ORDER PO-4107

Appeal PA17-156

Wilfrid Laurier University

January 27, 2021

Summary: The appellant submitted an access request to the university under the Freedom of Information and Protection of Privacy Act  for certain records created by a named individual that reference her. The university issued a decision stating that it found no records within its custody or control. At mediation, the appellant questioned the reasonableness of the university’s search and this issue was added to the scope of the appeal. In this order, the adjudicator finds that the university does not have custody or control over the emails it located in its search and also finds that its search is reasonable.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, sections 10(1) and 24.

Orders and Investigation Reports Considered: Order P-239.

Cases Considered: City of Ottawa v. Ontario, 2010 ONSC 6835, [2010] 328 D.L.R. (4th) 171 (Div. Ct.); leave to appeal denied (C.A. M39605), Canada (Information Commissioner) v. Canada (Minister of National Defence), 2011 SCC 25, [2011] 2 SCR 306.

OVERVIEW:

[1] The appellant, a professor at Wilfred Laurier University (the university), sought information about her that was created by a named individual who was a student in her class and also an employee of the university. The appellant submitted an access request to the university under the Freedom of Information and Protection of Privacy Act  (the Act ) for access to “all general records, including emails” that referred to her, and for her own personal information. The appellant named an individual associated with the request and specified the period for which she sought the records.

[2] The university issued a decision to the appellant stating that it had conducted a search for records responsive to the request and found no records within its custody and control. The university indicated that any records are in the possession of the named individual and relate to his role as a student and not as an employee of the university. The university added:

Please note that any emails that are solely personal in nature are not considered to be responsive records under the Freedom of Information and Protection of Privacy Act . This includes email communication of a student or former student who may also be in the employ of the university when the emails relate solely to that individual’s role as a student (i.e. are not related to the employment relationship).

[3] The appellant appealed the university’s decision to this office.

[4] During mediation, the university provided detailed submissions, explaining the basis for its position that it has no responsive records in its custody or control.

[5] The university shared its complete submissions with the appellant, who remained unsatisfied and maintained that the records responsive to her request are in the university’s custody or control. She also questioned the reasonableness of the university’s search for responsive records. As a result, the issue of reasonable search was added to the appeal.

[6] As a mediated resolution of the appeal was not possible, the appeal moved to the adjudication stage where an adjudicator may conduct an inquiry under the Act . The IPC adjudicator assigned to the appeal sought and received representations from the parties which were shared in accordance with the IPC’s Code of Procedure. The appeal was then assigned to me in order to resolve the issues in dispute.

[7] In this order, I uphold the university’s decision and dismiss the appeal.

ISSUES:

1. Are the records “in the custody” or “under the control” of the university under section 10(1)?
2. Did the university conduct a reasonable search for responsive records?

DISCUSSION:

Issue A: Are the records “in the custody” or “under the control” of the university under section 10(1)?

[8] Under section 10(1), the Act  applies only to records that are in the custody or under the control of an institution. A record will be subject to the Act  if it is in the custody or under the control of an institution; it need not be both. [1]

[9] Section 10(1) states, in part:

Every person has a right of access to a record or a part of a record in the custody or under the control of an institution unless . . .

[10] The courts and this office have applied a broad and liberal approach to the custody or control question. [2]

[11] This office has developed a non-exhaustive list of factors to consider in determining whether or not a record is in the custody or control of an institution. [3] Some of the listed factors may not apply in a specific case, while other unlisted factors may apply. Factors to consider include:

• Was the record created by an officer or employee of the institution? [4]
• What use did the creator intend to make of the record? [5]
• Does the institution have a statutory power or duty to carry out the activity that resulted in the creation of the record? [6]
• Is the activity in question a “core”, “central” or “basic” function of the institution? [7]
• Does the content of the record relate to the institution’s mandate and functions? [8]
• Does the institution have physical possession of the record, either because it has been voluntarily provided by the creator or pursuant to a mandatory statutory or employment requirement? [9]
• If the institution does have possession of the record, is it more than “bare possession”? [10]
• If the institution does not have possession of the record, is it being held by an officer or employee of the institution for the purposes of his or her duties as an officer or employee? [11]
• Does the institution have a right to possession of the record? [12]
• Does the institution have the authority to regulate the record’s content, use and disposal? [13]
• Are there any limits on the use to which the institution may put the record, what are those limits, and why do they apply to the record? [14]
• To what extent has the institution relied upon the record? [15]
• How closely is the record integrated with other records held by the institution? [16]
• What is the customary practice of the institution and institutions similar to the institution in relation to possession or control of records of this nature, in similar circumstances? [17]

[12] In determining whether records are in the “custody or control” of an institution, the above factors must be considered contextually in light of the purpose of the legislation. [18]

[13] In addition to the above referenced factors, the Supreme Court of Canada in Canada (Information Commissioner) v. Canada (Minister of National Defence), [19] articulated a two-part test to determine institutional control of a record:

1. whether the record relates to a departmental matter, and
2. whether the institution could reasonably be expected to obtain a copy of the document upon request.

