FINAL ORDER PO-4160-F

Appeal PA19-00512

McMaster University

June 29, 2021

Summary: McMaster University (the university) received a request under the Freedom of Information and Protection of Privacy Act  (the Act ) for access to information relating to the requester that was held by a specific office at the university. The university provided records in response. The requester, believing that further responsive records should exist, appealed the reasonableness of the university’s search. In Interim Order PO-4114-I, the adjudicator determined that the university had not provided sufficient evidence regarding its search for responsive records and ordered it to conduct a further search. In this final order, the adjudicator upholds the university’s search as reasonable and dismisses the appeal.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, section 24.

Order Considered: Order PO-4114-I.

OVERVIEW:

[1] This final order addresses the reasonableness of a search conducted by McMaster University (the university) for all communications between the Ontario Physician Human Resources Data Centre (the Data Centre) and another university (the Other University) in response to a request the appellant made to the university pursuant to the Freedom of Information and Protection of Privacy Act  (the Act ).

[2] The appellant requested a copy of her “entire record” from the Data Centre and all communications that the Data Centre had with the Other University regarding that request. In Interim Order PO-4114-I, I concluded that the appellant’s “record” was provided in the form of an Excel Workbook and that balance of her request was for communications between the Data Centre and the Other University. I found that the university had failed to discharge its burden of providing the necessary evidence to establish that it conducted a reasonable search for records responsive to the second part of the appellant’s request, for communications between the Data Centre and the Other University. Specifically, I said the following:

[52] For the reasons set out above, I will order that the university conduct a further search for records and provide me with detailed affidavits sworn by the individuals who carry out these searches. The search for records should include all records that may exist, up until the date the appellant submitted her request. If possible, affidavits should be provided by the Director and the Research Coordinator of the Data Centre. These individuals should provide any overview of what specific actions they took to locate and identify responsive records and include information about any further steps they take to locate any potential missing emails or other records not previously identified in their earlier search.

[53] If these individuals are not available to conduct these additional searches and provide affidavit evidence regarding their efforts, the university should identify the appropriate alternate individual(s) to conduct the searches and provide detailed and specific evidence about the steps taken and why the university believes those steps are adequate in light of the circumstances set out in this interim order.

[54] As part of its further searches, the university should take steps to confirm the Privacy Coordinator’s assertion that the Data Centre is the only office that has responsive records and it should provide a detailed overview of the steps it took in that regard. If additional records are located during this aspect of the search, the university must provide evidence about how and where they were located.

[3] As ordered, the university conducted a further search for responsive records and also provided affidavit evidence detailing the specific actions undertaken in its earlier searches. The appellant provided representations in response challenging the university’s past searches, its new search and the credibility of its affiants.

[4] After reviewing the parties’ representations, I wrote to the university and invited it to provide further specific evidence about its searches for emails and asked it to explain who at the university had conducted the searches and how they were completed. I asked the university to consider paragraphs 50 and 51 of Interim Order PO-4114-I, which provided additional context about why I ordered it to search for additional email correspondence.

[5] The university provided further representations and an affidavit in response to my letter. These submissions were provided to the appellant, who was invited to make representations in reply. Following the receipt of the appellant’s reply, both the university and the appellant made a further sur-reply.

[6] In this order, I conclude that the university has provided sufficient evidence to establish that it has conducted a reasonable search for records responsive to the appellant’s request pursuant to the Act and I dismiss the appeal.

Preliminary matter

[7] In each set of representations referred to above, the appellant requested that an employee at the university email her one of the records the university provided in response to her request in a specific format.

[8] The appellant originally made this request in her initial representations for this inquiry under the heading “relief sought.” She asked that a university employee send her a copy of an email in a specific format. In Interim Order PO-4114-I, I noted that the Act  did not provide me the jurisdiction to order an employee of an institution to send an appellant a copy of an email and I declined to do so.

