INTERIM ORDER PO-4114-I

Appeal PA19-00512

McMaster University

February 24, 2021

Summary: McMaster University (the university) received a request under the Freedom of Information and Protection of Privacy Act  (the Act ) for access to information relating to the requester that was held by a specific office at the university. The university provided a record in response. The requester, believing that further responsive records should exist, appealed the reasonableness of the university’s search. In this order, the adjudicator finds that the university has not provided sufficient evidence regarding its search for responsive records and orders it to conduct a further search.

Statutes Considered: Freedom of Information and Protection of Privacy Act ,   R.S.O. 1990, c. F.31 , as amended, s.24.

OVERVIEW:

[1] McMaster University (the university) received a request under the Freedom of Information and Protection of Privacy Act  (the Act ) for the requester’s “entire record” from a specific office at the university, the Ontario Physician Human Resources Data Centre (the Data Centre) and all communications that the Data Centre had with another university (the Other University) regarding her request.

[2] The university granted full access to one responsive record, an Excel Workbook containing 25 sheets. The requester, now the appellant, appealed the university’s decision to this office.

[3] Prior to the commencement of mediation, the university provided the appellant with additional responsive records relating to the second part of her request, specifically email communications between the Data Centre and the Other University.

[4] During mediation, the mediator had discussions with the parties about the records and issues on appeal. The appellant advised the mediator that she believes that additional responsive records should exist relating to communications between the Data Centre and the Other University. The mediator raised this with the university’s representative. The university’s representative advised that there were no further responsive records. The mediator relayed this information to the appellant.

[5] The appellant also asked that the university provide her with the meaning of the acronyms that appeared in the Excel Workbook during mediation. The mediator raised this issue with the university’s representative. The parties were unable to resolve this issue through the process of mediation and section 48 (comprehensible form) of the Act  was added as an issue to this appeal.

[6] Further mediation of the issues was not possible. The appellant continued to assert that additional responsive records should exist and the appeal was transferred to the adjudication stage of the appeals process, where an adjudicator may conduct a written inquiry under the Act .

[7] I commenced this inquiry by seeking representations from the university. The appellant was then invited to make representations and both the university and the appellant made additional representations in reply and sur-reply. During the inquiry stage, the university provided the appellant with information about the acronyms used in the Excel Workbook. As a result, section 48  of the Act  is no longer at issue and the only issue to be determined in this inquiry is whether the university conducted a reasonable search for responsive records.

[8] In this order, the adjudicator finds that the university has not provided sufficient evidence regarding its search for responsive records and she orders it to conduct a further search for responsive records and to provide specific details about that search.

DISCUSSION:

[9] Where a requester claims that additional records exist beyond those identified by the institution, the issue to be decided is whether the institution has conducted a reasonable search for records as required by section 24. [1] If I am satisfied that the search carried out was reasonable in the circumstances, I will uphold the institution’s decision. If I am not satisfied, I may order further searches.

[10] The Act  does not require the institution to prove with absolute certainty that further records do not exist. However, the institution must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. [2] To be responsive, a record must be "reasonably related" to the request. [3]

[11] A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records which are reasonably related to the request. [4]

[12] A further search will be ordered if the institution does not provide sufficient evidence to demonstrate that it has made a reasonable effort to identify and locate all of the responsive records within its custody or control. [5]

[13] Although a requester will rarely be in a position to indicate precisely which records the institution has not identified, the requester still must provide a reasonable basis for concluding that such records exist. [6]

The university representations

[14] The university submits that its search was reasonable and in accordance with the provisions of the Act . In support of this assertion, the university provided an affidavit from its former Privacy Coordinator. It says that the Privacy Coordinator’s affidavit clearly establishes that the university’s search in response to the appellant’s request was conducted by employees that were experienced and knowledgeable in the subject matter of the request and that they expended reasonable efforts to located records that were responsive to the request.