[14] According to the Supreme Court, control can only be established if both parts of the test are met.

Representations

[15] In this appeal, most of the submissions setting out the parties’ arguments were provided during mediation. The adjudicator originally assigned to this appeal file set out the parties’ submissions in the Notices of Inquiry and provided each party with an opportunity to respond. Both the university and the appellant provided representations in response to the notices. For the purposes of this order, I have considered both the parties’ submissions made at mediation and those made in response to the Notices of Inquiry. [20]

The university’s position at mediation

[16] In referring to the list of factors set out above, the university provided submissions addressing them specifically.

[17] The university refers to the circumstances surrounding the creation of the records and submits that they were created by a student registered in the appellant’s course for the purpose of communicating about the course. The university confirmed that the records are retained on its email system and submits that this is only as a result of the student also being an employee and the emails being sent from a university email account.

[18] The university submits that the records were created by the named individual, an employee, who was also enrolled as a student at the relevant time. It submits that the records were not created for a university purpose and that all of the records relate solely to the creator’s role as a student.

[19] The university submits that it had no involvement with or authority over the creation of the records and that they belong to the named individual in his capacity as a student. The university submits that the contents of the records do not relate to its mandate or functions. The university confirmed that it had physical possession of the records as they were sent on its email system but submits that it does not have a right of possession, though it does administer the email account. The university submits that its policy allows employees to use their email accounts for a small amount of personal correspondence as long as the use does not interfere with their job and the emails are not used for harassment, discrimination or other improper purposes. It submits that while it has possession because the emails were sent on a university account, it does not have the right to deal with the records and has no responsibility to retain the records because they are personal records relating to the named individual’s role as a student. The university submits that students assume that their email is a personal record and not possessed or controlled by the university. The university also submits that the creator of the records provided copies to its privacy office but that the he maintains the personal nature of the records.

[20] The university refers to Orders PO-3612-I, PO-3716, MO-2821, MO-2773, and the Divisional Court’s decision in City of Ottawa v. Ontario [21] which it submits support the principle that any emails that are of a solely personal nature are not considered to be responsive records under the Act . The university submits that since the records are not university records, it has not relied on them and they are not integrated with other records it holds.

The appellant’s position

[21] The appellant challenges the university’s determination that the records are personal records. The appellant questions which “tests” the university used to determine that an employee writing from a work email address and creating a responsive record, becomes an employee writing a “private record.” The appellant also questions how this employee becomes a student even though he was an employee writing from a work email address. She submits:

The very decision to write from a work address clearly indicates to the recipient of the email that the email comes from a representative (of whatever rank, stature, importance) of Wilfrid Laurier University, not from an individual writing from a personal email account about personal matters. Any individual writing from a work email account to send email that creates a record about another individual working at the same institution might, upon reflection when notice is given that an access-to-information request has been made, choose to claim that the emails are personal, but the tests to determine whether or not the emails are personal have not been presented in a coherent manner.

[22] The appellant submits that she interprets the university’s position as allowing the named individual to use his work email to write his personal views about the appellant, her course, the university, its administration and departmental matters, including suggesting an alternative governance structure for the university. The appellant submits that since the named individual is using his work email, he has access to the auto-fill feature, not available on his student account, so he can reach many students who have not volunteered their email address to him. The appellant submits that given the university’s position, an employee, short of discrimination, can use “personal” time on university issued computers and university-run servers.

[23] Finally, the appellant noted that the university did not provide its complete policy on “Access Rights” in its submissions, because it omitted the portion stating that incidental personal use of the IT resources must be kept to a minimum. She submits that the named individual’s use of his work email was not kept to a minimum because he wrote more than one email and continued to create records even after his time as a student in her class had ended. She suggested that the named individual may have considered creating records about her as “work duties” instead of his actual work duties given the volume and duration of the emails created at his work station.

The university’s reply

[24] In response to the appellant, the university referred to its earlier submissions and the detailed list of factors that it addressed. The university submits that this list of factors is the “test” to apply in determining whether an email prepared and sent by an employee on a work email address is in its custody or under its control.

[25] The university submits that the case law is clear that employees of an institution governed by freedom of information legislation do not have their personal records and information subject to that legislation simply because the personal material is stored in their employer-provided office or email account at any given time. It refers to Interim Order PO-2701-I, which found that communication by a student relating to their role as a student is the student’s personal information. It submits that the fact that a personal record was created and sent on a university email account does not, in itself, change this from being the individual employee’s personal record to a university record in which the university has custody or control.

