information” within the meaning of the Act and, if so, to whom does it relate?

[7]  During the inquiry stage, the ministry withdrew its reliance on section 14(1)(a). This means that the only exemption claimed by the ministry to withhold the record in its entirety is the personal privacy exemption at section 21(1)  of the Act .

[8]  Section 21(1) can only apply to information that qualifies as “personal information” within the meaning of the Act . That term is defined in section 2(1) to mean “recorded information about an identifiable individual.” Section 2(1) also includes a non-exhaustive list of examples of personal information. [1] Among these are any identifying number, symbol or particular assigned to the individual [paragraph (c) of the definition at section 2(1)]; the individual’s address [paragraph (d)]; and the individual’s name where it appears with other personal information relating to the individual, or where the disclosure of the name would reveal other personal information about the individual [paragraph (h)].

[9]  Sections 2(2), (3) and (4) also relate to the definition of personal information. I do not reproduce them here as they do not appear to be applicable in the circumstances. In particular, there is no evidence before me to suggest that any of the information in the record arises in a business or professional context.

[10]  To qualify as personal information, it must be reasonable to expect that an individual could be identified from the information. [2] Identifiability may result from that information alone, or that information in combination with other available information. [3]

Parties’ representations, and findings

[11]  The ministry takes the position that the names of Twitter accounts blocked by the OPP qualify as personal information of the individuals to whom those accounts belong.

[12]  There is no claim that any of the Twitter accounts in the record belong to the appellant.

[13]  Twitter account names (or Twitter handles) are selected by individuals who use Twitter. Each Twitter handle is unique, and consists of an account username (which appears following the symbol @) and a display name. Some Twitter users choose account usernames or display names that contain their real names or business names. Some Twitter users also choose to upload profile photos. A profile photo may be an image of the Twitter user, or may be some other image. The ministry observes that some of the Twitter accounts listed in the record include images of individuals.

[14]  The ministry proposes that Twitter handles are analogous to personal email addresses, which have been found in many previous orders of this office to qualify as personal information under the Act . [4] In some of these orders, a personal email address was explicitly found to constitute an “identifying number, symbol or other particular” of an individual within the meaning of paragraph (c) of the definition of personal information at section 2(1), or to fall within the definition of “address” in paragraph (d). The ministry relies on both these paragraphs of the definition, as well as on paragraph (h), on the ground that disclosure of the record would reveal that particular Twitter users have been blocked from posting on an OPP Twitter account, and that the fact of having been blocked is personal information about those individuals.

[15]  In some of the past orders addressing the question of whether email addresses qualify as personal information, the email addresses under consideration were already explicitly connected to named individuals—as where, for example, the record at issue was a list of names of individuals along with those individuals’ personal email addresses and other contact information for them. In those cases, there was no dispute that the email addresses, if disclosed, would be connected to named individuals. [5]

[16]  By contrast, the record at issue here is a list of Twitter accounts that are not explicitly connected to named individuals in the same way. Specifically, while some Twitter users may choose to use their proper names and own images in their Twitter handles, other users may choose pseudonyms, short forms or random words that do not resemble proper names. The record at issue contains some Twitter handles that may reflect proper names, and others that clearly do not. Similarly, some of the profile photos accompanying some of the Twitter handles in the record are images of individuals, while others are merely generic images. Even where a profile photo depicts an individual, it is not clear whether the depicted individual is in fact the individual who maintains that Twitter account.

[17]  Given these different circumstances, I do not find directly analogous those IPC orders that have considered whether the personal email addresses of named individuals qualify as personal information of those individuals. However, I agree with the ministry that Twitter handles serve a similar communication function to email addresses, and, like unique email addresses, are associated with unique users. In addition, like most email addresses, Twitter handles are selected by individual users, and may or may not reflect users’ actual names.

[18]  The question in this case is whether it is reasonable to expect that individuals may be identified from their Twitter handles (and any associated profile photos), whether or not they contain the actual names (or images) of these individuals. For the reasons that follow, I conclude that disclosure of the Twitter handles at issue could reasonably be expected to lead to the identification of the individuals who operate those accounts.

[19]  About half the Twitter handles listed in the record appear to reflect or to reveal proper names of individuals. Assuming that the associated names are not pseudonyms, I have no trouble accepting that identifiable individuals’ Twitter handles qualify as recorded information about them, and thus as their personal information within the meaning of the Act . Specifically, I find that, like email addresses associated with identifiable individuals, Twitter handles associated with identifiable individuals fit within the meaning of identifying particulars or addresses in paragraphs (c) and (d) of the definition of personal information at section 2(1). I also agree with the ministry that the disclosure of Twitter handles associated with identifiable individuals in the context of the record would reveal other personal information about those individuals—namely, that they were blocked from the OPP’s Twitter account (paragraph (h) of the definition).

[20]  The remaining Twitter handles do not appear to reflect or to reveal proper names of individuals. For these Twitter handles (and for any Twitter handles discussed above that may use pseudonyms and not actual names of users), I find that there is nonetheless a reasonable expectation that the individuals behind these handles could be identified.