[15] In her affidavit, the Privacy Coordinator attests that she is the former Privacy Coordinator for the university and was responsible for coordinating the search for records that were responsive to the appellant’s request. She says that she reported directly to the University Secretary and the Designated Head of Institution in respect of the appellant’s request.

[16] The Privacy Coordinator states that the only office that could reasonably be expected to have records responsive to the appellants’ request was the Data Centre. She says the Data Centre is a small office with six employees. She states that it “was contacted and asked to search for responsive records.” She says that she directly coordinated the search for records in consultation with the Data Centre’s Director and its Research Coordinator, both of whom had knowledge of the appellants’ request for records.

[17] The Coordinator attests that searches were conducted by the Director and the Research Coordinator. She says that she was advised that the searches of the “offices” included searches of emails, electronic files and paper files. [7] She specifies that she was further advised that the searches included all communications between the university and the Other University in relation to the appellant’s request.

[18] The Coordinator “confirms” that the records retrieved by the Data Centre representatives and delivered to her office for review included all correspondence between the university and the Other University, regardless of the subject matter, for the applicable time period “from which we were able to identify all records referencing the appellant and relating to the appellant’s request for records.” She says that based on her consultations with the Data Centre, she has no reason to believe that any further responsive records exist.

[19] The Coordinator attests that it is her belief that the university’s search in response to the request was conducted by employees experienced and knowledgeable in the subject matter of the request who expended reasonable efforts to locate records that were related to the request.

The appellant’s representations

[20] The appellant submits that the university has not provided sufficient evidence to show that it made a reasonable effort to identify and locate responsive records that are reasonably related to her request.

[21] First, the appellant says that the university’s affidavit was not sworn by the individual who conducted the actual search for records. She submits that according to the affidavit of the Privacy Coordinator, the searches were conducted by the Data Centre’s Director and its Research Coordinator. The appellant says that affidavits should have been provided by these individuals.

[22] Next, the appellant says that the communications could have also occurred between various other parties, including other staff at the Data Centre and the Other University, staff at the university’s privacy office and other internal university communications.

[23] The appellant notes that in her affidavit, the Privacy Coordinator attested that the only office that could reasonably be expected to have records responsive to her request was the Data Centre. The appellant argues that the Privacy Coordinator has limited the scope of her request by eliminating any responsive records at the university’s Privacy Office. She says that the Privacy Coordinator does not explain why the Data Centre would be the only office that could reasonably be expected to have records responsive to her request. She asserts that since both Data Centre and the university’s Privacy Office dealt with her request, it follows that they could both be reasonably expected to have responsive records.

[24] The appellant asserts that one of the emails she was provided suggests that there were communications between the Privacy Office liaison at the university and the Data Centre’s Research Coordinator and that as such, there should have been additional responsive records.

[25] The appellant also submits that the university limited the scope of responsive records at Data Centre by including additional requirements for records to be responsive. Specifically, the appellant says that the university limited its search to only records that referenced her name. She argues that this represents a narrowing of her request and submits that a record may be “reasonably related” to her request without making reference to her name since the reference may be implied, understood, or unnecessary.

[26] Furthermore, the appellant says that the three records the university provided her could not exist in isolation of others that have not been provided. For example, she says one of the emails asks how the recipient would like the sender to proceed and the responding email asks to recipient to keep the sender informed of any concerns or delays. The appellant says it appears that there are intervening email communications that may have been excluded. The appellant refers me to Order MO-3661-I where she says that an adjudicator ordered a further search in similar circumstances where it appeared that some of the records at issue could not exist in isolation of others.

[27] Finally, the appellant says that there are formatting inconsistencies that suggest intervening emails were not included. Specifically, she says that one of the three email chains is not aligned the same as the other two. She notes that there is an indentation between specific emails that leads her to believe some emails may be missing. She also points to formatting inconsistencies with regard to horizontal lines and missing “headers” which she asserts is evidence that there may be additional responsive emails.

