ORDER PO-4415

Appeal PA21-00103

Toronto Metropolitan University

June 30, 2023

Summary: The Toronto Metropolitan University (the university) received a request for records relating to two incidents where the appellant was asked to leave the premises by university security. The university disclosed information relating to the appellant, but withheld information under section 49(a) read with section 14(1)(i) (building security) and 49(b) (personal privacy). The appellant also stated that additional records relating to the incidents should exist. In this order, the adjudicator finds that the withheld information qualifies for exemption under sections 49(a) and (b). She also finds the university’s search reasonable and dismisses the appeal.

Statutes Considered: Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c.  F.31 , as amended, sections 2(1), 14(1)(i), 24, 49(a) and 49(b).

Order Considered: Order PO-3740.

OVERVIEW:

[1] The requester (now the appellant) made a request to Toronto Metropolitan University (the university) under the Freedom of Information and Protection of Privacy Act  (the Act ) for access to records relating to the appellant being at a skating rink and a church on two specified dates and being asked to leave. The appellant specified officer’s names and various locations. The university clarified the dates of the request as relating to incidents on February 13, 2020 and August 18, 2020 and the appellant indicated that he is looking for video records, notes and officer notebook entries.

[2] The university issued a decision advising that there are thirteen responsive records held by the Community Safety and Security Department. The university’s decision was as follows:

• Records 1-5 (security notes): provided partial access, with severances made pursuant to section 49(b);
• Record 6 (audio recording): denied in its entirety pursuant to section 49(b);
• Records 7-8 (security reports): provided partial access, with severances made pursuant to sections 14(1)(i) and 49(b); and
• Records 9-13 (video clips): granted full access.

[3] The appellant appealed the university’s decision to withhold certain information and records and the appeal file was assigned to a mediator. At mediation, the university confirmed that the appellant had received all of the information in records 1 – 5 with the exception of the information identified as non-responsive. The appellant confirmed that he is not pursuing the non-responsive information.

[4] Portions of records 7 and 8 were withheld pursuant to sections 49(b) and 14(1)(i). Since these records contain information about the appellant, the mediator raised the possible application of section 49(a). The university agreed with this, and accordingly, section 49(a) was added as an issue in the appeal. In discussions with the mediator, the appellant advised that he is not pursuing the vehicle information contained on page 2 of record 7. The appellant advised the mediator that he wishes to pursue access to the remaining portions of records 7 and 8 in their entirety.

[5] With respect to record 6 – an audio recording of a call on August 18, 2020 – the university advised the mediator that it does not have the ability to sever audio records. During mediation, the appellant indicated that he would be satisfied with receiving a transcription of the call, and the university therefore agreed to transcribe record 6 for the appellant.

[6] The appellant advised the mediator that there should also be an audio recording for the call on February 13, 2020. The mediator relayed this concern to the university and the FOI Coordinator agreed to conduct an additional search for audio records relating to this call.

[7] The university issued a supplementary decision, advising that portions of record 6 (the transcribed audio recording) were now being withheld under section 49(b) and that no responsive records had been located relating to the other call. The appellant confirmed that he was pursuing access to the withheld information in record 6 and also that he believes responsive records should exist for the other call.

[8] The appeal was not resolved during mediation and was moved to the adjudication stage of the appeals process. I decided to conduct an inquiry and sought and received representations from the university and the appellant. The parties’ representations were shared in accordance with the IPC’s Code of Procedure.

[9] In this order, I uphold the university’s decision to withhold the remaining information in the records at issue and find that the university conducted a reasonable search for records. I dismiss the appeal.

RECORDS:

[10] The records at issue consist of the withheld information in records 6 (a transcript of a phone call), 7 (a security occurrence report), and 8 (another security occurrence report).