[21]  I find persuasive the ministry’s observation that in many cases, a user’s Twitter handle can be linked to other content that the user has posted on Twitter or on other online platforms. This could provide a fairly complete picture of a Twitter user’s online activity, which could in many instances lead to the identification of the particular user. Even where it is not possible to connect a pseudonymous Twitter handle with the user’s other Twitter activity (in the case of inactive Twitter accounts, for example), there may be other publicly available information that, combined with the Twitter handle, could lead to identification of an individual. For example, I am mindful of the fact that it is an increasingly common practice for individuals to provide along with more traditional forms of contact information (such as telephone numbers and email addresses) their Twitter handles and other identifiers used on social media. Where individuals have posted all this contact information online, connecting an individual’s Twitter handle to his or her proper name may be a simple matter.

[22]  Based on all these considerations, I find it reasonable to expect that a Twitter handle, even one that does not appear on its face to contain identifying information, could be used alone or in combination with other publicly available information to lead to the identification of an individual. I find, as a result, that even the pseudonymous Twitter handles in the record at issue qualify as personal information within the meaning of the Act .

[23]  In arriving at this finding, I have considered the order of the Office of the Information and Privacy Commissioner of Alberta (Alberta OIPC) to which the appellant referred me. In that order, an adjudicator from that office, applying a different statute, reached a different conclusion on this question. Although the Alberta order is not binding on me, I will address the findings in that order to explain why I have reached a different conclusion under the Act .

Order F2019-02 of the Alberta OIPC

[24]  Order F2019-02 of the Alberta OIPC arose from a request for access, under the Alberta Freedom of Information and Protection of Privacy Act (FOIP Act), to a list of Twitter users and accounts that had been blocked for each Twitter account operated or authorized by Alberta Education, an Alberta government institution. The institution denied access to some Twitter accounts (namely, those that the institution believed were operated by an individual in a personal capacity, rather than in a business or professional capacity) on the ground that disclosure would be an unreasonable invasion of the personal privacy of third parties.

[25]  Like section 21(1)  of the Act , the personal privacy exemption in the Alberta FOIP Act can only apply to personal information. In deciding whether the claimed exemption applied, the Alberta adjudicator first had to decide whether the Twitter accounts at issue qualified as “personal information” within the meaning of the Alberta statute. After considering the statutory definition as well as some past orders of the Alberta OIPC, the adjudicator ultimately concluded that Twitter accounts do not qualify as personal information within the meaning of the FOIP Act.

[26]  Although contained in a different statute, the definition of “personal information” in the FOIP Act is very similar to the definition contained in section 2  of the Act . And like this office, the Alberta OIPC has had occasion to consider the distinction between personal information and information about a property or about an object. Both offices have recognized that information about a property or an object may qualify as personal information where the information contains a “personal dimension,” or reveals something of a personal nature about an identifiable individual. [6]

[27]  In Order F2019-02, based on the evidence before her, the Alberta adjudicator concluded that the Twitter account names at issue were not personal information, but rather information about things—Twitter accounts—that lacked any personal dimension that would bring them within the definition of personal information. She based her conclusion on a number of observations. The first was that while some individuals may use their actual names as Twitter account names, others do not. The adjudicator also took notice of media articles reporting on the prevalence of fake and automated Twitter accounts (“bots”). From this, she concluded that “the name of a Twitter account cannot be said to have a personal dimension necessarily, even though an account may have the appearance of being associated with an identifiable individual.”

[28]  Thus, while the adjudicator noted that some of the Twitter handles (and corresponding pictures) in the record “could possibly be genuine,” she said that she could not find on the evidence before her that the accounts were actually being used by individuals, or that the name of a given account and the image associated with it were about the same individual. Because it was impossible to tell from the information before her whether identifiable individuals were associated with the Twitter account names, she concluded that all that would be revealed from disclosure of the record was that “a Twitter account that may or may not be associated with an identifiable individual was blocked” by the institution. She also found relevant to her determination the fact that the record itself did not indicate the reasons why any account was blocked. She stated:

As it is not clearly the case that the accounts severed under section 17 [the FOIP Act’s personal privacy exemption, similar to section 21(1)  of the Act ] are associated with identifiable individuals, and there is no requirement that a Twitter user use his or her own name or image, or be a human being, the fact that the Twitter account was blocked does not necessarily reveal personal information about an identifiable individual (at paragraph 28).

[29]  Without commenting on the Alberta adjudicator’s application of the Alberta statute to the facts before her, I will consider whether the reasons she cited are persuasive grounds for finding that the Twitter accounts at issue in this appeal are not “personal information” under the Act .

[30]  First, I do not find determinative the fact that there is no requirement for a Twitter user to use his or her own name or image in the Twitter handle. As canvassed above, under the Act , information that is not explicitly connected to a named individual may nonetheless qualify as personal information of the individual, if it is reasonable to expect that an individual may be identified from the information.

[31]  This test for identifiability under the Act  does not require the institution to show that it is “clearly the case” or to “determine with certainty” that information at issue is associated with identifiable individuals. The Alberta adjudicator’s application of a potentially different test of identifiability under the FOIP Act does not inform my determination of identifiability under the Act . Based on the evidence before me, I find it reasonable to expect that individuals could be identified from the Twitter handles at issue, whether or not they are connected to proper names. This is sufficient to qualify the information as personal information under the Act .

