ORDER PO-4288

Appeal PA20-00178

McMaster University

August 16, 2022

Summary: This order deals with an appeal of a decision issued to the appellant by McMaster University (the university) in which it claims that the access request is frivolous and vexatious and, in the alternative, claims the application of section 19(c) (solicitor-client privilege) to four records at issue. In this order, the adjudicator finds that the request is not frivolous or vexatious. The adjudicator also finds that the exemption in section 19(c) applies to two of the records and they are, therefore, exempt from disclosure. The adjudicator also upholds the university’s exercise of discretion under section 19(c). The university withdrew its reliance on section 19(c) with respect to the two remaining records and is ordered to disclose one of these records to the appellant, as no other exemptions were claimed with respect to it.

The university claims that the fourth record, which is an email, contains the personal information of an individual other than the appellant and that this personal information is exempt from disclosure under section 21(1) (personal privacy). The adjudicator finds that the name and personal email address of this individual qualifies as their personal information and is exempt from disclosure under section 21(1). The adjudicator orders the university to disclose the rest of the email to the appellant.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, sections 2(1)  (definition of “personal information”), 10(1)(b), 19(c), 21(1), 27.1, and 52(4); section 5.1 of Regulation 460.

Orders and Investigation Reports Considered: Orders MO-1168-I, MO-3919-I, PO-2151, and PO-3718-I, and PO-4035.

Cases Considered: Ontario (Liquor Control Board) v. Magnotta Winery Corporation, 2010 ONCA 681, 102 O.R. (3d) 545 (C.A.), affirming (2009) 97 O.R. (3d) 665 (Div. Ct.).

OVERVIEW:

[1] This order disposes of the issues raised as a result of an access request made to McMaster University (the university) under the Freedom of Information and Protection of Privacy Act  (the Act ) for all records and reports relating to an incident that took place at the university’s athletic centre, involving the requester.

[2] The university located records responsive to the access request and issued a decision to the requester, denying access under section 10(1) (b) of the Act , the section that permits a head to refuse access because the request is frivolous or vexatious. The university’s decision letter stated that the head was of the opinion that the request was frivolous and vexatious because it was made in bad faith and for a purpose other than to obtain access to records.

[3] The decision letter also stated that, in the alternative, the discretionary exemption in section 19(c) (solicitor-client privilege) of the Act  applied to the records because they were prepared by or for counsel employed or retained by an educational institution for use in giving legal advice and in contemplation of or for use in litigation.

[4] The requester, now the appellant, appealed the university’s decision to the Information and Privacy Commissioner of Ontario (the IPC).

[5] During the mediation of the appeal, the university confirmed its position that the request was frivolous or vexatious. In addition, it confirmed its position that, in the alternative, the requested records would be denied in full under section 19 (c) of the Act . The matter was not resolved in mediation and the appellant indicated that he would like the file to proceed to adjudication.

[6] The appeal then moved to the adjudication stage of the appeals process, where an adjudicator may conduct an inquiry. I decided to commence an inquiry and sought representations from the university and the appellant. Both provided representations to the IPC.

[7] The university did not provide the IPC with three of the four records at issue. As I will explain in Issue B, I was able to make my findings in relation to these three records on the basis of the information before me.

[8] In its representations, the university withdrew its reliance on section 19 (c) with respect to two of the four records, claiming that the appellant already has these records. The first of these records is an expert evidence report prepared for the university in relation to civil litigation proceedings between it and the appellant (the appellant litigation report).

[9] The second record is an email relating to the incident that took place at the university’s athletic centre. During the inquiry and for the first time, the university claimed that the name and email address of the author of the email is that individual’s personal information and is exempt from disclosure under section 21(1) (personal privacy). Because section 21(1) is a mandatory exemption and because the university had withdrawn its section 19 (c) claim, I requested the university to provide me with a copy of the record, which it did. I will discuss my findings regarding the appellant expert report and the email in Issues B and C, respectively, below.

[10] For the reasons that follow, I find that the access request is not frivolous or vexatious. I also find that the exemption in section 19 (c), which the university claimed in the alternative, applies to two of the records and they are, therefore, exempt from disclosure and I uphold the university’s exercise of discretion under section 19 (c).

[11] As stated above, the university withdrew its reliance on section 19 (c) with respect to the two remaining records. Having concluded that the request is not frivolous and vexatious, I therefore order the university to fully disclose one and partially disclose the other. In particular, I order the university to disclose the appellant litigation report to the appellant in its entirety, as no other exemptions were claimed with respect to it and no mandatory exemptions apply. Concerning the email, I find that the name and personal email address its author qualifies as their personal information is exempt from disclosure under section 21(1). I order the university to disclose the rest of the email to the appellant.