[9] The appellant requested that I reconsider Interim Order PO-4114-I on a number of grounds. In her reconsideration request, she specified the following:

[…] ‘RECORD – August 8, 2019.pdf,’ which is an email chain, was provided in PDF format. What I requested was the Research Coordinator send me this Record in its original form – as an email attachment with a .eml extension.

[10] In the schedule attached to her reconsideration request, she submitted that I had misrepresented her request in Interim Order PO-4114-I and omitted to consider section 30(2)  of the Act . In Reconsideration Order PO-4134-R I concluded that section 30(2), which allows a person to ask to inspect the original record, was not at issue before me in Interim Order PO-4114-I and I declined to consider it in response to the appellant’s reconsideration request.

[11] The appellant has since reiterated her request to “be provided with the record ‘Record – August 8, 2019.pdf’ in its original form” three more times, in each set of representations made to this office referred to above in regards to this final order. The appellant argues that “section 30(2) is subject only to the requirement of reasonable practicability.” She says that she has already established that

• her request is reasonably practical;
• the record at issue is clearly a part of this appeal;
• she made the request to view the original at the earliest opportunity during the adjudication process (in her initial representations); and
• this remains the only avenue for her to request viewing the original record at this time.

[12] The appellant notes that the university has not addressed the issue of whether the employee should send her the email and points out that the portions of her representations related to this request were severed from the copies of her representations I provided to the university.

[13] I confirm that the university was not invited to respond to the appellant’s submissions regarding her request for the employee to send her a copy of an email because, as I noted in Reconsideration Order PO-4134-R, that matter is not at issue in this appeal.

[14] To clarify, in Reconsideration Order PO-4134-R, I concluded that the appellant’s demand for the employee at the university to send her an email does not qualify as a request for access to an original record pursuant to section 30(2)  of the Act . That section specifies the following:

Access to original record

Where a person requests the opportunity to examine a record or a part thereof and it is reasonably practicable to give the person that opportunity, the head shall allow the person to examine the record or part thereof in accordance with the regulations. R.S.O. 1990, c. F.31, s. 30 (2) .

[15] Regulation section 3 of O. Reg. 460 provides, in part:

1. A head who provides access to an original record must ensure the security of the record.
2. A head may require that a person who is granted access to an original record examine it at premises operated by the institution.

[16] This section contemplates that a requester may prefer to examine the original record rather than obtain a copy. Previous orders of this office have typically interpreted section 30(2) to mean that a requester may request to view a record onsite at the institution, or otherwise attend somewhere in person to physically examine a record. [1]

[17] The appellant has repeatedly asked that a particular employee at the university send her a copy of an email in a particular format. In my view, receiving an email, regardless of the format, is not the same as examining the original record, as contemplated by section 30(2)  of the Act . The appellant did not raise section 30(2) until she made a reconsideration request, I declined to consider it at that time and I will not consider it now either.

DISCUSSION:

[18] The only issue remaining in this appeal is whether the university has established that it conducted a reasonable search for records that are responsive to the appellant’s request. Where a requester claims that additional records exist beyond those identified by the institution, the issue to be decided is whether the institution has conducted a reasonable search for records as required by section 24. [2] If I am satisfied that the search carried out was reasonable in the circumstances, I will uphold the institution’s decision. If I am not satisfied, I may order further searches.

[19] The Act  does not require the institution to prove with absolute certainty that further records do not exist. However, the institution must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. [3] To be responsive, a record must be "reasonably related" to the request. [4]

[20] A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records which are reasonably related to the request. [5]

[21] A further search will be ordered if the institution does not provide sufficient evidence to demonstrate that it has made a reasonable effort to identify and locate all of the responsive records within its custody or control. [6]

The university’s representations

[22] In response to Interim Order PO-4114-I, the university provided two affidavits. The first affidavit was sworn by the Assistant Director of the Data Centre. She provided additional information about the university’s initial search for responsive records and also attested that she participated in a further search for responsive records together with a Research Coordinator. Specifically, the Assistant Director attested that

I confirm that the records retrieved from the [Data Centre’s] internal network drives on virtual servers and disclosed include all records responsive to the Request, including correspondence between [the university] and the Other [University], regardless of subject matter, for the applicable time period, and that we were able to identify all records referencing the Appellant and relating to the Request.

