ORDER PO-4363

Appeal PA20-00103

University of Toronto

March 15, 2023

Summary: The requester sought access to correspondence from the University of Toronto (the university) and the University of Toronto Asset Management Corporation (UTAM). The university granted partial access to the responsive records. A third party appealed the university’s decision, arguing that the responsive records are not in the university’s custody or under its control, or alternatively, that the information at issue is exempt under the mandatory third-party information exemption in section 17(1)  of the Freedom of Information and Protection of Privacy Act  (the Act ). In this order, the adjudicator determines that the records are in the custody or under the control of the university. She concludes that section 17(1) applies only to the information at issue that would reveal the identity of the third party’s investors. The adjudicator upholds the university’s decision that section 17(1) does not apply to the remaining information and orders it disclosed to the requester.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, sections 10(1)  and 17(1) .

OVERVIEW:

[1] The requester, a member of the media, filed a request under the Freedom of Information and Protection of Privacy Act  (the Act ) with the University of Toronto (the university) for correspondence between an identified individual, a charitable foundation, the university and/or the University of Toronto Asset Management Corporation (UTAM).

[2] After clarifying the request, the university located a number of responsive records and notified a party whose interests may be affected by the disclosure of the records (the affected party) under section 28  of the Act . The university then issued an access decision to the requester and the affected party, granting the requester partial access to the records. It withheld some portions of the records under the mandatory exemptions in sections 17(1) (third party information) and 21(1) (personal privacy) and the discretionary exemption in section 18(1) (economic interests) of the Act . The requester did not appeal the university’s decision to withhold these portions.

[3] The affected party (now the appellant) appealed the university’s decision. Mediation did not resolve the issues under appeal and the matter was transferred to the adjudication stage of the appeal process, where an adjudicator may conduct a written inquiry pursuant to the Act . An adjudicator commenced an inquiry and sought representations from the parties. In its representations, the appellant asserted that the records at issue are not in the custody or under the control of the university. The adjudicator added this issue to the appeal.

[4] Next, the adjudicator provided UTAM with a Notice of Inquiry and invited it to submit representations. UTAM declined to participate in the inquiry. The adjudicator also invited the university to submit representations in response to the appellant’s representations. The university also declined to participate. Finally, the adjudicator provided the original requester with a Notice of Inquiry and invited them to make representations, but none were received.

[5] The matter was then transferred to me to continue the inquiry. I reviewed all of the information at issue and determined that I did not require any additional information from the parties to issue a decision. In this order, I find that the records are in the custody or under the control of the university. I find that a number of investors’ email addresses that repeat throughout the records are exempt from disclosure pursuant to section 17(1)  of the Act . However, I find that section 17(1)  does not apply to the remaining information at issue and I uphold the university’s decision to disclose that information to the requester.

RECORDS:

[6] The records at issue in this appeal are comprised of correspondence, distribution notices and other information relating to the appellant’s organization. There are 1056 pages at issue in total. [1]

ISSUES:

1. Are the records “in the custody” or “under the control” of the university pursuant to section 10(1)  of the Act ?
2. Does the mandatory exemption at section 17(1) (third party information) apply to the information the university decided to disclose?

DISCUSSION:

Issue A: Are the records “in the custody” or “under the control” of the institution under section 10(1)?

[7] The appellant denies that the records at issue are in the custody or control of an institution subject to the Act and says that as a result, the information the requester seeks should not be disclosed.

[8] Section 10(1) provides for a general right of access to records that are in the custody or under the control of an institution governed by the Act . It reads, in part:

Every person has a right of access to a record or a part of a record in the custody or under the control of an institution unless . . .

[9] Under section 10(1), the right of access applies to a record that is in the custody or under the control of an institution; the record need not be both. [2]

[10] There are exceptions to the general right of access set out in section 10(1). [3] The record may be excluded from the application of the Act by section 65, or may be subject to an exemption from the general right of access. [4] However, if the record is not in the custody or under the control of the institution, none of the exclusions or exemptions need to be considered since the general right of access in section 10(1) is not established.