ISSUES:

1. Do the records contain “personal information” as defined in section 2(1) and, if so, whose personal information is it?
2. Does the discretionary personal privacy exemption at section 49(b) apply to the information at issue?
3. Does the discretionary exemption at section 49(a) read with 14(1)(i) related to endangerment of a building, vehicle or system apply to the information in records 7 and 8?
4. Did the institution exercise its discretion under sections 49(a) and (b)? If so, should the IPC uphold the exercise of discretion?
5. Did the institution conduct a reasonable search for records?

DISCUSSION:

A. Do the records contain personal information?

[11] Before I consider the exemptions claimed by the university, I must first determine whether the records contain “personal information.” If they do, I must determine whether the personal information belongs to the appellant, other identifiable individuals, or both. “Personal information” is defined in section 2(1)  of the Act  as “recorded information about an identifiable individual.”

[12] Information is “about” the individual when it refers to them in their personal capacity, which means that it reveals something of a personal nature about the individual. Generally, information about an individual in their professional, official or business capacity is not considered to be “about” the individual.[1] In some situations, even if information relates to an individual in a professional, official or business capacity, it may still be “personal information” if it reveals something of a personal nature about the individual.[2] Information is about an “identifiable individual” if it is reasonable to expect that an individual can be identified from the information either by itself or if combined with other information.[3]

[13] The university submits that the records contain personal information about identifiable individuals. They note that the appellant’s name does not appear directly within the records at issue, but the context and contents of the records include inferences related to the personal information of the appellant. The university further submits that the records contain the personal information of other individuals:

1. Record 6 contains the personal information of another individual, including their name and location
2. Record 7 contains the personal information of another identifiable individual, including their full name, gender, community status, ID type and details, height and other identifying information
3. Record 8 is a security report that contains the personal information of other individuals, including the reporter, who is identified by their first name, and can identify the individual if combined with other information. In addition, personal information about another identifiable individual is included in the record, which constitutes the personal information of the individual if combined with other information.

[14] As such, the university submits that the records at issue are mixed records containing information that qualifies as both the personal information of the appellant and other identifiable individuals.

[15] I have reviewed the entirety of the appellant’s representations but will only address what is relevant to the issues on appeal. The appellant does not dispute the university’s representations and notes that the records contain his information, along with the information of others. Based on my review of the records at issue and the representations of each party, I find that the records at issue contain the personal information of both the appellant and other identifiable individuals. I note that the university has already disclosed a substantial amount of information in the records to the appellant and what remains is largely the personal information relating to other identifiable individuals.

[16] I will now consider the application of the exemptions claimed to withhold the information in the records.

B. Does the discretionary personal privacy exemption at section 49(b) apply to the information at issue?

[17] The university has withheld information in records 6, 7, and 8 under the discretionary personal privacy exemption in section 49 (b) of the Act . As such, and because I have found that these pages contain the personal information of both the appellant and other individuals, I must determine whether disclosure of this withheld information would be “an unjustified invasion of personal privacy” under section 49(b). Under section 49(b), where a record contains personal information of both the requester and another individual, and disclosure of the information would be an “unjustified invasion” of the other individual’s personal privacy, the institution may refuse to disclose that information to the requester. Since the section 49(b) exemption is discretionary, the institution may also decide to disclose the information to the requester.

Representations

[18] The university submits that the records at issue in this appeal contain the personal information and descriptive information of identifiable individuals other than the appellant. They state that although the appellant claims to be aware of the identity of some of these individuals, disclosing the information would be considered an unjustified invasion of their privacy, regardless of what the appellant already knows. They state that none of the individuals involved provided consent to the release of their personal information, and that this personal information was provided to the university for the purposes of investigating and addressing security and safety concerns.

[19] The appellant submits that the university did not explain why the disclosure of combined information would be an unjustified invasion of privacy. He states that they could release information that is not exempt from disclosure without combining it with exempt information and notes that he wants information that is relevant to legal proceedings. He states that the information he seeks was collected for the purpose of creating a record available to the general public and individuals who called university security had no expectation of privacy.