The university’s reply

[28] In reply, the university submits that the Privacy Coordinator had direct responsibility for and oversight of the entire search for records was properly selected as its affiant. It submits that the Coordinator had direct knowledge of the matters that were deposed. The university asserts that no further affidavit evidence is reasonably required to assess the reasonableness of the university’s search.

[29] The university denies that it limited the scope of its search by not searching for correspondence between the Data Centre and the Privacy Office. It says that the request was clearly and unambiguously a request for communications between the university (including the Data Centre and the university’s Privacy Office) and the Other University. The university asserts that regardless of the appellant’s subjective intent, she never stated or implied that she was seeking internal correspondence amongst university representatives. The university submits that there is no reasonable interpretation of the appellant’s request that would include such internal correspondence.

[30] The university further submits that it is illogical to conclude that the appellant’s request was intended to include correspondence between Data Centre and the Privacy Office, as any such correspondence would have post-dated the time period applicable to the request.

[31] The university submits that the Privacy Coordinator “had actual knowledge that there was no correspondence between the Privacy Office and the Other Institution” when she attested to the fact that Data Centre was the only office within the university where responsive records could exist. The university asserts that this does not constitute a narrowing of the scope of the request and that it is an example of an individual with direct knowledge of the matter at hand that properly and reasonably determined that only the Data Centre could have records responsive to the request.

[32] The university says that the Data Centre delivered to the Privacy Office all correspondence between Data Centre and the Other Institution and that upon receipt of such records, the Privacy Office reviewed and identified those records responsive to the request. It says that because this was a request for the appellant’s personal information, it is unclear how any record not referencing the appellant and the appellant’s request for records could possibly be considered responsive to the request.

The appellants’ sur-reply

[33] The appellant reiterates her assertion that the Privacy Coordinator was not the appropriate individual to submit an affidavit regarding the university’s search for responsive records. She says that the affiant was the “former” Privacy Coordinator and she was responsible only for coordinating the search. The appellant says the actual searches were conducted by the Data Centre’s Director and its Research Coordinator.

[34] The appellant denies that the Privacy Coordinator had direct knowledge of the search. She says this is apparent from her affidavit which indicates that she was advised by others regarding the actual searches conducted.

[35] The appellant further asserts that the Privacy Coordinator was unsuited to provide the affidavit of search because she is no longer the university’s Privacy Coordinator. The appellant refers me to Orders P-618 and MO-2663-I, where she says institutions were ordered to conduct a further searches and provide additional affidavits because the adjudicators concluded that the institutions had not provided direct evidence from the persons who conducted the actual searches for responsive records.

[36] The appellant denies that she is expanding the scope of her request. She says that the communications she says are missing are reasonably related to her request and she continues to assert that the university is limiting the scope of her request by not conducting the searches she referred to in her initial representations.

[37] The appellant submits that the records the university provided to her clearly indicate that the university expected to communicate further with the Data Centre and the Other University. She refers me to one of the records at issue, which she says clearly demonstrates that there are communications between the university’s Privacy Office and the Data Centre that exist and are responsive to her request.

[38] The appellant also says that her request was made in context of a privacy breach that was associated with the request. She says that she subsequently clarified with the university that she was requesting records that post-dated her initial request. She says when she first contacted the university, she was only seeking a copy of her personal information that was under the custody and control of Data Centre. However, she says that once she learned that university had contacted the Other University, she advised the university that it had breached her privacy. She asserts that the privacy breach was the basis for the additional unique request for additional records.

[39] The appellant says it was clear that she was seeking information related to the privacy breach and that any communications between any of the three parties related to the privacy breach would be clearly related to her request. She says that the university’s failure to consider this context is demonstrative that it adopted an overly technical, restrictive and narrow interpretation of her request and that it failed to consider the context of the request for all records that are reasonably related to the privacy breach.

[40] The appellant also argues that, given the unique nature of the request for records that relate to the privacy breach associated with the request for information, it is logical and expected that additional responsive records would be generated after she submitted the request. The appellant asserts that a response she received from the university makes it clear that the university understood she was seeing communications that “post-dated” the time of her request.