[26] The university also referred to Order PO-3009-F which involved faculty members at the University of Ottawa and found that records in the possession of a faculty member that relate to personal matters or activities, wholly unrelated to the university’s mandate, are not in the university’s custody or control and applied equally to physical records and records stored on the university’s email or other electronic IT systems. The university noted that importantly, the opposite also applies; the IPC has stated that an institution cannot evade access to information requests by using instant messaging tools or personal email accounts for business purposes. The university submits that it is the nature of the record and not the account on which it is created that determines the application of the Act.

[27] The university concluded by stating that whenever it receives an access request for records that may be held by an employee, its privacy office follows up with the employee and asks that the employee to conduct a search for the requested records. It submits that its privacy office also provides detailed instructions on how to do this and it is clear that the search includes all records in whatever format they are recorded. The university said that it followed this process in addressing the appellant’s access request, and that it was clear that the email records responsive to this request were personal records of the named individual as a student and did not relate to the student’s employment or departmental activities.

[28] The appellant was provided with the university’s response and in another email reiterated her position.

The parties’ representations at adjudication

[29] Considering the extensive submissions exchanged during mediation, the initial adjudicator invited the appellant to provide representations first on the list of factors and the university’s position. The adjudicator then invited the university to provide reply representations if it had any new submissions that it had not previously provided to this office.

[30] In her representations, the appellant submits that the creator of the records, who was both a student and an employee of the university at the relevant time, was her contact person in the university’s administration from July 1, 2014 to June 30, 2015, when she held a liaison role in a specified department of the university. The appellant provides no additional representations on the issue of custody or control.

Analysis and finding

[31] Having reviewed and considered all of the representations made by the parties throughout the appeal, I accept that the records are not within the university’s custody or control, for the following reasons.

[32] As noted, this office has developed a non-exhaustive list of factors to consider in determining whether or not a record is in the custody or control of an institution. I am to consider these factors contextually in light of the purpose of the legislation. There is no dispute that the named individual, the creator of the records, was a university employee as well as a university student at the relevant time and that he was enrolled in a university course taught by the appellant. The parties disagree on the named individual’s status for the purpose of the records.

[33] In its representations, the university specifically addressed the non-exhaustive list of factors, mentioned above. The university submits that despite its email system being used to send the named individual’s emails, the records that refer to the appellant are personal records relating to the named individual as a student in the appellant’s class and do not relate to him in his employment capacity. It further submits that its students assume that their emails are personal records that it does not possess or control, and that the named individual maintains that these records are of a personal nature.

[34] The university’s representations establish that it has bare possession of the records and nothing more. The bare possession of these records is not sufficient to establish that the university has custody of the records, absent some right to deal with the records and some responsibility for their care and protection. [22] I accept that the university has no authority over the creation, content, use and disposal of the records, as the records belong to a student in their capacity as a student and do not relate to the university’s mandate and functions. I accept that the records are personal emails sent on a work email account and that they belong to the creator, the named individual. The use of a work email for personal matters is not unheard of, and the university, like many modern workplaces, has an IT policy permitting some personal use of a work email address as long as that personal use does not amount to a contravention of the IT policy. This office and the courts have recognized this fact and have repeatedly found that private communications about matters unrelated to an employee’s work for an institution do not become records within the custody or under the control of that institution simply because the communications went through a work email address. [23]

[35] In City of Ottawa the Divisional Court found that when a government employee uses their workplace email address to send and receive personal emails unrelated to their work, these emails are not in the custody and control of the institution and, therefore do not fall within the scope of the Act . Justice Molloy speaking for the panel stated:

Much will depend on the individual circumstances of each case, but generally speaking, I would expect very few employee emails that are personal in nature and unrelated to government affairs to be subject to the legislation merely because they were sent or received on the email server of an institution subject to the Act .

[36] In my view, the circumstances in this appeal are similar and I adopt the approach in City of Ottawa. I am satisfied from a review of the representations, and the actual request, that the records were not created in the student’s capacity as a university employee, but rather, related to personal matters. I am also satisfied that the university had no involvement with or authority over the creation of the records, nor does it have any right to deal with the records or regulate their content.

[37] The appellant submits that the records cannot be of a personal nature because they were created on a work email and they refer to her. She also submits that the creation of more than one email about her proves that the named individual created the records in an employment capacity. I am not persuaded by this argument. The employee was also a student at the university and was taking a course taught by the appellant. I accept the university’s submission that the emails the student located related to his status as a student and not as a university employee.