Analysis and finding

[20] Based on my review of information that was withheld under section 49(b), I find that all of the information that solely relates to the appellant has already been disclosed to him. The information withheld in records 6, 7, and 8 under section 49(b) consists of the names of individuals who had contacted university security regarding the appellant, and information that was collected as part of the university’s response to the calls.

[21] Sections 21(1) to (4) provide guidance in determining whether disclosure would be an unjustified invasion of personal privacy. If the information fits within any of exceptions in sections 21(1)(a) to (e), disclosure is not an unjustified invasion of personal privacy and the information is not exempt under section 49(b).

[22] In determining whether the disclosure of the personal information in the records would be an unjustified invasion of personal privacy under section 49(b), this office will consider, and weigh, the factors and presumptions in sections 21(2) and (3) and balance the interests of the parties.[4]

[23] If any of sections 21(3)(a) to (h) apply, disclosure of the information is presumed to be an unjustified invasion of personal privacy under section 49(b). Section 21(2) lists various factors that may be relevant in determining whether disclosure of personal information would constitute an unjustified invasion of personal privacy.[5] The list of factors under section 21(2) is not exhaustive. The institution must also consider any circumstances that are relevant, even if they are not listed under section 21(2).[6]

Section 21(3) - is disclosure presumed to be an unjustified invasion of personal privacy?

[24] Sections 21(3)(a) to (h) list several situations in which disclosing personal information is presumed to be an unjustified invasion of personal privacy under section 49(b). For the reasons that follow, I find that section 21(3(b) applies to the withheld information.

21(3)(b): investigation into a possible violation of law

[25] Neither the appellant or the university specifically reference section 21(3)(b) in their representations, but I find that it applies to the information at issue. This presumption requires only that there be an investigation into a possible violation of law.[7] So, even if criminal proceedings were never started against the individual, section 21(3)(b) may still apply.[8]

[26] The presumption can apply to different types of investigations, including those relating to by-law enforcement,[9] and enforcement of environmental laws,[10] occupational health and safety laws,[11] or the Ontario  Human Rights Code .[12]

[27] The presumption does not apply if the records were created after the completion of an investigation into a possible violation of law.[13]

[28] In Order PO-3740, it was found that a record created in the context of an investigation by a university security department was created during an investigation into a possible violation of law, and disclosure of the record was presumed to be an unjustified invasion of privacy.

[29] The three records are a transcription of a call that was made to the university’s Community Safety and Security Department, and two reports made by the same department. Based on my review of these records and the parties’ representations, I find that the personal information at issue was compiled and is identifiable as part of an investigation into a possible violation of law, relating to two incidents that the university’s security personnel investigated. Therefore, the presumption at section 21(3)(b) applies.

Section 21(2): Do any factors in section 21(2) help in deciding if disclosure would be an unjustified invasion of personal privacy?

[30] Section 21(2) lists several factors that may be relevant to determining whether disclosure of personal information would be an unjustified invasion of personal privacy.[14] Some of the factors weigh in favour of disclosure, while others weigh against disclosure.

21(2)(h): the personal information was supplied in confidence

[31] This section weighs against disclosure if both the individual supplying the information and the recipient had an expectation that the information would be treated confidentially, and that expectation is reasonable in the circumstances. This requires an objective assessment of whether the expectation of confidentiality is “reasonable.”[15]

[32] The university did not raise this factor specifically, but it is clear from the records and their context that the names of the callers and other personal information were supplied in confidence. Previous decisions have found that personal information provided to the police is generally done so in confidence, and I make the same finding here.[16]

[33] I do not agree with the appellant’s submission that the call transcript and security occurrence reports are records that are available to the general public. The call transcript was created specifically for this appeal, and there is no evidence to suggest that call recordings to the university’s security personnel would otherwise be available to the public. Additionally, the appellant has provided no evidence that security occurrence reports are generally available to the public, and the reports themselves are clearly marked confidential. Therefore, I find that the personal information in the records were supplied in confidence, weighing against disclosure.