RECORDS:

[12] There are four records at issue:

• An expert evidence report prepared for the university in relation to civil litigation proceedings between it and the appellant, (the appellant litigation report) [1] ,
• An expert evidence report prepared for the university in relation to civil litigation between it and a third party (the initial third party report),
• A supplemental report to the initial third party report (the supplemental third party report), and
• An email relating to an incident at the athletic centre involving the appellant (the email). [2]

BACKGROUND:

[13] The university provided background information about the records and the access request. The university and the appellant were engaged in a civil litigation matter stemming from an incident that took place at the university’s athletic centre, involving the appellant. The matter was dealt with in a lower court, but then appealed to the Court of Appeal. According to the university, both the lower court’s and the Court of Appeal’s decisions found in the university’s favour. The access request that is the subject matter of this appeal was made after the litigation matters were concluded.

[14] Also by way of background, the university refers to previous access requests the appellant made to it. In particular, the university submits that the appellant has made three access requests to it within an 18-month period, which includes the current access request.

[15] The first access request was made by the appellant’s then legal counsel for purposes of the litigation and was for incident reports over a lengthy time period. In response, the university issued a fee estimate and interim decision. The appellant appealed that decision to the IPC [3] and as part of a mediated settlement of that appeal, the appellant narrowed the scope of the request. The university then issued a final decision to the appellant, providing access to a number of incident reports relating to accidents and incidents at its athletic centre, with the personal information of the individuals involved severed from the records. The appellant subsequently appealed the final access decision to the IPC and a new appeal file was opened. [4]

[16] The second access request (also made by the appellant’s then legal counsel) was not appealed to the IPC. The university does not state what the request was for, but notes that access was granted to the records related to this request.

[17] The third access request, which is the subject matter of this appeal, was made after the conclusion of the civil litigation. According to the university, it has become aware that the appellant is the publisher of a website, and on this website, it appears that the appellant already has two of the records at issue, namely the email and the appellant litigation report. The university refers to the appellant’s website as “fraught with inaccuracies, misrepresentations and frivolous allegations” regarding the university and other parties.

ISSUES:

1. Is the request for access frivolous or vexatious?
2. Does the discretionary exemption at section 19 (c) apply to the initial and supplemental third party reports?
3. Does the withheld information in the email contain personal information? If so, does the mandatory exemption in section 21(1) apply to it?
4. Did the university exercise its discretion under section 19 (c)? If so, should the IPC uphold the exercise of discretion?

DISCUSSION:

Issue A: Is the request for access frivolous or vexatious?

[18] The university’s position is that, while the previous two access requests made by the appellant’s then legal counsel were made in good faith and for a proper purpose, there are reasonable grounds to conclude that the appellant’s current access request is frivolous and vexatious under section 10(1)(b) and section 5.1 of Regulation 460 of the Act .

[19] Section 10(1) (b) of the Act  reads, in part:

Every person has a right of access to a record or a part of a record in the custody or under the control of an institution unless,

the head is of the opinion on reasonable grounds that the request for access is frivolous or vexatious.

[20] Section 5.1 of Regulation 823 under the Act  elaborates on the meaning of the terms “frivolous” and “vexatious”:

A head of an institution that receives a request for access to a record or personal information shall conclude that the request is frivolous or vexatious if,

(a) the head is of the opinion on reasonable grounds that the request is part of a pattern of conduct that amounts to an abuse of the right of access or would interfere with the operations of the institution; or

(b) the head is of the opinion on reasonable grounds that the request is made in bad faith or for a purpose other than to obtain access.

[21] Section 10(1) (b) provides institutions with a summary mechanism to deal with frivolous or vexatious requests. This discretionary power can have serious implications on the ability of a requester to obtain information under the Act , and therefore it should not be exercised lightly. [5]

[22] An institution has the burden of proof to substantiate its decision to declare a request to be frivolous or vexatious. [6]

Section 5.1(a) – Pattern of conduct

Pattern of conduct that amounts to an abuse of the right of access

[23] The university submits that the appellant has exhibited part of a pattern of conduct that amounts to an abuse of the right of access. The following factors may be relevant in determining whether a pattern of conduct amounts to an “abuse of the right of access”:

• the number of requests,
• the nature and scope of the requests,
• the purpose of the requests, or
• the timing of the requests.

