FINAL ORDER MO-4183-F

Appeal MA17-648

The Corporation of the City of Oshawa

March 31, 2022

Summary: This final order resolves the outstanding issue of the reasonableness of the city’s search for responsive records following Interim Order MO-4102-I. In compliance with the interim order, the city conducted a further search for responsive records relating to communications between city staff and council members regarding appraisals identified in a specified confidential report. Following its additional search, the city located records and disclosed them to the appellant. The adjudicator upholds the city’s search as reasonable and dismisses the appeal.

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. M.56 , as amended, section 17 .

Order considered: Interim Order MO-4102-I.

OVERVIEW:

[1] This final order disposes of the remaining issue resulting from an access request the appellant made to the City of Oshawa under the Municipal Freedom of Information and Protection of Privacy Act  (the Act ). The issue is the reasonableness of the city’s search for records responsive to the appellant’s request for access to the following information:

All communications 1) between staff, 2) between staff and Council members, 3) between staff, Council members and the Mayor’s office, from March 20, 2013 and the release of any information, email, report or other communication in response to the March 20, 2013 direction of Council to provide Council with a copy of all appraisals and assessed value for land identified in [a specified confidential report] including the final report.

[2] As background, in 2013 the city purchased three different pieces of property to amass the land required to build the city’s Consolidated Operations Depot (COD). At issue in this appeal are records related to this purchase and the appraisals and valuations of one of the properties.

[3] In response to the appellant’s access request, the city issued a decision.

[4] The appellant appealed the city’s decision to the Information and Privacy Commissioner of Ontario (the IPC). Following numerous revised city decisions and mediation at the IPC, the city disclosed a number of records to the appellant. [1] The remaining issues on appeal were the application of the labour relations and employment exclusion in section 52(3)  of the Act  and the mandatory personal privacy exemption in section 14(1) to the information and records at issue.

[5] After conducting an inquiry, I issued Interim Order MO-4102-I, in which I found the exclusion in section 52(3)  did not apply to the withheld records but found that some information was exempt under section 14(1). I ordered the information that was not personal information disclosed to the appellant. Lastly, I found that the city had not conducted a reasonable search for responsive records and ordered it to conduct a further search.

[6] In compliance with Interim Order MO-4102-I, the city conducted a further search and located four additional responsive records. The city issued a decision to the appellant granting access in full to these records.

[7] The city also provided me with representations and affidavits setting out its additional searches. The city’s representations including the affidavits were shared with the appellant. The appellant provided representations in response and the city was given a final opportunity to address the appellant’s representations.

[8] In this order, I uphold the city’s search as reasonable and dismiss the appeal.

DISCUSSION:

[9] The only remaining issue is whether the city’s search for records was reasonable. In order provision 3 of my interim order, I ordered the city to:

…conduct a further search in response to the appellant’s request, which ensures that the city’s archived records and server environment have been searched. This search should include a search for the missing attachments set out in paragraph 159 of this order.

[10] Paragraphs 158 and 159 of Interim Order MO-4102-I are also relevant to the additional searches that the city was required to conduct. These paragraphs state:

While I find that the city’s representations and affidavits provide details about its searches, I find that they do not address the following, which were raised in the appellant’s representations:

· whether the affiants only searched their own records (given that affiants state “I searched my hardcopy files, computer drives, and emails…”)

· whether the affiants also conducted a search for records for their department and/or for employees who were employed by the city in 2013 and involved in the 2013 land acquisition;

· when the searches were conducted; and

· whether the city’s IT group conducted a search of the city’s server environment.

In addition, my review of the records themselves reveals that some records are incomplete. For example, Record 10 indicates that there are three documents attached to the email, including the draft appraisal report, the final appraisal report and an email between an appraiser and a city employee. However, the city only provided this office with the second page of the two-page email attachment and a copy of the draft appraisal report. Therefore, it appears that there are pages missing in Record 10. There also appears to be missing pages in Record 8, which references two attachments, despite the record provided to the IPC having no attachments.

City’s representations

[11] The city submits that in compliance with Interim Order MO-4102-I the following city staff conducted the additional searches for records in their respective areas:

• Executive Administrative Assistant for the Office of the Mayor
• Manager of Policy in Planning Services
• Executive Administrative Assistant for the Office of the Chief Administrative Officer
• Supervisor of Records and Information Management
• Legal Assistant
• Manager of Cybersecurity & Infrastructure Operations
• Commissioner of Finance Services
• Director of Economic Development Services

[12] The city provided affidavits from these individuals. While I do not set out the details of each of the affidavits provided, I note that the affiants affirm to having searched:

• The Mayor’s office including hard copy folders and electronic files
• The inbox and mailbox folders for the Manager, Policy in Planning Services
• Planning service file cabinets and shared drive
• Inbox and mailbox folders for Executive Administrative Assistant for the Office of the Chief Administrative Officer
• City Clerk Services shared drive folders including search for records born electronic and records scanned from hard copies that were saved electronically to city servers
• Legal Services inbox and mailbox folders as well as related paper and electronic files

[13] The city notes that the above staff are the subject-matter experts in the records and search methodologies and also these individuals have access to the records of the original record holders in either electronic versions or hard copy. The city submits that for the purposes of conducting a reasonable search, these staff members are to be considered experienced employees of the institution.