21(2)(d): fair determination of rights

[34] The appellant did not specifically raise section 21(2)(d) in his representations, but he states that the information he is requesting is relevant to ongoing legal proceedings against the university. The university did not provide specific representations on section 21(2)(d). Based on my review of the records and the appellant’s representations, it is not clear to me how the disclosure of the withheld information would assist him in his legal proceedings against the university. The appellant has already received all of the information related to him, and he claims to know the identity of the individuals whose information has been withheld. While I can appreciate that the appellant wants information related to how he was treated by the university in the two incidents, he has already received this information. As such, I do not find that this factor weighs in favour of disclosure.

[35] After considering the competing interests of the appellant’s right to disclosure of information against the privacy rights of the affected parties, I conclude that the information being supplied in confidence to the university as part of an investigation into a possible violation of law means that the disclosure of the withheld information in the records to the appellant would constitute an unjustified invasion of the personal privacy of the affected parties. Therefore, I find the records at issue qualify for exemption under section 49(b), subject to the absurd result principle and my findings on the university’s discretion, discussed below.

Absurd result

[36] An institution might not be able to rely on the section 49(b) exemption in cases where the requester originally supplied the information in the record, or is otherwise aware of the information contained in the record. In this situation, withholding the information might be absurd and inconsistent with the purpose of the exemption.[17]

[37] For example, the “absurd result” principle has been applied when:

• the requester sought access to their own witness statement[18];
• the requester was present when the information was provided to the institution[19]; and
• the information was or is clearly within the requester’s knowledge[20].

[38] However, if disclosure is inconsistent with the purpose of the exemption, the absurd result principle may not apply.[21]

[39] Although the appellant claims to already know the identity of some of the individuals in the records, he did not provide evidence to substantiate his claim. I do not find that withholding this information would be inconsistent with the purpose of the exemption. Despite the knowledge that the appellant may already have, the personal information contained in the records was clearly collected as part of a security investigation and was not intended to be disclosed to the public. Furthermore, I find that the university has already disclosed non-exempt information to the appellant, including his own personal information. Accordingly, I find that the information in the records withheld by the university under section 49(b) is exempt from disclosure, subject to my review of the university’s discretion below.

C. Does the discretionary exemption at section 49(a) read with section 14(1)(i) related to endangerment of a building, vehicle or system apply to the record?

[40] Records 7 and 8 contain information that the university withheld pursuant to section 14(1)(i). As these records also relate to the appellant, I have considered section 49(a) read with section 14(1)(i). As seen from my decision below, I find that the information is exempt under section 49(a) read with section 14(1)(i). Section 49 (a) of the Act  reads:

A head may refuse to disclose to the individual to whom the information relates personal information,

where section 12, 13, 14, 14.1, 14.2, 15, 15.1, 16, 17, 18, 19, 20 or 22 would apply to the disclosure of that personal information.

[41] The discretionary nature of section 49(a) (“may” refuse to disclose) recognizes the special nature of requests for one’s own personal information and the desire of the Legislature to give institutions the power to grant requesters access to their own personal information.

[42] Section 14(1) states:

(1) A head may refuse to disclose a record if the disclosure could reasonably be expected to,

(i) endanger the security of a building or the security of a vehicle carrying items, or of a system or procedure established for the protection of items, for which protection is reasonably required;

[43] However, the exemption does not apply just because a continuing law enforcement matter exists,[22] and parties resisting disclosure of a record cannot simply assert that the harms under section 14 are obvious based on the record. They must provide detailed evidence about the risk of harm if the record is disclosed. While harm can sometimes be inferred from the records themselves and/or the surrounding circumstances, parties should not assume that the harms under section 14 are self- evident and can be proven simply by repeating the description of harms in the Act .[23]

[44] Parties resisting disclosure must show that the risk of harm is real and not just a possibility.[24] However, they do not have to prove that disclosure will in fact result in harm. How much and what kind of evidence is needed to establish the harm depends on the context of the request and the seriousness of the consequences of disclosing the information.[25]

[45] For section 14(1)(i) to apply, there must be a reasonable basis for concluding that disclosure of the information at issue could be expected to endanger the security of a building or the security of a vehicle carrying items, or of a system or procedure established for the protection of items, for which protection is reasonably required.