[24] The institution’s conduct also may be a relevant consideration weighing against a “frivolous or vexatious” finding. However, misconduct on the part of the institution does not necessarily negate a “frivolous or vexatious” finding. [7] Other factors, particular to the case under consideration, can also be relevant in deciding whether a pattern of conduct amounts to an abuse of the right of access. [8]

[25] The focus should be on the cumulative nature and effect of a requester’s behaviour. In many cases, ascertaining a requester’s purpose requires the drawing of inferences from his or her behaviour because a requester seldom admits to a purpose other than access. [9]

Pattern of conduct that would interfere with the operations of the institution

[26] The university also submits that the appellant has exhibited part of a pattern of conduct that would interfere with its operations. A pattern of conduct that would “interfere with the operations of an institution” is one that would obstruct or hinder the range of effectiveness of the institution’s activities. [10]

[27] Interference is a relative concept that must be judged on the basis of the circumstances a particular institution faces. For example, it may take less of a pattern of conduct to interfere with the operations of a small municipality than with the operations of a large provincial government ministry, and the evidentiary onus on the institution would vary accordingly. [11]

Representations on both types of patterns of conduct

[28] The university argues that the IPC should consider a number of factors in determining whether a requester is exhibiting a pattern of conduct that amounts to an abuse of the right of access or that would interfere with the operations of the institution, including the following:

• Purpose – the IPC should consider the purpose of the request including whether thy are intended to accomplish an object other than simply gaining access to the records. [12] The IPC will also investigate whether the purpose of the request is for the purpose of harassing the institution, burdening its system, or for nuisance value, [13] and
• Timing – the IPC should consider the timing of a request, including whether it is connected to the occurrence of some other related event, such as a court proceeding. [14]

[29] The university submits that with respect to the appellant’s conduct, almost concurrently with the commencement of this appeal process, the appellant reinstituted appeal proceedings in relation to the first access request over a year after receiving the records, and the university was surprised to receive a notice of that appeal and a request for records after that length of time had passed. It is the university’s position that because the only information that was not disclosed to the appellant (as a result of the first access request) was the personal information of other individuals, it appears that the appellant is pursuing access to information that has no “reasonable relevance” to any of the appellant’s rights or interests.

[30] The university goes on to state:

McMaster reasonably concluded that the recommencement [of the appeal of the first access request] was not part of a desire to gain access to the redacted portions of the records of issue in that appeal (namely, personal information of third parties identified in McMaster incident reports). Rather, together with the submission of the Request [the current request] and initiation of the Appeal [of the first request], it formed part of an overall pattern of conduct that amounts to an abuse of the right of access and is intended to interfere with the operations of McMaster.

[31] The appellant submits that he made only three access requests to the university, namely two requests in 2018 and one in 2020 and, consequently, the total number of requests is not excessive. He also argues that all three requests were made or appealed within the time frames and procedures set out in the Act .

[32] The appellant further submits that the university’s position that he has engaged in a pattern of conduct that amounts to an abuse of process and is intended to interfere with the university’s operations is not supported by any evidence.

Analysis and findings

[33] As previously stated, the appellant has made three access requests to the university over an 18-month period. The first access request was for incident reports, the second request was for records unknown to me and the third request is the subject matter of this appeal, involving litigation records and an email.

[34] A “pattern of conduct” requires recurring incidents of related or similar requests by a requester under the Act  [15] and in this matter, no such evidence has been provided to suggest such a pattern. For example, in Order PO-4035, Adjudicator Jaime Cardy stated:

Section 5.1(a) of Regulation 460 provides that a request is frivolous or vexatious if it is part of a “pattern of conduct that amounts to an abuse of the right of access or would interfere with the operations of the institution.” Previous orders have explored the meaning of the phrase “pattern of conduct.” In Order M-850, for example, former Assistant Commissioner

Tom Mitchinson stated:

[I]n my view, a “pattern of conduct” requires recurring incidents of related or similar requests on the part of the requester (or with which the requester is connected in some material way).

[35] As is made clear in the above, it is not enough for there to be a pattern of conduct. For the purposes of section 5.1(a), the pattern must either amount to an abuse of the right of access, or interfere with the operations of the institution. To determine whether an appellant’s request forms part of a pattern of conduct that amounts to an abuse of the right of access, a number of factors can be considered, such as the cumulative effect of the number, nature, scope, purpose, and timing of the request. [16]

[36] In my view, the appellant’s current access request, taken into consideration with his previous two requests as detailed above, even if they form a “pattern of conduct”, [17] do not constitute a pattern of conduct that amounts to an “abuse of the right of access.” I find that the number of requests is not excessive, and that the nature and scope of the request at issue in this appeal is not unreasonable. The university’s position is that the appellant’s current access request, in tandem with the IPC appeal of the first access request, is tantamount to a pattern of conduct that amounts to an abuse of the right of access and intended to interfere with its operations. I disagree. Despite the number of access requests that the appellant has made to the university, I find that the university has not met the burden of proof that the appellant’s three requests over an 18-month period is an excessive number by reasonable standards.