[41] In support of her assertions, the appellant refers me to orders of this office that specify that the purpose and spirit of the Act  is best served when institutions adopt a liberal interpretation of requests for information. She says that the university has failed to do this.

[42] In response to the university’s submission that it searched for records that included her name, the appellant points out that not all of the emails in the email chains that comprise the records at issue mention her name, yet they are still responsive to her request.

[43] The appellant also makes a number of submissions regarding her preference for the Research Coordinator to send her an email, and for other specific relief, which I will not set out in detail.

Findings and analysis

[44] For the reasons that follow, I find that the university has not provided me with sufficient evidence to enable me to conclude that, in the circumstances of this appeal, it has discharged its statutory responsibility to conduct a reasonable search for records responsive to the appellant’s request and I will order the university to conduct a further search for records.

[45] In support of its assertions that it conducted a reasonable search for responsive records, the university provided an affidavit from its former Privacy Coordinator, who attested that she was responsible for “coordinating” the search for records that were responsive to the appellant’s request. The Privacy Coordinator said that the only office that could reasonably be expected to have responsive records was the Data Centre. She stated the Data Centre is a small office with only six employees and that she coordinated the search in “consultation” with the Data Centre’s Director and its Research Coordinator.

[46] I understand from the Privacy Coordinator’s affidavit that the Director and the Research Coordinator conducted the searches of the Data Centre, and that their searches included emails, electronic files and paper files. However, the university provided no direct information about how the Director or the Research Coordinator actually conducted the searches. For example, the Privacy Coordinator did not specify what specific actions they took, or whether the other four employees in the Data Centre also searched for records. If it was not necessary for the other four employees to search for responsive records, the Privacy Coordinator did not provide an explanation in that regard.

[47] Without direct information about the searches conducted, it is not possible for me to evaluate the Privacy Coordinator’s attestation that all the responsive records were delivered to the Privacy Office for review, or her statement that she has no reason to believe further responsive records exist.

[48] Based on my review of all of the evidence before me in this appeal, I agree with the appellant that the Privacy Coordinator was not the appropriate individual to provide the affidavit setting out the details of the university’s search. While there are some cases where a privacy coordinator, freedom of information coordinator, or an employee in a similar role may be the appropriate person to provide the affidavit of search for an institution, the university has not satisfied me that this is the case in this appeal. [8]

[49] In this case, the Privacy Coordinator’s role was limited to requesting that the Data Centre search for responsive records. All of her evidence about how the actual searches were conducted is based on what she has been told by the Director and Research Coordinator. This second-hand information does not enable me to conclude that the university has conducted a reasonable search, particularly in light of some of the concerns raised by the appellant.

[50] Specifically, the appellant says that there are inconsistencies in the formatting of emails that suggest that intervening emails have not been identified and provided. She also says that there appears to be intervening emails missing based on the content of the email chains she received. I do not agree with the appellant that this is clear evidence that emails are missing. There are many possible reasons for email chains being formatted differently and there are other ways for individuals to communicate beyond email. However, I agree with the appellant that the Privacy Coordinator’s attested belief that all of the responsive records are included is insufficient in the circumstances and further information from the individuals who actually conducted the searches for emails is necessary.

[51] The appellant also expressed concern that the university limited its search to only those records that contained her name. Based on my review of the university’s original representations, it does not appear that its search was limited only to records containing the appellant’s name. However, given the second-hand nature of the evidence provided by the university, I accept the appellant’s concern that the search terms used were unclear.

[52] For the reasons set out above, I will order that the university conduct a further search for records and provide me with detailed affidavits sworn by the individuals who carry out these searches. The search for records should include all records that may exist, up until the date the appellant submitted her request. [9] If possible, affidavits should be provided by the Director and the Research Coordinator of the Data Centre. These individuals should provide any overview of what specific actions they took to locate and identify responsive records and include information about any further steps they take to locate any potential missing emails or other records not previously identified in their earlier search.