[46] Although this exemption is found in a section of the Act  that deals primarily with law enforcement matters, it is not restricted to law enforcement situations. It can cover any building, vehicle, system or procedure that requires protection, even if those things are not connected to law enforcement.[26]

Representations, analysis and finding

[47] The university submits that all of the records in the appeal relate to incidents where the university’s security was contacted by members of the public or by community members, due to their concerns for their personal or public safety around the appellant at the time. They state that the withheld information in records 7 and 8 relate to specific locations of security cameras or storage of video footage, and that this information cannot be disclosed without impacting the university’s security programs.

[48] The appellant states that the locations of the cameras are in plain sight and mounted in high places that are out of reach. He states that without evidence that he is likely to damage such equipment, the university has not provided “detailed evidence” as required under the Act .

[49] I do not agree with the appellant’s submission that the university needs to provide evidence that he will damage the cameras. Based on the information before me, the university is not claiming that the appellant will do so. Instead, the university states that the release of this information and the release of the storage locations of the video footage to the public would impact the university’s security programs.

[50] In these circumstances, I am satisfied by the university’s submissions that the security of the university could reasonably be expected to be endangered if the withheld information were disclosed. The appellant claims to know where the security cameras are. However, even if this is true, written confirmation of the location of the cameras would adversely affect the surveillance effectiveness of the cameras. It is also clear that the storage location of video footage being made public presents a potential security risk. As such, I find that section 14(1)(i) applies to the withheld information in records 7 and 8 and the information is exempt from disclosure under section 49(a), subject to my review of the university’s exercise of discretion.

D. Did the institution exercise its discretion under sections 49(a) and (b) If so, should the IPC uphold the exercise of discretion?

[51] The section 49(a) and (b) exemptions are discretionary (the institution “may” refuse to disclose), meaning that the institution can decide to disclose information even if the information qualifies for exemption. An institution must exercise its discretion. On appeal, the IPC may determine whether the institution failed to do so.

[52] In addition, the IPC may find that the institution erred in exercising its discretion where, for example,

• it does so in bad faith or for an improper purpose;
• it takes into account irrelevant considerations; or
• it fails to take into account relevant considerations.

[53] In either case, the IPC may send the matter back to the institution for an exercise of discretion based on proper considerations.[27] The IPC cannot, however, substitute its own discretion for that of the institution.[28]

[54] The university submits that they reviewed the records in detail and weighed the appellant’s right of access to his own personal information against others’ right to privacy. They state that they properly exercised their discretion by withholding the personal information of individuals other than the appellant in order to protect those individuals from an unjustified invasion of personal privacy. The university states that they considered the reasons for the appellant’s request, the consequences of disclosing the information, and the university’s historical practice in disclosing records.

[55] The appellant did not provide specific representations on the university’s exercise of discretion for the records at issue in the appeal, but generally says that the university acted in bad faith towards him during the incidents and throughout the access process. He says that this shows that they have not properly exercised their discretion.

[56] Based on my review of the parties’ representations and the nature and content of the records at issue, I find that the university properly exercised its discretion to withhold the information pursuant to the discretionary exemptions at sections 49 (a) and (b) of the Act . While I appreciate that the appellant feels that the university has not treated him fairly, I am satisfied that the university took into account relevant considerations, and did not act in bad faith or for an improper purpose when deciding whether or not to release the records. Accordingly, I uphold the university’s exercise of discretion in deciding to withhold the personal information in the records under the sections 49(a) and (b) exemptions.