[37] Regarding the timing and purpose of the access requests, I am not satisfied that the timing of this request is suspect. I am not satisfied that the fact that the access request took place during a time when there was another appeal between the parties at the IPC demonstrates an abuse of the right of access. The test is whether the access request(s) are part of a pattern of conduct that would either amount to an abuse of the right of access or are intended to interfere with the university’s operations. The test is not whether the appellant has other appeals at the IPC.

[38] I also find that the university has not demonstrated that the appellant’s access request is part of a pattern of conduct that would “interfere with the operations of an institution.”

[39] In Order PO-2151 former Adjudicator Laurel Cropley canvassed what may constitute an unreasonable interference with the operations of an institution. [18] She noted from past orders that it appeared that in order to establish “interference” an institution must, at a minimum, provide evidence that responding to a request would “obstruct or hinder the range of effectiveness of the institution’s activities. [19] ”

[40] In my view, the appellant’s access request is not one that would obstruct or hinder the range of effectiveness of the university’s activities. In response to the current access request, the university was able to locate records responsive to the request and was able to issue an access decision to the appellant in a fairly timely fashion without any interference to its operations. The university claims that the request was intended to interfere with its operations but has not provided me with any evidence to establish that responding to the current access request obstructed or hindered the range of effectiveness of its activities.

[41] In sum, I find that the university has not shown that the appellant’s access request is part of a pattern of conduct that amounts to an abuse of the right of access or would interfere with its operations within the meaning of section 5.1(a) of the Regulation.

Section 5.1(b) – Bad faith or purpose other than to obtain access

Bad faith

[42] The university is claiming that the current access request was made in bad faith. Where a request is made in bad faith, the institution need not demonstrate a “pattern of conduct”. [20]

[43] “Bad faith” has been defined as:

The opposite of “good faith”, generally implying or involving actual or constructive fraud, or a design to mislead or deceive another, or a neglect or refusal to fulfil some duty or other contractual obligation, not prompted by an honest mistake as to one’s rights, but by some interested or sinister motive. ... “bad faith” is not simply bad judgement or negligence, but rather it implies the conscious doing of a wrong because of dishonest purpose or moral obliquity; it is different from the negative idea of negligence in that it contemplates a state of mind affirmatively operating with furtive design or ill will. [21]

Purpose other than to obtain access

[44] The university is not claiming that the appellant’s access request was made for a purpose other than to obtain access, but it submits that an examination of this portion of section 5.1(b) of the Regulation is relevant as to whether the request was made in bad faith.

[45] A request is made for a purpose other than to obtain access if the requester is motivated not by a desire to obtain access, but by some other objective. [22] Previous orders have found that an intention by the requester to take issue with a decision made by an institution, or to take action against an institution, is not sufficient to support a finding that the request is “frivolous or vexatious”. [23]

[46] In order to qualify as a “purpose other than to obtain access”, the requester would need to have an improper objective above and beyond a collateral intention to use the information in some legitimate manner. [24]

[47] Where a request is made for a purpose other than to obtain access, the institution need not demonstrate a “pattern of conduct”. [25]

Representations on bad faith and a purpose other than to obtain access

[48] The university acknowledges the IPC’s interpretation of bad faith in the context of whether an access request is frivolous or vexatious. It also acknowledges that prior IPC orders have found that generating online content using information obtained under the Act , whether inflammatory and untrue or not, does not constitute an illegitimate purpose under the Act . The university goes on to submit that the IPC has held that the fact that an appellant may use information gleaned from an access request in a manner that opposes or is detrimental to an institution does not mean that the reasons for using the access scheme are for a “purpose other than to obtain access.”

[49] However, the university then argues that it disagrees with the conclusions reached in these IPC prior orders because they have failed to recognize the use of the disjunctive in section 5.1(b) of the Regulation. That is, the university submits, these orders have focused on whether a requester was motivated by a “purpose other than to obtain access,” and absent such other purpose, generally disregarded indicia of bad faith. Based on a plain reading of the provision, the university argues that an institution should not have to establish the existence of a “purpose other than to obtain access” in order to establish bad faith and, in turn, rely upon this section as grounds justifying a finding of frivolous and vexatious. The unambiguous language in section 5.1(b), the university argues, clearly contemplates the possibility that bad faith may exist regardless of whether the purpose of a request is to obtain access. If this were not the case, the legislature would not have used the word “or” in section 5.1(b).

[50] The university states:

As such, whether a request is submitted in “bad faith” should not rest upon or be tied to a requester’s purpose, as purpose is a separate and independent factor to consider. If the purpose of the request is, in the reasonable opinion of the institution, to obtain records to be utilized as part of a continued campaign of disinformation, concluding that it is permissible simply because the request is for “the purpose of obtaining records,” wholly disregards the dishonest purpose, moral obliquity and ill will on the part of the requester.