[11] The courts and the IPC have applied a broad and liberal approach to the custody or control question. [5] The IPC considers the following non-exhaustive list of factors when deciding if a record is in the custody or under the control of an institution:

• Was the record created by an officer or employee of the institution? [6]
• Does the institution have a statutory power or duty to carry out the activity that resulted in the creation of the record? [7]
• Does the content of the record relate to the institution’s mandate and functions? [8]
• Does the institution have physical possession of the record, because its creator provided it voluntarily or pursuant to a statutory or employment requirement?
• If the institution does have possession of the record, is it more than “bare possession”? [9]
• Does the institution have the authority to regulate the record’s content, use and disposal? [10]
• Are there any limits on the ways the institution may use the record? If so, what are those limits, and why do they apply to the record? [11]
• How closely is the record integrated with other records held by the institution? [12]
• What is the usual practice of the institution and institutions similar to the institution in relation to possession or control of records of this nature? [13]

[12] The list is not intended to be exhaustive. Some of the listed factors may not apply in a specific case, while other unlisted factors may apply. [14]

[13] In addition to the factors referred to above, the Supreme Court of Canada articulated the following two-part test to determine institutional control of a record in Canada (Information Commissioner) v. Canada (Minister of National Defence):

1. Do the contents of the document relate to a departmental matter?
2. Could the government institution reasonably expect to obtain a copy of the document upon request? [15]

[14] According to the Supreme Court, control can only be established if both parts of this test are met. To determine whether the records are in the “custody or control” of the university, I must consider the factors contextually in light of the purpose of the legislation. [16]

[15] In its representations, the appellant says that UTAM is not an institution under the Act and that as a result, information and records in the custody or control of UTAM are not subject to requests for access made pursuant to the Act .

[16] The appellant asserts that the records at issue were not created by, and do not concern, the university. It says that the records are comprised exclusively of correspondence involving, and information received by, UTAM personnel. The appellant says that UTAM is a separately incorporated organization governed by its own senior management team and board of directors. It submits that UTAM hires its own staff, sets its own policies, and has its own offices.

[17] The appellant says that in the decision letter it received from the university regarding its decision to release the records at issue, the university asserted that the records are subject to a right of access under the Act  because UTAM acts as an agent for the university, and the university has a right to access its records. The appellant says that it is not aware of any such agency or access right in respect of the records. It says that the university did not provide an explanation or any supporting information about its relationship with UTAM. The appellant says that all of its dealings and communications were with UTAM and not the university.

[18] The appellant says that even if the university and UTAM had an agency and/or right of access agreement, which it denies, the records at issue would still not be in the custody or control of the university. The appellant refers me to IPC Order 120, which sets out a number of factors that are to be considered in determining whether an institution has custody or control of a record. The appellant argues that these factors weigh strongly in favour of a finding that the records at issue are in the custody or control of UTAM, and not the university. Specifically, it says that the records:

• were created by UTAM personnel in the ordinary course, and for the sole purpose, of UTAM’s business and operations;
• are held by UTAM on UTAM’s independent computer servers and/or in UTAM’s separate offices; and
• do not relate to the university’s mandate.

[19] Furthermore, the appellant says there is no statutory or other mandatory requirement that the university be provided with copies of the records. Finally, the appellant argues that the university does not have the authority to dispose of the records or regulate how they are used. As a result, the appellant says that the records should be withheld from the requester in full.

[20] As noted above, neither the university nor UTAM participated in this inquiry. In its email to the IPC where it advised it would not be making representations, the university specified that it continued to rely on its access decision. I note that the university’s access decision states that the records at issue are in the custody of the university and subject to the Act .

Findings and analysis

[21] For the reasons that follow, I find that the records at issue are in the custody or under the control of the university pursuant to section 10(1)  of the Act . In making this determination, I considered the appellant’s representations and its assertions that UTAM is a separate entity from the university governed by its own board of directors, with its own staff, policies, and offices. There is no dispute that UTAM is a separate entity from the university.