[38] The intent of the legislature in enacting the Act  was to enhance democratic values by providing citizens with access to government information. [24] Considering the factors contextually in light of the Act ’s purpose, I do not see how interpreting the language of the Act  as applying to private communications of an employee would do anything to advance the purpose of the legislation or interfere with a citizen’s right to fully participate in democracy. [25]

[39] I conclude, therefore, that the records are not in the university’s custody or control.

[40] For these reasons, I find that the records are not in the custody or under the control of the university and are, therefore, not subject to the Act .

B. Did the university conduct a reasonable search for responsive records?

[41] Because the appellant claims that additional records exist beyond those identified by the university, I must also decide whether the university conducted a reasonable search for records as required by section 24. [26] To satisfy me that the search carried out was reasonable in the circumstances, the university must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. [27] To be responsive, a record must be "reasonably related" to the request. [28] This office has consistently found that a reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records which are reasonably related to the request. [29]

[42] This office has also consistently found that although a requester will rarely be in a position to indicate precisely which records the institution has not identified, the requester still must provide a reasonable basis for concluding that such records exist. [30]

Representations

[43] In its representations, the university submits that after receiving the appellant’s request it determined that the request was clear so it approached the named individual with detailed instructions on how to complete the search for all records that might be responsive to the request. The university submits that upon speaking with the named individual and reviewing the records it was clear that they were personal records and did not relate to his employment or departmental activities.

[44] The appellant submits that she was a co-op liaison at one point and that she was in a working relationship with the named individual who was her contact person. She appears to suggest that at minimum there should be records concerning university business when she was a co-op liaison.

[45] The appellant also submits that the university uses learning software that allows students to send emails to each other and to professors through a third party that is hosted on university servers. She asserts that the university has provided no indication that the named individual searched the email account associated with this software, nor has it indicated that the named individual has searched his student email account or his personal email accounts. She argues that because the university has stated that the named individual used his employee email account to discuss her, the absence of evidence of searches of other email accounts concerns her, as it is not reasonable to assume the named individual did not use third-party communication devices or servers to discuss her or issues related to her with other students or other university representatives when he clearly has used an inappropriate email address to discuss her extensively.

[46] In response to the appellant’s representations, the university states that there is no reason to believe there would be university records on any of the employee’s personal email accounts, including the identified individual’s student email account, that would be in the university’s custody or control and responsive to the request.

[47] The university notes that in the search documentation it sent to the individual who performed the search, which the university shared with the appellant during the mediation stage, it asked the named individual to search his work email account “and any other email accounts (including personal accounts) used for work purposes” for responsive records. It adds that the email to which this documentation was attached stated:

Conduct the search for the records requested. This includes all records in whatever form it is recorded – print and electronic – including documents, notes, email, social media created, maintained or used in the course of your employment with Laurier.

Analysis and findings

[48] As noted above, although an appellant will rarely be in a position to indicate precisely which records have not been identified in an institution’s search, they must, nevertheless, provide a reasonable basis for concluding that such records exist. [31]

[49] The appellant stated that she was a co-op liaison during the 2014-2015 school year, and the named individual was her contact in the university’s administration. She suggests that there should be emails that concern university business as a result which were not located in the university’s search. However, if the appellant is suggesting that this is the basis that further responsive records exist, I would expect her to be able to produce a record from her own email account in support of this claim by showing that the named individual communicated about university business with her using his email account.

[50] Also, there is no evidence before me that the named individual used either his personal email address or the learning software (for students) to conduct university business. I note that he was asked to search his work email account and any other email accounts, including personal accounts that may have been used for work purposes, when the university approached him about his search and none was located. Therefore, I find that there is no basis to order a further search of the identified individual’s personal email accounts.

[51] Further, I find that the search was completed by an experienced employee knowledgeable in the subject matter of the request who expended a reasonable effort to locate records which are reasonably related to the request. In my review of the email the co-ordinator at the privacy office sent to the named individual to facilitate his search, I find that it is quite detailed and states that the search should include all records in whatever form they are recorded and includes print, electronic, document, notes, email, social media created, maintained or used in the course of his employment with the university. The university provided clear and thorough instructions to the named individual on how to conduct a reasonable search for records responsive to the appellant’s request. It is also apparent that the named individual conducted a search for records in accordance with the instructions provided by the university. After a search was completed and the records reviewed, it was clear to the university that the records were outside of its custody and control. I am not convinced by the appellant’s submissions that the named individual would retrieve further responsive records if the university approached him to conduct yet another search.

[52] For these reasons, I find that the university’s search was reasonable.

ORDER:

I uphold the university’s decision and dismiss the appeal.

Original Signed by:		January 27, 2021
Alec Fadel
Adjudicator