ORDER PO-4378

Appeal PA21-00635

University of Waterloo

April 14, 2023

Summary: The University of Waterloo (the university) received a request under the Freedom of Information and Protection of Privacy Act  (the Act ) for the name of an individual who had sent the requester “hate mail” on a webform using an Internet Protocol address belonging to the university. The university searched and located responsive records containing the name and ultimately claimed that these records were excluded from the Act  on the basis of the section 65(6) 3 exclusion for labour relations or employment records.

In this order, the adjudicator finds that the records are excluded from the application of the Act under section 65(6)3 and she dismisses the appeal.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31, section 65(6) 3.

OVERVIEW:

[1] This order concerns the application of the labour relations or employment exclusion to internal university emails that name a university staff member who allegedly improperly used the university’s information technology services.

[2] The University of Waterloo (the university) received a request under the Freedom of Information and Protection of Privacy Act  (FIPPA  or the Act ) for the name of the individual who had allegedly sent the requester “hate mail” on a webform using an Internet Protocol address (IP address) belonging to the university.

[3] Without searching for records, the university issued a decision denying access to records that might exist pursuant to the mandatory personal privacy exemption at section 21(1)  of the Act .

[4] The requester (now the appellant) appealed the university’s decision to the Information and Privacy Commissioner of Ontario (the IPC) and a mediator was assigned to attempt a resolution of the appeal.

[5] During the course of mediation, the university advised that its decision had been issued based on the nature of the information requested rather than pursuant to a review of any responsive records. The university subsequently identified two responsive email chains and issued a revised decision denying access to these records pursuant to the exclusion at section 65(6)3 (labour relations or employment records) of the Act . The university no longer claimed the exemption at section 21(1)  of the Act  to deny access.

[6] Further mediation was not possible and the appeal was transferred to the adjudication stage of the appeal process, where an adjudicator may conduct an inquiry. I decided to conduct an inquiry and I sought the university’s and the appellant’s representations which were shared in accordance with the IPC’s Practice Direction 7 on the sharing of representations.

[7] In this order, I uphold the application of the section 65(6)3 exclusion to the emails and dismiss the appeal.

RECORDS:

[8] The records are two email chains that contain emails exchanged directly between university management (i.e., the Manager of University Information Technology (IT) Security Operations, and other management, including staff in the university’s Human Resources department).

[9] The records are about the process undertaken to discover who sent the “hate mail” to the appellant from the university’s IP address. Once it was determined that the sender was a university staff member, the records discussed the next steps to be undertaken by the university as the employer of the sender of the “hate mail.”

DISCUSSION:

Does the section 65(6)3 exclusion for records relating to labour relations or employment matters apply to the emails?

[10] Section 65(6)  of the Act  excludes certain records held by an institution that relate to labour relations or employment matters. If the exclusion applies, the record is not subject to the access scheme in the Act , although the institution may choose to disclose it outside of the Act ’s access scheme.[1]

[11] The purpose of this exclusion is to protect some confidential aspects of labour relations and employment-related matters.[2]

[12] Section 65(6) states, in part:

Subject to subsection (7), this Act  does not apply to records collected, prepared, maintained or used by or on behalf of an institution in relation to any of the following:

3. Meetings, consultations, discussions or communications about labour relations or employment related matters in which the institution has an interest….

[13] If section 65(6) applies to the records, and none of the exceptions found in section 65(7) applies, the records are excluded from the scope of the Act . Section 65(7) sets out various exceptions to the exclusion; however, none of those have been argued in this appeal and, in my view, none are relevant to the circumstances.[3]

[14] If section 65(6) applied at the time the record was collected, prepared, maintained or used, it does not stop applying at a later date.[4]

[15] For section 65(6)3 to apply, the institution must establish that:

1. the records were collected, prepared, maintained or used by an institution or on its behalf;
2. this collection, preparation, maintenance or use was in relation to meetings, consultations, discussions or communications; and
3. these meetings, consultations, discussions or communications are about labour relations or employment-related matters in which the institution has an interest.