[22] The University of Toronto Act, 1971, specifies that the “government, management and control” of the university, and of the “property, revenues, business and affairs thereof,” are vested in the university’s Governing Council. This statute also provides that the Governing Council may invest the university’s assets as it considers proper, but that the Governing Council must act in the best interests of the university.

[23] The responsibilities of the Governing Council, including its obligations with regard to the university’s asset management (including its finances and capital expenditures) are set out in the University of Toronto Governing Council’s “Principles of Good Governance” and “Mandate of Governance,” which are available on the university website. [17] It is clear from the university’s governing statute and related policies that management of university assets is a departmental matter of the university.

[24] I have also considered the university’s decision letter, where it specified that the records are properly in the control of the university, and are therefore subject to the Act . [18] The university stated that although UTAM is a separate entity from the university, it acts as an agent for the university and the university “has documented rights to access its records.” While the university did not submit representations, I gave significant weight to its determination that it has control of the records at issue.

[25] In making the determination that the records are in the custody or under the control of the university, I also considered the type of information at issue. Each of the records at issue is an email, or an attachment to an email, that was either sent or received by a UTAM employee. I agree with the appellant that these emails were created by UTAM personnel in the ordinary course of UTAM’s business and operations. However, the emails are clearly connected to the university’s asset management, which is a responsibility of the university as per the University of Toronto Act.

[26] I also note that the UTAM employee emails contain the university’s domain name (for example, employee@utam.utoronto.ca). The appellant, however, asserts that the emails at issue are held by UTAM on UTAM’s independent computer servers and/or in UTAM’s separate offices. I did not receive any additional evidence on this point from the appellant, nor do I have any information from UTAM or the university about who owns the server the emails are stored on. In any event, whose server the emails are on is not determinative. If the university has possession of the emails on its server, then I find, for the reasons set out in this order, that the university has custody of them and not just bare possession. If the emails are on UTAM’s servers, then for similar reasons I find that the university has control of them.

[27] I am not persuaded by the appellant’s claim that there is no statutory or other mandatory requirement that the university be provided with copies of the records at issue. As noted above, the University of Toronto Act provides that asset management is a university matter. The university’s decision letter specified that it had a “documented right of access.” While it would have been helpful if the university had been more specific, I note that UTAM did not challenge the university’s access decision, apparently conceding that the emails are in the custody or under the control of the university.

[28] If the emails are indeed not in the university’s possession, as asserted by the appellant, I find that the two-part test set out in National Defence is satisfied and the university has institutional control over the records. [19] Applying the approach set out in National Defence, and considering the governance structure of UTAM, I find that the records relate to a departmental matter (the university’s asset management) and that the university would be entitled to obtain a copy of the records from the UTAM.

[29] UTAM’s website indicates that it reports to the university’s Business Board regarding UTAM’s investment management and performance. The website explains that the Business Board is one of the university’s three boards of the Governing Council. Its responsibilities include ensuring that resource allocations are responsible and cost- effective, and approving policy and major transactions in the business management of the University. [20] In my view, it is reasonable to expect that the university’s Business Board could obtain copies of the records at issue from UTAM.

[30] In making this determination, I have also had the benefit of reviewing the Divisional Court’s decision in YUDC v. Information and Privacy Commissioner, where it considered an IPC adjudicator’s finding that the National Defence test was satisfied. [21] The Court emphasized the following:

In National Defence, the Supreme Court recognized the importance of interpreting the “control” provisions of access to information legislation in a manner consistent with the purpose of the legislation. As a result, the Court held that “the notion of control must be given a broad and liberal meaning in order to create a meaningful right of access to government information” (at para. 54).