[14] The city submits that following the further search, 603 records were identified as potentially responsive to the appellant’s request. The city states:

City staff searched in various locations concurrently for responsive records, as ordered. These searches resulted in duplications of responsive records that have been previously released to the appellant, as well as several records that are responsive to the parameters of the request and have been included in the city’s revised notice of decision dated November 19, 2021.

It is important to note that the search for [specified address] conducted by the Manager of Cybersecurity & Infrastructure Operations resulted in the production of many records related to the Jess Hann Branch of the Oshawa Public Library located at [specified address], in addition to records related to the Consolidated Operations Depot…

[15] After receiving all the responses from staff who conducted searches, the city’s Information Access and Privacy Officer reviewed all of the provided records and identified those records that were either duplicates, not responsive (outside of the requested date range or relating to the library), or those records already disclosed to the appellant. The city issued a decision disclosing four additional records in full. The city notes that it also re-released record 8 to include the attachments referenced in the interim order. The city further notes that in regard to record 10 “...the original sender of Record 10 only attached a scanned version of page two of the email in question, page one was not included as an attachment to the original email that forms Record 10. Therefore, the inclusion of only page two in the attachment supports the entire context of Record 10.”

Appellant’s representations

[16] The appellant submits that he believes additional responsive records continue to exist and provided copies of records from the city’s proactive disclosure which he submits indicates the existence of additional appraisal reports and also possible additional records that would have gone through the city’s Legal services.

[17] The appellant submits that the city staff members who conducted the additional searches were not experienced employees. The appellant states:

…the city has not identified the right people to conduct the search, as can be seen by the affidavits of [the Executive Administrative Assistant for the Office of the Chief Administrative Officer] and [the Commissioner of Finance Services], who both attest that there are not sufficient people in their departments that would be knowledgeable in the subject matter at request.

Further, the wording of the affidavits provided by city staff state that they are knowledgeable only of the information within the affidavit, not that they are specifically knowledgeable of the requested information.

In many cases, the affidavits have been completed by current employees of the City of Oshawa who were not employed by the city or in positions of knowledge relating to the requested records from 2013.

[18] The appellant submits that, in most cases the affidavits list email boxes, unnamed hardcopy files and branch shared drives and because many employees from 2013 have since left, it would be reasonable for the city to have searched its archives, back up tapes or other back up storage media. The appellant notes that many of the employees from 2013 no longer work at the city and states:

Even the affidavit from the Manager of Cybersecurity & Infrastructure Operations does not provide sufficient evidence to suggest that any back up media was searched or that any email accounts terminated since 2013 were included in searches.

[19] The appellant submits that the city did not reach out to him to clarify his request and the guidance given by the city’s access officer “…therefore left much of the application of parameters to the individual staff members”. The appellant submits that the scope of his request should have included three addresses instead of one address for the appraisal report.

[20] The appellant also submits that the city did not address whether responsive records may have been destroyed and he reiterates that the search of archives, back ups or deleted email accounts was not addressed by the city.

[21] The appellant also submits that in an ongoing appeal with the IPC and the city, two interim orders have required the city to conduct further searches including backups. [2] The appellant also cites Final Order MO-3768-F where the adjudicator noted that the determination of whether a reasonable search requires a search of backup data is a contextual inquiry. The adjudicator went on to find that the city was required to search its backup data for responsive records. The appellant submits the facts in the present appeal are similar to those in the current appeal and a search of backup data is required before I find that the city has conducted a reasonable search.

City’s reply representations

[22] The city reiterates its position that the staff who conducted the additional searches in compliance with Interim Order MO-4102-I were experienced employees. The city acknowledges that many of the employees involved in the purchase of the property and the creation of the appraisal report are no longer employed by the city. However, the city states:

…the email accounts of departing staff members are reviewed by their supervisor prior to destruction. Subsequently, all records related to city business are saved in the associated file locations on the corporate servers in order to ensure that all business records are subject to the city’s Records Retention By-law. Therefore, the email accounts of the former employees were subject to destruction at the time of their departure from the city.

Additionally, it is an expectation of city employees that all records related to a specified branch, project or function be saved in the appropriate folder on the city’s servers so that the Records Retention By-law may be applied as required, and the records may be accessed as needed by other city employees as needed.

As the city does not permanently retain inactive accounts, the [Manager of Cybersecurity & Infrastructure Operations] conducted his search using the most thorough methodology available to retrieve responsive records falling within parameters of the request.

[23] Regarding the appellant’s submission that the city should have searched archives or backups, the city states:

The city submits that it is appropriate in the circumstances to consider the amount of time that elapsed between the time period for the requested records (2013) and the original request (2017). Considering this passage of time, the Manager searched as far back as records exist in an accessible format, using a broad range of key words, so as not to discount potentially responsive records from any accounts.