Parts 1 and 2 : collected, prepared, maintained or used in relation to meetings, consultations, discussions or communications

[16] I acknowledge that the appellant seeks only the name of the university employee. The university has identified the records that contain this information and these are the records that are before me. The IPC has consistently taken the position that the application of section 65(6) is record-specific and fact-specific. This means that when determining whether the exclusion applies, I must examine the record as a whole rather than looking at individual pages, paragraphs, sentences or words. This whole record method of analysis has also been described as the “record by record approach”.[5]

[17] The appellant agrees that the records at issue, the two email chains, were created after he advised the university that he had received “hate mail” from the university’s server. The appellant does not dispute that the records were collected, prepared, maintained or used by the university in relation to meetings, consultations, discussions or communications.

[18] Based on my review of the parties’ representations and the records, I find that parts 1 and 2 of the test under section 65(6)3 have been met as the university collected, prepared, maintained and used the records, which are email chains involving university staff, in relation to meetings, consultations, discussions or communications about the appellant’s complaint about the “hate mail”.

[19] Specifically, the records were collected, prepared, maintained and used by the Manager of University IT Security Operations for communications in relation to the investigation into the appellant’s allegations, and subsequently by the university’s employee management for discussions in relation to how to address the conduct of the employee in question, who I refer to in this order as the affected person.

[20] I must next consider whether the discussions were about “labour relations or employment-related matters in which the institution has an interest.”

Part 3: labour relations or employment-related matters in which the institution has an interest

[21] The phrase “labour relations or employment-related matters” has been found to apply in the context of:

• a job competition;[6]
• an employee’s dismissal;[7]
• a grievance under a collective agreement;[8]
• disciplinary proceedings under the Police Services Act;[9]
• a “voluntary exit program;”[10]
• a review of “workload and working relationships”;[11] and
• the work of an advisory committee regarding the relationship between the government and physicians represented under the Health Care Accessibility Act.[12]

[22] The phrase “labour relations or employment-related matters” has been found not to apply in the context of:

• an organizational or operational review;[13] or
• litigation in which the institution may be found vicariously liable for the actions of its employee.[14]

[23] The phrase “in which the institution has an interest” means more than a “mere curiosity or concern,” and refers to matters involving the institution’s own workforce.[15]

[24] The records are excluded only if the meetings, consultations, discussions or communications are about labour relations or “employment-related” matters in which the institution has an interest. Matters related to the actions of employees, for which an institution may be responsible are not employment-related matters for the purpose of section 65(6).[16]

Representations re part 3

[25] The university states that the appellant, an individual external to the university, raised allegations about a university member improperly using the university’s IT resources. In response to these allegations, the Manager of University IT Security Operations conducted an investigation under the authority of the University of Waterloo Act, 1972 and the university IT Security Service’s policies and guidelines on the use of university computer and network resources.

[26] The university states that records regarding the employee in question (the affected person) were located as a result of this investigation. The results of this investigation were reported by the Manager of University IT Security Operations to the staff member’s managers and the university’s Human Resources department.

[27] It states that the records were used in the investigation conducted by the affected person’s managers and university Employee Management staff and reflect communications about the appellant’s complaint, and communications about the ensuing investigations conducted by the IT department and human resources.

[28] The university submits that the discussions reflected in the records are entirely about employment-related matters as these are communications about the employment of the affected person, a university staff member, and their conduct as an employee of the university as it relates to compliance with policies of the university. It states that the records were used by the university in its capacity as an employer as they relate to allegations of employee misconduct. It states:

Allegations of employee misconduct are clear human resources matters in which the University has an interest. Employees of the university have obligations and employment duties set out in legislation, policies (e.g., Policy 33, Policy 34), and guidelines (e.g., Guidelines on use of university computer and network resources). An allegation that there has been a breach of such obligations and duties is investigated…

The records relate to the management of a member of the university’s own workforce…

[29] The appellant states that all he is seeking is the name of the affected person that he describes as the “tortfeasor” (wrongdoer) who sent him “hate mail” using the university’s IP address. He submits that this name is not “employment-related” but relates to the actions of the affected person, an employee of the university.

[30] The appellant states that he has no interest in the “investigation” conducted by the university subsequent to the appellant bringing to the university’s attention that someone had sent him “hate mail” using its computer facilities. He wants the name of the affected person so that he can obtain legal redress. He submits that the university’s investigation is distinct from the employee’s action of sending “hate mail” to the appellant.