[31] The Court in YUDC also reiterated that the test in National Defence is contextual and requires a decision-maker to consider all of the circumstances in assessing whether records are under the control of an institution subject to the Act . The Court specified that the test is flexible enough to apply to a variety of factual contexts. In that specific case, the Court upheld the IPC adjudicator’s conclusion that the National Defence test was satisfied because first, the specific records at issue related to the York University’s mandate to manage and lease its real property and have any revenues applied to achieve its objectives and purposes. Second, because York University could reasonably expect to obtain a copy of the records at issue from the York University Development Corporation (the “YUDC”).

[32] In making the second determination, the adjudicator cited Ontario (Criminal Code Review Board) v. Doe, [22] and concluded that York University could not avoid the application of the Act by creating a corporate entity to assist it in carrying out an aspect of York’s statutory mandate. The Divisional Court upheld the adjudicator’s findings as reasonable and I agree with and adopt those findings and apply them to the current case involving the university and UTAM.

[33] For all of the reasons set out above, I find that the records at issue are in the custody and/or under the control of the university and I will continue to determine whether the mandatory exemption claimed by the appellant for third party information applies such that the information at issue must not be disclosed.

Issue B: Does the mandatory exemption at section 17 (third party information) apply to the records?

[34] The appellant says that section 17(1)(a) and/or (c) apply to all of the records at issue and argues that they must not be disclosed.

[35] The purpose of section 17(1) is to protect certain confidential information that businesses or other organizations provide to government institutions, [23] where specific harms can reasonably be expected to result from its disclosure. [24] The relevant portions of section 17(1) state:

A head shall refuse to disclose a record that reveals a trade secret or scientific, technical, commercial, financial or labour relations information, supplied in confidence implicitly or explicitly, if the disclosure could reasonably be expected to,

(a) prejudice significantly the competitive position or interfere significantly with the contractual or other negotiations of a person, group of persons, or organization; …

(c) result in undue loss or gain to any person, group, committee or financial institution or agency; or …

[36] For section 17(1) to apply, the party arguing against disclosure must satisfy each part of the following three-part test:

1. the record must reveal information that is a trade secret or scientific, technical, commercial, financial or labour relations information;
2. the information must have been supplied to the institution in confidence, either implicitly or explicitly; and
3. the prospect of disclosure of the record must give rise to a reasonable expectation that one of the harms specified in paragraph (a), (b), (c) and/or (d) of section 17(1) will occur.

[37] All three aspects of the section 17(1) test must be met in order for the information to qualify for exemption. If any part of the test is not satisfied, the information is not subject to the section 17(1) exemption.

[38] The appellant says that the records at issue are exempt from disclosure under section 17(1)  of the Act  because they contain confidential commercial, financial and technical information, the disclosure of which would reasonably be expected to: (a) prejudice significantly its competitive position, and result in undue loss to it and undue gains for its competitors; and (b) interfere significantly with its current and prospective contractual or other negotiations with investors. [25]

Part I: Type of Information

[39] The appellant says that the records are comprised of, and permit inferences about, its technical, financial and commercial information by revealing details about its business and operations, as well as the frequency, timing, and type of communications it has with its investors. [26]

[40] Previous IPC orders have defined commercial information as follows:

Commercial information is information that relates only to the buying, selling or exchange of merchandise or services. This term can apply to commercial or non-profit organizations, large or small. [27] The fact that a record might have monetary value now or in future does not necessarily mean that the record itself contains commercial information. [28]

[41] Having reviewed all of the records at issue I agree with the appellant that most of the information at issue is commercial information, as that term is described above. The majority of the information at issue relates to the appellant’s business operations and the delivery of the services it provides to its investors.

[42] However, some of the information at issue is not commercial information, nor does it contain any of the other types of information that would meet part one of the three- part test in section 17(1). This information is comprised of automatic “out of office” emails, [29] emails exchanged solely for the purposes of scheduling meetings, [30] other generic or routine communications, [31] or communications that contain information that directly relates to UTAM and not the appellant. [32] In my view, this is not the sort of information intended to be protected under section 17(1)  of the Act . This information does not reveal anything about the appellant’s business operations, nor the services it provides. Furthermore, it is clearly not financial or technical information.