[51] Applying these principles to the matter at hand, the university submits that the appellant already has two of the four records that are the subject matter of the request, suggesting that the purpose in continuing to pursue the request is something other than a desire to obtain copies of the records. In addition, the university’s position is that seeking records or information to which one already has access to is a clear indicium of bad faith, and one where such a denial is reasonably justified.

[52] The university further argues that despite the fact that the request is made for the purpose of obtaining access to the records, it is nonetheless a request submitted in bad faith. Based on the appellant’s website, the university argues, the IPC should be able to ascribe ill will on the part of the appellant, as well as dishonest purposes and moral obliquity.

[53] The appellant submits that the university has not provided any proof that his access request was made in bad faith or for a purpose other than accessing the records at issue, and that his access request was, in fact, made for the purpose of obtaining access to the records at issue. The appellant further submits that the university has not proven that he is the owner of a website and that it has engaged in unsupported speculation about some information found on the Internet. The appellant does not indicate whether he has any of the records in his possession.

Analysis and findings

[54] While the university is not claiming that the access request was made for a purpose other than to obtain access, it is claiming that the appellant’s access request was made in bad faith, and that section 5.1(b) of the regulation clearly contemplates the possibility that bad faith may exist regardless of whether the purpose of a request is to obtain access. I agree, in principle, that bad faith may be established under the Act  even if the purpose of the request is to obtain access. [26]

[55] However, the university is still required to demonstrate that the access request was made in bad faith. The university’s position is essentially that the appellant made the current access request in bad faith because he is seeking records or information to which he already has access, and because of the information allegedly posted on the appellant’s website.

[56] In Interim Order MO-1168-I, former Adjudicator Cropley, in discussing whether an access request was made in bad faith made the following findings:

. . . I have considered the Board’s representations. I will begin by saying that I am not persuaded that the Board has demonstrated that the appellant’s request was made in “bad faith”. The Act provides a legislated scheme for the public to seek access to government held information. In doing so, the Act  establishes the procedures by which a party may submit a request for access and the manner in which a party may seek review of a decision of the head. It is the responsibility of the head and then the Commissioner’s office to apply the provisions of the Act  in responding to issues relating to an access request. In my view, the fact that there is some history between the Board and the appellant, or that records may, after examination, be found to fall outside the ambit of the Act , or that the appellant may have obtained access to some confidential information outside of the access process, in and of itself is an insufficient basis for a finding that the appellant’s request was made in bad faith. The question to ask is whether the appellant had some illegitimate objective in seeking access under the Act  . . .

[emphasis added]

[57] Adjudicator Cropley also found that there is nothing in the Act  which delineates what a requester can and cannot do with information that has been granted to them, and the fact that the appellant in that appeal may have decided to use the information obtained in a manner which was disadvantageous to the institution did not mean that the appellant’s reasons for using the access scheme were not legitimate.

[58] I agree with this approach, and applying it to the circumstances of this appeal, I am not satisfied that the request resulting in this appeal was made in bad faith. I find that the request made by the appellant was made for a legitimate purpose. I cannot agree that the appellant’s reasons for seeking access to the information he requests or the uses to which he puts any information he may receive, whether it be on an alleged website or not, are either illegitimate or dishonest. I also find that the fact that the appellant may be in possession of two of the four records at issue does not lead to the conclusion that his access request for the same records was made in bad faith.

[59] I further find that the request was not designed to mislead or deceive, nor did it result from a refusal to “fulfil some duty or other contractual obligation.” I note that previous decisions have confirmed that “bad faith” is not simply bad judgement or negligence, but rather implies the conscious doing of a wrong because of dishonest purpose or moral obliquity.

[60] There is insufficient evidence before me to suggest that, with respect to the access requests before me, the appellant is acting with some dishonest or illegitimate purpose or goal. I am satisfied that the appellant legitimately seeks access to the information that he has requested, and I am unable to ascribe “furtive design or ill will” on his part. As a result, I find that the university has failed to establish that the requests were made by the appellant in bad faith. Therefore, I find that the university cannot rely on this part of section 5.1(b) of the Regulation to declare that the access request is frivolous or vexatious.

[61] In conclusion, I do not uphold the university’s application of the frivolous/vexatious provisions in section 10(1) (b) to the access request. I now turn to the university’s alternative bases for denying access.

Issue B: Does the discretionary exemption at section 19(c) apply to the initial and supplemental third party reports?

[62] Having found that the appellant’s access request is not frivolous or vexatious, I will now consider the university’s alternative argument which is that two of the four records are exempt from disclosure under the statutory litigation privilege exemption in section 19 (c). The two records for which the university is making the section 19 (c) claim are the initial third party report and the supplemental third party report.