[32]  I also do not find determinative the evidence that there likely exist millions of fake or automated Twitter accounts. According to the sources cited by the Alberta adjudicator, automated accounts are often used for such purposes as boosting real Twitter users’ follower numbers or for the dissemination of certain news items. [7] Considering the types of activity (like verbal harassment) that commonly result in a Twitter account’s being blocked, I find it unlikely that any of the blocked Twitter accounts at issue are automated accounts. (It may be useful here to recall the distinction between automated Twitter accounts—meaning Twitter accounts not operated by human users—and pseudonymous Twitter accounts operated by human users under names that are not the users’ actual names. I found, above, that pseudonymous Twitter accounts qualify as personal information because it is reasonable to expect that the individual users behind them may be identified.)

[33]  Even if there were reason to believe that some of the Twitter accounts in the record were automated accounts, I find it unlikely that the record would consist solely of automated accounts (so that it could not qualify as a record of personal information). The ministry is not required to show that each Twitter account at issue can be definitively linked to an individual. The test is whether it is reasonable in the circumstances to expect that individuals could be identified from disclosure of the record. Taken all together, I find it reasonable for the ministry to have treated the record as a record of personal information because of an expectation that the listed accounts could be linked to individual users. The fact that there exist automated Twitter accounts in the world does not detract from the reasonableness of this belief. I also find it reasonable for the ministry to have concluded that the record is not reasonably severable within the meaning of the Act . In the circumstances, it would not be reasonably possible to determine which Twitter accounts in the record, if any, were automated accounts.

[34]  Finally, the Alberta adjudicator considered significant the fact that the record before her did not explicitly identify the reasons why each account was blocked (or tie the reasons for blocking an account to an identifiable individual). She concluded, as a result, that disclosure of the fact that an account was blocked would not necessarily reveal personal information about an identifiable individual.

[35]  I have reached a different conclusion about the identifiability of individuals from their Twitter handles. Because I found that these Twitter handles relate to identifiable individuals, they qualify as personal information. (I also found that, once connected to an identifiable individual, the fact that a Twitter account appears on a list of blocked Twitter accounts is itself personal information about the individual—even without being connected to the reason for having been blocked.)

[36]  Having considered the reasons and the findings of the Alberta OIPC, I conclude that the Twitter handles at issue in this appeal qualify as personal information within the meaning of the Act . I will next consider whether the personal privacy exemption at section 21(1)  of the Act  applies to this information.

B. If the record contains personal information, does the mandatory personal privacy exemption at section 21(1) apply?

[37]  Where a requester seeks personal information of other individuals, section 21(1) prohibits an institution from releasing this information unless one of the exceptions in paragraphs (a) to (f) of section 21(1) applies. In this case, the only potentially applicable exception to the prohibition against disclosure is section 21(1)(f), which allows disclosure of other individuals’ personal information if that disclosure would not be an unjustified invasion of their personal privacy.

[38]  Section 21(4) also lists situations that would not be an unjustified invasion of personal privacy. None of the conditions in section 21(4) applies here.

[39]  Sections 21(2) and (3) also help in determining whether disclosure would or would not be an unjustified invasion of privacy. None of the presumptions in section 21(3) is applicable here.

[40]  Where no section 21(3) presumption applies, section 21(2) lists various factors that may be relevant in determining whether disclosure of personal information would constitute an unjustified invasion of personal privacy. [8] In order to find that disclosure does not constitute an unjustified invasion of personal privacy, one or more factors and/or circumstances favouring disclosure in section 21(2) must be present. It is also necessary to consider any unlisted factors that may weigh in favour of or against disclosure. [9] In the absence of any factors favouring disclosure of personal information, the exception in section 21(1)(f) is not established and the mandatory section 21(1) exemption applies. [10]

[41]  The appellant provided no representations to support an argument for disclosure of personal information. Based on the nature of the information requested, I have considered whether the factor favouring disclosure at section 21(2)(a) might apply. This section contemplates disclosure in order to subject the activities of government to public scrutiny. [11] I have also considered whether there is an argument to be made that disclosure of the record would assist in ensuring public confidence in the ministry as an institution. [12] However, in the absence of any representations from the appellant on this topic, I find that the evidence before me does not independently establish the application of either of these factors—or of any other listed or unlisted factors— favouring disclosure.

[42]  Given this, the section 21(1)(f) exception cannot apply. The record is therefore exempt from disclosure under the mandatory personal privacy exemption at section 21(1).

[43]  In these circumstances, it is unnecessary for me to consider the ministry’s argument that the information at issue is highly sensitive within the meaning of section 21(2)(f), and I decline to do so.

[44]  For all the foregoing reasons, I uphold the ministry’s denial of access to the record under section 21(1)  of the Act . I dismiss the appeal.

ORDER:

I uphold the ministry’s decision under section 21(1). I dismiss the appeal.

Original Signed by:		October 10, 2019
Jenny Ryu
Adjudicator