[23] The Research Coordinator that conducted the further search with the Assistant Director also provided an affidavit confirming the information in the Assistant Director’s affidavit.

The appellant’s reply

[24] The appellant provided responsive representations in which she submits that the evidence provided by the university does not detail its search for the records that are currently at issue. She says that the Assistant Director and Research Coordinator’s affidavits describe the search that resulted in the excel file she was already provided in response to her request for her “entire record.” She says that the current issue in this appeal is the search for communications between the university and the Other University.

[25] She also asserts that the university failed to search the emails of two employees who are likely to have responsive records and argues that the Assistant Director provided incorrect evidence about when the university’s search for communications between the Data Centre and the Other University was conducted. The appellant refers me to an appendix she provided in support of her earlier representations in support of these assertions.

[26] Lastly, the appellant argues that the university improperly limited the scope of its search. She says that the Assistant Director’s affidavit specifies that emails were only identified as responsive if they referenced her name and related to her request and she provides additional submissions and evidence in support of this assertion.

The university’s sur-reply

[27] The university was invited to make representations in sur-reply. Specifically, I asked the university to consider Order Provision 2 of Interim Order PO-4114-I, where it was ordered to complete searches for the type of records described in paragraphs 52 to 54 of that interim order. I noted that the university has not specified what steps it took to locate any potential missing emails and invited it to provide further affidavit evidence about any steps it had taken, or would take, in that regard.

[28] In response, the university provided additional representations and an affidavit from the Research Coordinator referred to in paragraph 52 of Interim Order PO-4114-I (the Second Research Coordinator).

[29] The Second Research Coordinator attests that the Data Centre is a small office with seven employees including a Director, an Assistant Director, three Research Coordinators and two Data Management Assistants. She says that in addition to the searches detailed in the Assistant Director’s affidavit, she oversaw two searches for emails. She specified that during these searches, the emails of all employees at the Data Centre were searched, with the exception of the Data Management Assistants. The Second Research Coordinator attested that the employment duties of the Data Management Assistants do not involve anything potentially relevant to the matters at issue in this appeal and she further stated that they do not have contact with outside universities, including the Other University.

[30] The Second Research Coordinator says that an initial email search of the Data Centre employees’ email accounts was conducted on August 7^th and 8^th of 2019. She states that it was a search for any email correspondence containing the appellant’s first or last name. She attests that a subsequent email search was conducted of the Data Centre employees’ email accounts on October 7, 2019 for the following:

any and all email correspondence with the Other [University], or even just containing the word ‘Ottawa’ (which search term would also capture variations, such as ‘UOttawa’, ‘uOttawa’, all institutional email addresses ending in ‘@uottawa.ca’, etc.), for the period July 29, 2019 to August 28, 2019, regardless of subject matter.

[31] The Second Research Coordinator says that “all mailboxes” in the Data Centre employees’ email accounts were searched during both email searches, using the “email client search function.” The Second Research Coordinator’s affidavit includes an image she identifies as a screenshot of the “email client search function.”

[32] The Second Research Coordinator specifies that the “all mailboxes” searches covered all folders, including the “Inbox”, “Sent Items” and “Deleted Items” (also known as “Trash”) folders, as well as any draft or archived items.

[33] She says that when a relevant email was located, it was copied and saved to a folder created for that purpose. She states that duplication of emails was avoided by ensuring that entire “email chains” were copied and saved. She says that this occasionally affected the formatting in earlier emails, but did not affect any of the content.

[34] The Second Research Coordinator says that when these email searches were completed, the relevant “email chains” were submitted to the university’s Privacy Office and ultimately disclosed. The Second Research Coordinator attests that there are no additional places that Data Centre employee emails are stored to be searched. She says that at the Data Centre, neither emails nor personal data is ever printed or stored in paper files and that all information is exclusively stored in electronic folders saved on the Data Centre’s internal network drives on virtual servers. She denies that any emails were deleted or destroyed and confirms that the emails were retrieved from the Data Centre’s employee email internal network drives on virtual servers and disclosed include all emails responsive to the appellant’s request.