[63] Section 19 (c) of the Act , it states:

A head may refuse to disclose a record,

that was prepared by or for counsel employed or retained by an educational institution or a hospital for use in giving legal advice or in contemplation of or for use in litigation.

[64] Section 19  contains two branches. Branch 1 (“subject to solicitor-client privilege”) is based on the common law. Branch 2 (prepared by or for Crown counsel or counsel employed or retained by an educational institution or hospital) is a statutory privilege. The institution must establish that one or the other (or both) branches apply. In this appeal, the university relies only on Section 19 (c), which is Branch 2.

[65] Branch 2 is a statutory privilege that applies where the records were prepared by or for Crown counsel or counsel employed or retained by an educational institution or hospital “for use in giving legal advice or in contemplation of or for use in litigation.” The statutory exemption and common law privileges, although not identical, exist for similar reasons.

[66] Statutory litigation privilege applies to records prepared by or for Crown counsel or counsel employed or retained by an educational institution or hospital “in contemplation of or for use in litigation.” It does not apply to records created outside of the “zone of privacy” intended to be protected by the litigation privilege, such as communications between opposing counsel. [27]

[67] In contrast to the common law privilege covered by Branch 1, termination of litigation does not end the statutory litigation privilege in section 19 . [28]

Representations

[68] The university submits that the initial third party report and the supplemental third party report are expert evidence reports that were clearly and unequivocally prepared for use in litigation and whose sole purpose was to be used by the university’s legal counsel to conduct or aid in the conduct of litigation with a third party and, as such, are exempt under section 19 (c). The university further submits that the statutory privilege does not end with the conclusion of litigation and that it has not elected to waive its privilege.

[69] The university further submits that it considered whether there is any withheld information in the third party records that should be disclosed under section 10(2), but that it determined that these records are subject to the statutory solicitor-client privilege in their entirety.

[70] The appellant disagrees with the university’s position that the records are subject to statutory litigation privilege and submits that the records are instead subject only to common law litigation privilege under branch 1 of section 19 , which comes to an end at the conclusion of litigation.

Analysis and findings

[71] As previously stated, the university did not provide copies of these records to the IPC. However, based on the university’s representations and the circumstances, I find that the third party reports are exempt from disclosure under section 19 (c), subject to my findings regarding the university’s exercise of discretion.

[72] Regarding the fact that the university did not provide the IPC with a copy of the two third party reports, I find Interim Order MO-3919-I instructive, in which Adjudicator Valerie Jepson found that where an adjudicator is unable to review the records on the basis of a claim of solicitor-client privilege, a preliminary issue arises which is whether the institution has provided sufficient information to enable the adjudicator to decide whether the records are exempt under the solicitor-client privilege exemption.

[73] Based on my review of the university’s representations, I am satisfied with its explanation that the third party expert reports were prepared by or for counsel for the university for use in litigation; their sole purpose was to be used by the university’s legal counsel to conduct or aid in the conduct of litigation with a third party (not the appellant).

[74] I also find that this is not a case where the exemption does not apply to records created outside of the “zone of privacy” intended to be protected by the litigation privilege, such as communications between opposing counsel. [29] The records were clearly created to assist with the litigation process, not merely prepared “during the course of” litigation. [30]

[75] Applying the above principles, and subject to my findings regarding the university’s exercise of discretion, I find that the third party expert reports fall within the “zone of privacy” as contemplated in the statutory litigation privilege in section 19 (c).

[76] Lastly, with regard to the appellant’s argument that the third party reports are subject only to the common law litigation privilege in Branch 1 of section 19 , meaning that that privilege ends when litigation concludes, it is only necessary for the university to establish either Branch 1 or 2, not both. Having found that the third party reports are exempt under the statutory (Branch 2) litigation privilege in section 19 (c), the litigation privilege continues after the conclusion of litigation and I do not need to decide if they are also exempt under Branch 1.

[77] The other two records in this appeal are the appellant litigation report and the email. The university has withdrawn its reliance on section 19 (c) with respect to these two records. As the university has not claimed any other exemptions for the appellant litigation report, and no mandatory exemptions apply, I will order it to disclose this record to the appellant in its entirety.

[78] Concerning the email, the university’s position is that the name and email address of the author of the email constitutes that individual’s personal information and this information is exempt from disclosure under section 21(1). I will consider this argument in Issue C, below.

Issue C: Does the withheld information in the email contain personal information? If so, does the mandatory exemption in section 21(1) apply to it?

[79] The university is claiming that the name and personal email address of the author of the email qualifies as the author’s personal information and is exempt from disclosure under section 21(1). No other exemptions have been claimed with respect to the email.

[80] In order to decide which sections of the Act  may apply to a specific case, the IPC must first decide whether the record contains “personal information,” and if so, to whom the personal information relates.