[31] In reply, the university states that while the appellant submits that he has no interest in the “investigation” conducted by the university, such a claim is inconsistent with the fact he specifically contacted the university’s Manager of IT Security Operations and alleged having received a “hate mail” message submitted to a webform on his website and stated, “I would really appreciate any information that you can obtain for me.” It states that but for the request and allegation brought forward by the appellant to the Manager of University IT Security Operations, the records would never have been created.

[32] In sur-reply, the appellant states that the name of the affected person is not a record collected, prepared, maintained or used by or on behalf of the university and that the name only came to the university’s attention after the appellant informed the university that he had received “hate mail” from its server.

Findings re part 3

[33] The types of records excluded from the Act  by section 65(6) are those relating to matters in which the institution is acting as an employer, and terms and conditions of employment or human resources questions are at issue.[17]

[34] Section 65(6) does not exclude all records concerning the actions or inactions of an employee of the institution simply because their conduct could give rise to a civil action in which the institution could be held vicariously liable for its employees’ actions.[18] The appellant relies on this principle and I will return to it below.

[35] For the collection, preparation, maintenance or use of a record to be “in relation to” one of the subjects mentioned in this section, there must be “some connection” between them.[19]

[36] The “some connection” standard must, however, involve a connection relevant to the scheme and purpose of the Act , understood in their proper context. For example, given that accountability for public expenditures is a core focus of freedom of information legislation, accounting documents that detail an institution’s expenditures on legal and other services in collective bargaining negotiations do not have “some connection” to discussions about labour relations.[20]

[37] The term “employment-related matters” refers to human resources or staff relations issues arising from the relationship between an employer and employees that do not arise out of a collective bargaining relationship.[21]

[38] In this appeal, at issue are email chains that were created after the appellant advised the university that he had received a “hate mail” message originating from the university’s IP address and asked the university to provide him the name of the sender of this message.

[39] The records are internal university emails regarding this investigation that was undertaken to locate the name of the sender of the “hate mail”.

[40] Once it was determined by the university’s IT services that the sender was a university staff member, the records then discuss the next steps to be undertaken by the university as the employer of the sender of the “hate mail.”

[41] Looking at each record as a whole, I agree with the university that the discussions in the records are about employment-related matters in which the university has an interest.

[42] In this case, the university was investigating who sent the message to the appellant. The records reveal the affected person’s (a university’s staff member) name who allegedly improperly used the university’s IT resources. The records also discuss university management’s next steps in response to this information regarding the affected person. It is evident from my review of the emails that the university treated the incident as an employment matter as soon as it was known that the sender was an employee.[22]

[43] Therefore, the records relate to matters in which the university is acting as an employer and the terms and conditions of employment or human resources questions about a university staff member are at issue.[23]

[44] As noted above, section 65(6) does not exclude all records concerning the actions or inactions of an employee of the institution simply because their conduct could give rise to a civil action in which the institution could be held vicariously liable for its employees’ actions.[24]

[45] The appellant has indicated that he needs the employee’s name to seek legal redress. He has not indicated what legal redress he would be seeking if he obtained this name or whether he would be seeking redress from the university.

[46] I acknowledge that the appellant argues that the records are not excluded because they concern the actions or inactions of a university employee because their conduct could give rise to a civil action in which the university could be held vicariously liable for its employee’s actions. However, I disagree with the appellant that this principle applies to the records before me.

[47] In this case, although the “hate mail” message was sent from an employee of the university, I have not been provided with evidence by either party that the employee was authorized to send this message on behalf of the university or that the university could be held vicariously liable for its employee’s actions in the sending of this message.

[48] Instead, the records are excluded as they are employment-related discussions about the conduct of the affected person, a university staff member, and their compliance with the IT Security Service’s policies of the university.

[49] Accordingly, the records are excluded from the application of the Act by reason of section 65(6)3. It should be noted that my finding is limited to the jurisdiction of the IPC.

ORDER:

As the records are excluded from the application of the Act, I dismiss the appeal.

Original signed by:		April 14, 2023
Diane Smith
Adjudicator