E. Did the institution conduct a reasonable search for records?

[57] During mediation, the appellant submitted that additional records should exist for the February 13, 2020 call. If a requester claims that additional records exist beyond those found by the institution, the issue is whether the institution has conducted a reasonable search for records as required by section 24  of the Act .[29] If the IPC is satisfied that the search carried out was reasonable in the circumstances, it will uphold the institution’s decision. Otherwise, it may order the institution to conduct another search for records.

[58] Although a requester will rarely be in a position to indicate precisely which records the institution has not identified, they still must provide a reasonable basis for concluding that such records exist.[30]

[59] The Act  does not require the institution to prove with certainty that further records do not exist. However, the institution must provide enough evidence to show that it has made a reasonable effort to identify and locate responsive records;[31] that is, records that are "reasonably related” to the request.[32]

[60] A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request makes a reasonable effort to locate records that are reasonably related to the request.[33] The IPC will order a further search if the institution does not provide enough evidence to show that it has made a reasonable effort to identify and locate all of the responsive records within its custody or control.[34]

The parties’ representations

[61] The university provided an affidavit of a university Community Safety and Security employee (the employee) with its representations. In the affidavit, the employee states that following the receipt of the request from the university’s privacy office on November 18, 2020, it was clear to the employee that the appellant was seeking records relating to incidents on February 13, 2020 and August 18, 2020.

[62] The employee stated that on November 18, 2020 she conducted a search in internal paper and electronic university databases, systems, emails, and shared drives for records related to the appellant. She says she saved and downloaded records, which included video and audio recordings related to the two incidents. She stated that during mediation at this office she conducted a second search for audio records related to the February 13, 2020 incident, but she was not able to find additional recordings.

[63] She stated that the university switched to a new audio logging system and lost recordings that were not saved elsewhere prior to September 27, 2020, which would include recordings related to the two incidents. She stated that audio logs are considered transitory and are retained for 30 days, unless otherwise requested. She submits that the access request occurred well past 30 days and that no further records exist.

[64] The appellant submits that in his previous interactions with the university, the university had previously withheld information and only found it after discussions with this office. The appellant also takes issue with the university’s statement that it had migrated to a new audio logging system, stating that the university had not provided evidence of this migration. Additionally, the appellant provided a link to the university’s records retention policy and stated that the audio recordings are within the record retention schedules listed on the university’s website.[35]

Analysis and finding

[65] For the following reasons, I find that the university has provided sufficient evidence to demonstrate that it has made a reasonable effort to identify and locate all of the responsive records within its custody or control. Further, I also find that the appellant has not provided a reasonable basis for me to conclude that additional responsive records exist.

[66] In their submissions, the university provided a detailed explanation of the efforts that the university took to locate records responsive to the appellant’s request. Once the request was received, the university had an experienced employee knowledgeable in the subject matter of the request search for the records. It is clear from the affidavit that the employee expended a reasonable effort to locate records which are reasonably related to the request.

[67] The appellant did not point to any specific section of the retention policy, but based on my review of it there is no specific retention period listed for audio recordings of calls to Community Safety and Security or any other department, which is consistent with the university’s submission that these recordings are considered transitory. With respect to the appellant’s claims about the audio logging system migration, I find that even without accepting the university’s submissions on this, the appellant has not provided a reasonable basis to believe that further records exist. The university employee stated in their affidavit that the audio logs are not retained past 30 days, and the access request was made well past this. The appellant has not provided evidence that refutes this.

[68] Based on the information before me, I find that the appellant has not sufficiently provided a reasonable basis to challenge the university’s evidence of the steps that it did take, such that I can accept that a further search should be ordered. Furthermore, as mentioned, the Act  does not require the university to prove with certainty that further records do not exist. The university was required to provide enough evidence to show that it made a reasonable effort to identify and locate records that are reasonably related to the request. Accordingly, I find that there is no reasonable basis to conclude that further records exist.

ORDER:

I uphold the university’s access decision and the reasonableness of its search, and dismiss the appeal.

Original Signed by:		June 30, 2023
Stephanie Haly
Adjudicator