[81] Section 2(1)  of the Act  defines “personal information” as “recorded information about an identifiable individual.” “Recorded information” is information recorded in any format, such as paper records, electronic records, digital photographs, videos, or maps. [31]

[82] Information is “about” the individual when it refers to them in their personal capacity, which means that it reveals something of a personal nature about the individual. Generally, information about an individual in their professional, official or business capacity is not considered to be “about” the individual. [32] See also sections 2(2.1) and (2.2), which state:

(2.1) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

(2.2) For greater certainty, subsection (2.1) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling.

[83] In some situations, even if information relates to an individual in a professional, official or business capacity, it may still be “personal information” if it reveals something of a personal nature about the individual. [33]

[84] Information is about an “identifiable individual” if it is reasonable to expect that an individual can be identified from the information either by itself or if combined with other information. [34]

[85] Section 2(1)  of the Act  gives a list of examples of personal information:

“personal information” means recorded information about an identifiable individual, including,

. . .

(d) the address, telephone number, fingerprints or blood type of the individual,

[86] The list of examples of personal information under section 2(1)  is not a complete list. This means that other kinds of information could also be “personal information.” [35]

[87] One of the purposes of the Act  is to protect the privacy of individuals with respect to personal information about themselves held by institutions. Section 21(1)  of the Act  creates a general rule that an institution cannot disclose personal information about another individual to a requester. This general rule is subject to a number of exceptions. I will discuss section 21(1)  further below.

Representations

[88] The university submits that the name and personal email address of the sender of the email should be withheld, because this information constitutes the personal information of that individual and is subject to the personal privacy exemption in section 21(1)  of the Act . The university acknowledges that it did not rely on section 21(1)  in its decision letter. However, as section 21(1)  is a mandatory exemption, I will consider it.

[89] The appellant submits that the email was authored by a university employee in their professional capacity, and therefore, the name and email address of the employee do not qualify as that individual’s personal information.

Analysis and findings

[90] The university’s position is that the name and email address of the author of the email qualifies as that individual’s personal information. The appellant’s position is that the name and email address do not qualify as personal information because the author of the email is a university employee who was acting in a professional capacity.

[91] I have reviewed the email and I find that the only personal information contained in it is the name and the email address of the individual who authored the email, which falls within paragraph (d) of the definition of “personal information” in section 2(1)  of the Act . It is clear from my review of the email that the name combined with the email address of this individual appear in a personal capacity.

[92] As noted, section 21(1)  of the Act  creates a general rule that an institution cannot disclose personal information about another individual to a requester. The section 21(1)(a) to (e) exceptions are relatively straightforward. If any of the five exceptions covered in sections 21(1) (a) to (e) exist, the institution must disclose the information. I find that none of the exceptions in section 21(1) (a) to (e) apply to the personal information at issue.

[93] The section 21(1) (f) exception is more complicated. It requires the institution to disclose another individual’s personal information to a requester only if this would not be an “unjustified invasion of personal privacy.” Other parts of section 21 must be looked at to decide whether disclosure of the other individual’s personal information would be an unjustified invasion of personal privacy.

[94] Sections 21(2), (3) and (4) help in deciding whether disclosure would or would not be an unjustified invasion of personal privacy.

[95] Sections 21(3)(a) to (h) should generally be considered first. [36] These sections outline several situations in which disclosing personal information is presumed to be an unjustified invasion of personal privacy.

[96] Upon my review of the record, I find that none of the presumptions in section 21(3) apply to the name and personal email address of the author of the email. I have also concluded based on my review that none of the situations in section 21(4) is present.

[97] Because I have found that the personal information being requested does not fit within any presumptions under section 21(3) or is addressed in section 21(4), I must next consider the factors set out in section 21(2) to determine whether or not disclosure would be an unjustified invasion of personal privacy.

[98] Section 21(2) lists several factors that may be relevant to determining whether disclosure of personal information would be an unjustified invasion of personal privacy. [37] Some of the factors weigh in favour of disclosure, while others weigh against disclosure. If no factors favouring disclosure are present, the section 21(1) exemption — the general rule that personal information should not be disclosed — applies because the exception in section 21(1) (f) has not been proven. [38]

[99] I have no evidence before me from either party regarding any of the factors in section 21(2). Having reviewed the email, I find that none of the factors either weighing in favour of or against disclosure apply to the name and personal email address of the author of the email.

[100] In sum, none of the exceptions in section 21(1) , the presumptions in section 21(3), the factors in section 21(2) or the circumstances in section 21(4) apply to the personal information at issue. Given that there are no factors weighing in favour of disclosure, I find that the name and personal email address of the author of the email is exempt from disclosure under this exemption. The university did not claim the exemption in section 21(1)  or any other exemptions to the rest of the email, and I find that no mandatory exemptions apply. As a result, I will order the university to disclose the email to the appellant, withholding only the name and personal email address of the author.