In terms of the city’s search for archived records, the city does not have a specified archive for digital records; all records are subject to the Records Retention By-law. Therefore, searching for records on the city’s servers would result in all responsive records that have not been subject to disposition in accordance with the Records Retention By-law.

Further, backups are not generally considered to be a record of their own accord; rather they are created as a recovery mechanism to ensure business continuity in the event of a disaster (ISO/TR 15489-2). As such backups were not included in the city’s Records Retention By-law at the time of the original request and, as such, were not intended to be retained in perpetuity.

Analysis and finding

[24] The Act does not require the city to prove with absolute certainty that further records do not exist. However, the city must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. [3] A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records which are reasonably related to the request. [4]

[25] As noted above, I ordered the city to provide me representations and evidence that the affiants conducted searches not only for their own emails and hardcopy files but also for emails and hardcopy records of their respective departments so that responsive records of former employees would be captured by the search. I further asked for evidence and representations regarding the city’s IT department search of the city’s server environment. I also asked the city to address the missing attachments of records 8 and 10.

[26] For the reasons set out below, I find the city has now established that it has conducted a reasonable search for responsive records.

[27] At the outset, I note that both the appellant and the city addressed other appeals and decisions of the IPC regarding the city’s search for records. While I take note of these other appeals and orders, my determination in this appeal rests, and must rest on the particular facts and circumstances in the present appeal.

[28] I note that the appellant alleges that the city did not clarify the scope of his request. The appellant submits that the city did not conduct a search for other addresses and limited their search to a single address. The appellant did not raise this issue before but, I understand the appellant to mean that he still believes additional responsive records exist and these records may be ones that would be identified if the other addresses were used as search terms. I note that the city’s original representations that were shared with the appellant refer to the search terms used for its search. [5] Given the breadth of the responsive records located by the city using the search terms it identified, I do not accept the appellant’s submission that the city’s search has not been reasonable.

[29] I find the staff who conducted the searches to be experienced employees who were knowledgeable in the subject matter of the request. The city acknowledges that many of the staff members who were with the city in 2013 are no longer employed by them. I accept that a reasonable search can still be conducted by different staff members so long as they are appropriately instructed as to the breadth and scope of the request and record holdings to be searched. Moreover, I accept the city’s representations that the staff members who conducted the searches had access to the records (both electronic and hard copy versions) of the original record holders, including archived material as described in the city’s representations. I do not accept the appellant’s position that the affidavits lack the necessary detail. I find the affidavits contain sufficient evidence to satisfy me as to the locations searched in the city’s record holdings for the purposes of the additional searches ordered in Interim Order MO-4102-I.

[30] I further find the city has now provided the necessary evidence of a reasonable search of its server environment. I find the affidavit of the Manager of Cybersecurity & Infrastructure Operations to provide sufficient detail to establish that he conducted a reasonable search of the city’s servers. As stated above, order provision 3 of Interim Order MO-4102-I required the city to conduct a further search in response to the appellant’s request which ensures that the city’s server environment has been searched. In the Manager of Cybersecurity’s affidavit, he states the following:

On September 28, 2021, I received a Supplemental FOI Branch Request Form requesting a search be conducted for the following [appellant’s request].

In response to this request, I ran four searches on the city’s Microsoft Exchange (e-mail) servers utilizing the built-in eDiscovery tool within the Microsoft Exchange Admin Centre. The search was not restricted to specific users in order to conduct a thorough search of all mailboxes. The search parameters included the date range of March 1 – June 30, 2013, as well as the following keywords: COD, 199 Wentworth, Consolidated Operations Depot, and CM-13-29. The final search was restricted to just emails within mailboxes to above time-out errors.

[31] I accept the city has now provided me with sufficient evidence to establish that it has conducted a reasonable search of its server environment. I do not require an affidavit from the city’s Manager of Cybersecurity setting out the city’s server infrastructure map as suggested by the appellant in order to make this finding. The appellant has not established that requiring more in-depth searches of the city’s server environment would result in additional responsive records being located.

[32] Finally, I accept the city’s explanation that it does not have a specific archive for digital records and that its records are covered by its retention policy. I find it reasonable that a search for records responsive to the appellant’s request would capture any records in the city’s current record holdings that would not have been destroyed as per the city’s retention policy. To be clear, while I ordered the city to provide evidence that it had searched its archive for responsive records, I now find that I accept the city’s explanation as to the fact that it does not have a specific archive for digital records and any records are a part of the city’s current record holdings, subject to its retention policy.

[33] The appellant asks that before I find the city has conducted a reasonable search, I must require the city to conduct a search of its backups. The city has explained that any back up records would have to be created from the recovery mechanism to “ensure business continuity in the event of a disaster.” I accept the city’s explanation of its back up system. The appellant has not provided evidence to establish that I should require the city to recover back-up records and to conduct a search of them. I accept that any responsive records would be found in the city’s current electronic and paper record holdings. Based on the records located as a result of the city’s searches for responsive records and its explanation of its back up system, I find the appellant has not established that I should require the city to search for records in its backups.

ORDER:

I find the city’s search for records to be reasonable and I dismiss the appeal.

Original Signed by:		March 31, 2022
Stephanie Haly
Adjudicator