[53] If these individuals are not available to conduct these additional searches and provide affidavit evidence regarding their efforts, the university should identify the appropriate alternate individual(s) to conduct the searches and provide detailed and specific evidence about the steps taken and why the university believes those steps are adequate in light of the circumstances set out in this interim order.

[54] As part of its further searches, the university should take steps to confirm the Privacy Coordinator’s assertion that the Data Centre is the only office that has responsive records and it should provide a detailed overview of the steps it took in that regard. If additional records are located during this aspect of the search, the university must provide evidence about how and where they were located.

[55] The appellant has made a number of further arguments about the university’s search, which I do not accept. I will address these below. For clarity, no further searches are required by the university in relation to the issues that follow.

[56] First, the appellant asserts that her request should be interpreted to include internal university communications, and communications within the Data Centre. I agree with the university that the appellant’s request did not include internal communications. As set out above, the appellant’s request was for her “record” at the Data Centre, as well as all communications the Data Centre had with the Other University about her request. Based on my review of the parties’ representations, I understand that her “record” was provided in the form of the Excel Workbook and that balance of her request was for communications between the Data Centre and the Other University. Based on all of the information before me, I agree with the university that a logical reading of the appellant’s request does not include internal university communications.

[57] The appellant has also made a number of representations about seeking records that, if they existed, would have been created after she submitted her request for information to the university. For example, she says that her request was made in the context of a privacy breach that was associated with her request and that she clarified with the university that she was requesting records that post-dated her initial request.

[58] In my view, the responsive records in this appeal cannot post-date the appellant’s request. To be clear, the university is only required to search for responsive records that existed prior to the date the appellant’s formal request for information was submitted. Based on my review of the information in our office’s file, I understand that date was August 26, 2019. If the appellant wishes to access records about the privacy breach she says occurred, or if she would like to request internal university communications, she may make a new request.

[59] In making this finding I have considered the appellant’s representation that the purpose and spirit of the Act  is best served when institutions adopt a liberal interpretation of requests for information. While I agree with this statement, a “liberal interpretation” does not mean that a request can be expanded to include information beyond the scope of what would reasonably be included in a request.

[60] Finally, I note that in the “Relief Sought” section of her representations, the appellant indicates that should would like the Research Coordinator to send her a specific email. The Act  does not provide me the jurisdiction to order that an employee of an institution email an appellant. The Act  provides that I may order a further search for responsive records, which I will do below.

ORDER:

1. I order the university to conduct a further search for records responsive to the appellant’s request in accordance with paragraphs 52 to 54 of this interim order.
2. I order the university to issue an access decision to the appellant regarding access to any records located as a result of the search ordered in Order Provision 1, in accordance with the Act , treating the date of this order as the date of the request.
3. I order the university to provide me with a copy of their decision rendered to the appellant in accordance with Order Provisions 1 and 2.
4. The university shall send their representations on the new search referred in Provision 1 and to provide me, by March 31, 2021 affidavits outlining the following:
1. the names and positions of the individuals who conducted the searches;
2. information about the types of files searched, the nature and location of the search, and the steps taken in conducting the search;
3. the results of the search; and
4. details of whether the record could have been destroyed, including information about record maintenance policies and practices such as retention schedules.

The university’s representations may be shared with the appellant, unless there is an overriding confidentiality concern. The procedure for submitting and sharing representations is set out in this office’s Practice Direction Number 7, which is available on the IPC’s website. The university should indicate whether it consents to the sharing of their representations with the appellant.

5. I remain seized of this appeal in order to deal with the outstanding issues arising from provisions 1 and 4 of this interim order.
6. The timeline noted in Order Provision 4 may be extended if the university is unable to comply in light of the current COVID-19 situation. I remain seized of the appeal to address any such requests.

Original signed by:		February 24, 2021
Meganne Cameron
Adjudicator