Issue D: Did the university exercise its discretion under section 19(c)? If so, should the IPC uphold the exercise of discretion?

[101] The section 19 exemption is discretionary, and permits an institution to disclose information, despite the fact that it could withhold it. An institution must exercise its discretion. On appeal, the IPC may determine whether the institution failed to do so.

[102] In addition, the IPC may find that the institution erred in exercising its discretion where, for example,

• it does so in bad faith or for an improper purpose,
• it takes into account irrelevant considerations, or
• it fails to take into account relevant considerations.

[103] In either case, the IPC may send the matter back to the institution for an exercise of discretion based on proper considerations. [39] The IPC may not, however, substitute its own discretion for that of the institution. [40]

[104] Relevant considerations may include those listed below. However, not all those listed will necessarily be relevant, and additional unlisted considerations may be relevant: [41]

• the purposes of the Act , including the principles that information should be available to the public, individuals should have a right of access to their own personal information, exemptions from the right of access should be limited and specific and the privacy of individuals should be protected,
• the wording of the exemption and the interests it seeks to protect,
• whether the requester is seeking his or her own personal information,
• whether the requester has a sympathetic or compelling need to receive the information,
• whether the requester is an individual or an organization,
• the relationship between the requester and any affected persons,
• whether disclosure will increase public confidence in the operation of the institution,
• the nature of the information and the extent to which it is significant and/or sensitive to the institution, the requester or any affected person,
• the age of the information, and
• the historic practice of the institution with respect to similar information.

Representations

[105] The university submits that it properly exercised its discretion in claiming the application of the discretionary exemption in section 19 (c) to the third party expert reports. In particular, the university submits that it took into consideration the fact that these records do not contain the appellant’s personal information, and, in fact, contain the personal information of another individual whose personal privacy should be protected. The university further submits that the appellant has a demonstrated history of mischaracterizing information and spreading disinformation through his website. Providing access to the third party records, the university argues, would further the appellant’s campaign, which it reasonably believes is the sole motivation for seeking access to these records.

[106] The appellant submits that the university did not properly exercise its discretion by taking into account irrelevant considerations, namely by erroneously applying the statutory litigation privilege to the third party reports, and by not taking into account relevant considerations such as the following:

• information should be available to the public,
• the reports contain information closely related to the health or safety hazard to the public as contemplated in section 11(1)  of the Act ,
• information is related to the public confidence in the university’s operations, and
• individuals should have a right to their own personal information.

Analysis and findings

[107] I find that, in exercising its discretion, the university did take into account a possibly irrelevant consideration, which was its perception and characterization of the appellant’s behaviour on an alleged website. However, when I consider the records at issue and the underlying circumstances I am satisfied that overall the university properly exercised its discretion in withholding the third party reports under section 19 (c) of the Act . I find that the university did not exercise its discretion in bad faith or for an improper purpose, and that the university took into account a relevant consideration, namely the importance of the statutory solicitor-client privilege in section 19 (c), which I previously found to be properly applied by the university to the third party reports.

[108] With respect to the appellant’s arguments, I find that some of the factors he believes should have been taken into consideration by the university in exercising its discretion are not relevant in the circumstances of this appeal. For example, I find the following factors to be irrelevant:

• the third party reports do not contain the appellant’s personal information,
• there is not a sufficient nexus between how the disclosure of an expert report used for litigation with a specific individual would relate to the public’s confidence in the university’s operations, and
• the threshold for the application of the obligation to disclose provision in section 11(1)  of the Act  is that the disclosure of a record is in the public interest and would reveal “a grave environmental, health or safety hazard to the public.” The appellant has not demonstrated how third party expert reports relating to litigation between the university and a third party would reveal a public health hazard of the magnitude contemplated in section 11(1) .

[109] In sum, I find that the university has properly exercised its discretion under section 19 (c) with respect to the third party report and the supplemental third party report and I uphold its exercise of discretion.

ORDER:

1. I uphold the university’s application of the exemption in section 19 (c) and its exercise of discretion with respect to the third party report and the supplemental third party report.
2. I order the university to disclose the appellant litigation report to the appellant in its entirety by September 21, 2022 but not before September 16, 2022.
3. I uphold the university’s decision to withhold the name and personal email address of the author of the email on the basis of the exemption in section 21(1) .
4. I order the university to disclose the remaining information in the email to the appellant by September 21, 2022 but not before September 16, 2022. For clarity, the university is to withhold the name and personal email address of the author of the email.

Original Signed by:		August 16, 2022
Cathy Hamilton
Adjudicator