[43] As such, records 165-167, 732, 734-742, 753-761, 765, 775-777, 781-782, 790-795, 799-801, 821-823, 825-826, 831-837, 840-855, 858-864, 875-878, 880-886, 907-909, 911-925, 933, 941, 943-944, 954, 958-966, 986-987, 989-990, 995-997, 1001, 1003-1006, 1008-1014, 1024-1029, 1037, 1038-1043 do not meet the three-part test in section 17(1) of the Act and I will order the university to disclose them to the requester.

[44] I find that the rest of the information is commercial information and I will continue to determine whether the remaining parts of the section 17(1) test are also satisfied.

Part 2: Supplied in confidence

[45] Part two of the three-part test itself has two parts: the appellants must have “supplied” the information to the university, and must have done so “in confidence,” either implicitly or explicitly.

[46] The requirement that the information has been “supplied” to the institution reflects the purpose in section 17(1) of protecting the informational assets of third parties. Information may qualify as “supplied” if it was directly supplied to an institution by a third party, or where its disclosure would reveal or permit the drawing of accurate inferences with respect to information supplied by a third party.

[47] In order to satisfy the “in confidence” component of part two, the parties resisting disclosure must establish that the supplier of the information had a reasonable expectation of confidentiality, implicit or explicit, at the time the information was provided. This expectation must have an objective basis. [33]

[48] In determining whether an expectation of confidentiality is based on reasonable and objective grounds, all the circumstances of the case are considered, including whether the information was communicated to the institution on the basis that it was confidential and that it was to be kept confidential, treated consistently by the third party in a manner that indicates a concern for confidentiality, not otherwise disclosed or available from sources to which the public has access, and prepared for a purpose that would not entail disclosure. [34]

[49] The appellant says that the information at issue is comprised of communications and documents that it supplied to UTAM. I have reviewed all of the information remaining at issue and I agree that it was supplied to UTAM by the appellant by email. As such, I must determine whether this information was supplied in confidence.

[50] The appellant submits its contract with its investors, including UTAM, contains a confidentiality provision that prohibits it, or its investors, from publicly disclosing information pertaining to the business relationship and/or investments with the appellant. The appellant provided an excerpt of the clause in the contract it referred to in support of this representation. [35] The appellant argues that, based on the terms of the contract, it reasonably expected that the information at issue was supplied in confidence.

[51] I have reviewed the relevant portions of the confidentiality clause and I agree with the appellant that, based on the specific language, it had a reasonable expectation that UTAM would endeavor to keep the information it supplied confidential. I also find that some of the information in the records themselves also supports the appellant’s assertions that information was being provided in confidence. As such, I find that the information I have already concluded is commercial information was also supplied in confidence to UTAM. I will now continue to determine whether part three of the three-part test in section 17(1) is met.

Part 3: Harms

[52] Sections 17(1)(a) and (c) seek to protect information that could be exploited in the marketplace. [36] Parties resisting disclosure of a record cannot simply assert that the harms under section 17(1) are obvious based on the record. They must provide detailed evidence about the risk of harm if the record is disclosed. While harm can sometimes be inferred from the records themselves and/or the surrounding circumstances, parties should not assume that the harms under section 17(1) are self-evident and can be proven simply by repeating the description of harms in the Act . [37]

[53] Parties resisting disclosure must show that the risk of harm is real and not just a possibility. [38] However, they do not have to prove that disclosure will in fact result in harm. How much and what kind of evidence is needed to establish the harm depends on the context of the request and the seriousness of the consequences of disclosing the information. [39]

[54] The appellant says that it is a “preeminent” private equity investment firm that specializes in “control and/or influence investments in distressed and undervalued Canadian situations, with particular experience in restructuring, credit markets and merchant and investment banking in both the U.S. and Canada.” It argues that the Canadian private equity investment market is complex, large and highly competitive. It says that in 2020, a total of approximately $14 billion was invested by Canadian and international private equity firms operating in Canada. [40] It says that it competes directly with both domestic and foreign private equity investment firms to maintain and grow its share of this competitive market.