[35] The Second Research Coordinator attests that based on her oversight of the above-described email searches, she has no reason to believe that any further responsive records exist, that any emails are missing, or that any further searches are necessary.

The appellant’s sur-reply

[36] The appellant was provided with a copy of the university’s representations and the Second Research Coordinator’s affidavit and was invited to make a sur-reply. In her sur-reply, the appellant argues that that there is inaccurate information in the evidence provided by the university. Specifically, she says that the search for emails the university says it conducted on August 7^th and 8^th of 2019 could not have taken place at that time because she did not make a request for communications between the Data Centre and the Other University until August 26, 2019.

[37] The appellant also refers me to evidence she previously provided of her communications with the university where the university apologized for failing to note the part of her request where she asked for communications between the Data Centre and the Other University and advised that it would “work to fulfil [that] request as soon as possible.” The appellant notes the date on the communication was October 4, 2019 and she says that as a result, the search for records could not have been conducted on August 7^th to 8^th, 2019, as attested to in the Second Research Coordinator’s affidavit.

[38] The appellant argues that because the Second Research Coordinator’s affidavit included a statement that is not true, the credibility of the entire affidavit is compromised and cannot be relied on.

[39] The appellant also submits that in previous representations, the university had indicated that it was willing to conduct a further search for responsive records between August 2, 2019 and August 8, 2019, but that to date, the university has not provided any affidavit evidence of this search.

[40] In summary, the appellant submits that the university has not provided sufficient evidence that it has made a reasonable effort to identify and locate all responsive records that are reasonably related to her request for communication between the Data Centre and the Other University. She states that this is due to the fact that the Second Research Coordinator’s affidavit is inaccurate and unreliable and because the university provided no evidence that it performed the additional search that it committed to. She requests that the university conduct a further search for responsive records and that affidavits be provided by the Director and the Information and Technology Department in support of those further searches.

The university’s sur-reply

[41] The university was invited to respond to the issues raised by the appellant about the credibility of the evidence it provided. It submits that the issues raised by the appellant with respect to its initial search for emails on August 7^th and 8^th of 2019, are based on a misunderstanding or a mischaracterization of the evidence set out in the Second Research Coordinator’s affidavit.

[42] The university says that the appellant first telephoned the Second Research Coordinator on July 29, 2019 and requested a copy of her “entire record” at the Data Centre. [7] The university says that request was later expanded to include any communications between the Data Centre and the Other University regarding her initial request, by way of the appellant’s letter of August 26, 2019.

[43] The university submits that the initial email search that was completed on August 7^th and 8^th of 2019 was conducted in order to determine what the appellant’s “entire record” with the Data Centre might comprise. The university says that the broader search that was completed in October 2019 was intended to locate any emails exchanged with the Other University, on any subject, to ensure that the appellant’s expanded formal request under the Act  was satisfied.

[44] The university also submits that the affidavits of the Assistant Director and the Research Coordinator, sworn March 30, 2021, clearly establish their further searches on March 15, 2021, with respect to the entire relevant period.

[45] In summary, the university says that its searches were reasonable and in accordance with the provisions of the Act , and that no further search or affidavit evidence is necessary. It also denies that there is any basis for questioning these facts, or impugning the Second Research Coordinator’s credibility. It asserts the Second Research Coordinator’s evidence is accurate and reliable, and says that the searches she describes were reasonable, in the circumstances. The university asks that the appellant’s appeal be dismissed.

The appellant’s final sur-reply

[46] The appellant was provided with a copy of the university’s response and invited to make additional sur-reply submissions.

[47] The appellant submits that it is unreasonable to suggest that there was an email search prior to August 26, 2019, since the search for her personal information did not occur until September 17^th and 18^th of 2019.