[55] The appellant submits that its continued success is dependent upon the development of successful business and monetization strategies as well as its relationships with investors. Accordingly, it says that it makes substantial investments of time, capital and other resources in developing and maintaining investor confidence and achieving positive fund performance. Furthermore, the appellant submits the following:

• Private equity investment market is highly competitive and there is significant competitive pressure to maintain and develop relationships with current and prospective investors in order to achieve positive fund performance,
• its strategy and approach to client relationship managements is essential to its successful performance in the Canadian investment market,
• it has invested time and capital to develop and refine its investor relations strategies, and
• its competitors could use those strategies at the expense of the appellant to better understand how it maintains its client relationships with key investors and improve its own strategies.

[56] The appellant also asserts that it maintains strict confidentiality over the identities of its investors. It says that if the identities of its investors were disclosed, this information would be used by one of its competitors to target its investors with future solicitations.

[57] I have reviewed all of the records at issue, and considered the appellant’s representations and while I accept its assertions about the nature of its business and operations, I do not believe that the disclosure of the specific information at issue could reasonably be expected to cause the harms it alleges.

[58] The majority of the information is basic, routine communications relating to progress reports, investor meetings, and gatherings or receptions. Many of the communications are cover letters sending attachments. The university withheld the majority of the attachments and so it is only the emails that remains at issue. In my view, these emails simply do not contain sufficient information to cause the types of harms alleged by the appellant.

[59] Similarly, I do not accept that revealing how often the appellant provides reports to clients on investment activities could reasonably be expected to prejudice the appellant’s competitive position or result in undue loss to it or gain to a competitor. In my view, this is not the type of information that a competitor could use to gain an edge on the appellant.

[60] I also disagree that the information in the records about the type of functions and/or gatherings, meetings or receptions held by the appellant could reasonably be expected to result in the harms it alleges. In my view, many business and/or investment firms engage in similar types of activities as those that are detailed in the records and the information would need to be much more specific, detailed and revealing in order to cause the type of harm contemplated by section 17(1)(a) or (c).

[61] Finally, I do not accept that the information at issue could be used by the appellant’s competitors to better understand how the appellant maintains its client relationships with key investors and improve its own strategies.

[62] However, I accept the appellant’s assertion that if the identities of its investors were disclosed, this information could be used by its competitors to target those investors with future solicitations. [41] As such, I find that this information meets the criteria set out in both section 17(1)(a) and (c) as this information could be exploited in the marketplace and prejudice the competitive position of the appellant and result in undue loss to it, and/or undue gain to its competitors. I have highlighted the information in the records that identifies the appellant’s investors and order that the university withhold this information from the requester. [42]

[63] I find that the remaining information, which is not highlighted in the records, is not subject to section 17(1)(a) or (c) and I order the university to disclose it to the requester. In making this decision, I considered all of the appellant’s representations, even those not referred to above. However, for the reasons already outlined above, I find that the remaining information is too generic to be reasonably expected to cause the types of harms referred to in section 17(1)  of the Act .

[64] Finally, I have considered the appellant’s assertion that none of the information at issue can be severed and the remainder disclosed because it would permit inferences about information that is exempt pursuant to section 17(1) and/or would also result in the requester receiving meaningless portions of information that are comprised of disconnected snippets. I disagree. For the reasons set out above, I have found that the majority of the information at issue is not exempt pursuant to section 17(1). The information that is exempt consists of email addresses that can easily be severed without impacting the requester’s ability to understand the remaining information, which I am ordering the university to disclose.

ORDER:

1. I order the university to disclose the records to the requester by April 21, 2023 but not before April 18, 2023. The information I have found to be exempt under section 17(1) is to be severed from the records. I have included a copy of the records and highlighted the portions that are not to be disclosed to the requester.
2. In order to verify compliance with order provision 1, I reserve the right to require that the university provide me with a copy of the records sent to the requester.

Original Signed by:		March 15, 2023
Meganne Cameron
Adjudicator