[48] She also alleges that the university is providing contradictory information about where records are stored. Specifically, she says that the university’s submission that it searched its emails for her personal information is contradictory to the Assistant Director’s affidavit which specified that email accounts are not used to store personal information. She also says that it is contradictory to the Second Research Coordinator’s affidavit evidence that records are not sent via email, and therefore it would not be reasonable for the university to look in emails for her personal information.

[49] Furthermore, the appellant submits that keeping personal information in emails would be contradictory to the Data Centre’s Data Management Policies and Procedures, an excerpt of which she provided. The appellant asserts that given that the Second Research Coordinator specified that she is an "employee experienced and knowledgeable in the subject matter of the Request," she should reasonably have knowledge about the Data Centre’s data management policies and procedures. The appellant submits that it would be unreasonable for the Second Research Coordinator to search emails to determine what her entire record "might comprise" as she herself indicated that records are not sent via email and therefore would not be located in email accounts.

[50] The appellant asserts that additional evidence does not support the Second Research Coordinator’s assertion that she performed an email search on August 7^th and 8^th of 2019. Specifically, she says:

• the Second Research Coordinator indicated in various emails that she would transfer the request to the Other University;
• the appellant had not yet submitted a formal request at that time;
• a university employee sent an email to the appellant on October 4, 2019 indicating that the university had failed to note the part of the appellant’s request seeking communications between the Data Centre and the Other University.

[51] The appellant asserts that in light of the inconsistencies outlined above, the Second Research Coordinator’s entire affidavit is compromised and cannot be relied on.

[52] Additionally, the appellant submits that the final additional search conducted by the university did not include a search of additional emails, despite the provisions of Interim Order PO-4114-I and my invitation to the university to reply to the appellant’s original response. The appellant says that it is perplexing that the university conducted a further search of records for the portion of the appellant's request “that was never an issue at any stage of the appeal but refused to conduct a further search of emails which is the only outstanding issue of the appeal and where the concerns regarding missing emails have yet to be addressed.”

[53] Furthermore, the appellant argues that it is particularly improper that the university refused to comply with PO-4114-I and instead came to a unilateral conclusion that "an exhaustive search for responsive emails had already been conducted". The appellant submits that it is concerning that the university “continues to obfuscate and conflate the search for records for personal information (that have been provided and are no longer a part of this appeal), and the search for emails that are the only remaining issue in this appeal.”

Findings and analysis

[54] For the reasons that follow, I find that the university has established that it has conducted a reasonable search for responsive records and I decline to order any further searches.

[55] As set out above, the Act  does not require the institution to prove with absolute certainty that further records do not exist. However, the institution must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. [8]

[56] In Interim Order PO-4114-I, I concluded that the university had not provided sufficient evidence to enable me to find that it had discharged its responsibility under the Act  to conduct a reasonable search for records that were responsive to the appellant’s request. In paragraphs 46 to 51 of that interim order, I explained that the university had not provided any direct evidence about how its searches for records were conducted, or what specific actions were taken, and that as a result, I could not evaluate concerns raised by the appellant that additional emails should exist. Specifically, I explained that it was not clear to me whether all of the appropriate email accounts had been searched, what specific search terms the university used, and consequently, whether additional responsive records might exist.

[57] Based on the additional information provided by the university about the search for responsive records it conducted on October 7, 2019, I am now satisfied that it has discharged its burden under the Act . Specifically, I note that the Second Research Coordinator’s affidavit specifies that the October 7, 2019 email search included the emails of all of the relevant employees that may have had communications with the Other University during the relevant period of time. I accept the additional evidence provided by the Second Research Assistant about the search terms used to identify any responsive emails and am satisfied that by searching for the Other University, or the name of the city the Other University is located in, it is reasonable to expect that all potentially relevant emails would have been located, regardless of whether they mentioned the appellant by name.

[58] I also find that based on the description of steps taken and the screenshot of the “email client search function,” no email folders would have been missed that may have contained responsive emails.

[59] Finally, I accept the Second Research Coordinator’s attestation that the emails retrieved from the Data Centre’s employee email internal network drives on virtual servers and disclosed include all emails responsive to the appellant’s request.

[60] In making this decision, I have considered all of the issues raised by the appellant in all of her submissions about the credibility of the Second Research Coordinator’s evidence. However, I find that the explanation provided by the university in its sur-reply about the timing for the searches, and what specifically was being searched for on each occasion, is reasonable in the circumstances. [9]

[61] Specifically, I understand that the August 7^th and 8^th, 2019 email search and the September 17^th and 18^th, 2019 search (referred to as the “initial search” in the Assistant Director’s affidavit) were for records relating to the appellant’s original request for her “entire record” at the Data Centre and that the search for communications between the Data Centre and the Other University occurred later, on October 7, 2019.

[62] To be clear, I understand the university’s position to be that the August 7^th and 8^th email search was conducted in order to determine what the appellant’s “entire record” might comprise and I accept that this was the case. I do not disregard the appellant’s point that the university should not have needed to search its emails in response to her original request, given its data management policy. However, in my view, it appears likely that the university nonetheless did so and I find its explanation sufficient in the circumstances. In support of this finding, I note the university’s November 11, 2019 letter to the appellant in which it specified the following:

We acknowledge there was [a] misunderstanding on the part of [the Data Centre] regarding its obligations to you in replying to your initial request, which resulted in a delay in responding to your request for information. We also appreciate that the processes followed by [the Data Centre] were not technically compliant with [the university’s] process for handling FIPPA requests of this nature. [10]

[63] The university has previously acknowledged there were procedural issues in responding to the appellant’s request. It appears that there was some confusion on the part of the university about how to respond to the request and I accept that in attempting to respond to the request, it is not unreasonable to expect that the university searched through the emails it says it did on August 7^th and 8^th prior to responding to the appellant.

[64] As noted in Order PO-3561-F, the Act  does not demand perfection. [11] It requires an institution to provide sufficient evidence to establish that a reasonable search has been conducted. In my view, the issues raised by the appellant about the process the university followed do not negate the fact that it conducted a search for records responsive to the second part of the appellant’s request (for communications between the Data Centre and the Other University) on October 7, 2019, nor do they affect the credibility of the evidence provided by the Second Research Coordinator.

[65] As noted above, I accept that, based on all of the evidence before me, the university conducted a search for communications exchanged between all of the relevant employees in the Data Centre and the Other University on October 7, 2019. I accept that, based on the evidence provided by the university about the search terms it used, this search was sufficient to locate any emails that would be responsive to the appellant’s request. As a result, it is now clear to me that the appropriate email accounts were searched using the appropriate search terms and that as such, there is no further basis for me to conclude that additional responsive records may exist that have not yet been identified.

[66] I also find that evidence provided by the appellant in Appendix A supports the finding that the search for emails took place on October 7, 2019 based on the “created” and “modified” dates in the “Document Properties” screenshots she provided regarding the emails dated August 8, 2019. The screenshots support the university’s assertions, and the Second Research Coordinator’s attestations, that a search for email communications between the Data Centre and the Other University took place on this date.

[67] Finally, I also note the appellant’s submissions regarding the university’s commitment to complete a further search for emails during this inquiry process and her arguments that the search referred to in the Assistant Director and Research Coordinator’s affidavits of March 15, 2021 do not refer to searches for emails. However, given my findings that the search conducted on October 7, 2019 was sufficient to discharge the university’s burden under the Act  to locate records related to the appellant’s request, I find that no further searches for emails were necessary.

[68] In summary, I am satisfied that the searches described by the university in response to the interim order demonstrate that there is no reasonable basis for me to find that additional responsive records might exist. Accordingly, I uphold the university’s search for responsive records and dismiss the appeal.

ORDER:

I uphold the university’s search for responsive records and dismiss the appeal.

Original Signed by:		June 29, 2021
Meganne Cameron
Adjudicator