ORDER MO-4497

Appeal MA21-00428

Corporation of the Town of Arnprior

March 6, 2024

Summary: This appeal relates to a multi-part request submitted under the Act for records relating to an IT system review conducted by the Town of Arnprior (the town) and an in camera discussion of that review at town council. The town granted partial access to the responsive records and relied on sections 6(1)(b) (closed meeting), 8(1)(i) (security), 10(1) (third party information) and 11 (economic and other interests) of the Act to withhold records. In this decision, the adjudicator finds that the exemptions at section 6(1)(b) and section 8(1)(i) apply to some records. She also finds neither the exemption at section 10(1) nor the exemption at section 11 apply to any of the records for which they were claimed. She orders the town to disclose the non- exempt information and dismisses the appeal.

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. M.56 , as amended, sections 6(1)(b), 8(1)(i), 10(1), 11(1)(c) and 11(1)(d). Municipal Act, 2001,  S.O. 2001, c. 25, section 239(2) .

Orders Considered: Orders MO-2833 and MO-3728.

OVERVIEW:

[1] In November 2019, as part of the Municipal Modernization Program, the Town of Arnprior (the town) resolved to undertake a comprehensive review of its information technology (IT) infrastructure, network security, resource support, and functionality (the IT system review).

[2] The appellant made a request, under the Municipal Freedom of Information and Protection of Privacy Act (the Act), for access to various types of records relating to the IT system review.

[3] Following third party notifications to three companies who might have an interest in the disclosure of the records (the affected parties), the town issued a decision granting partial access to the responsive records, with severances under the discretionary exemptions at sections 6(1)(b) (closed meeting), 8(1)(i) (endanger security of building, vehicle, system or procedure), 11(c) (prejudice to economic interests or competitive position) and 11(d) (injury to financial interests), and the mandatory exemption at section 10(1) (third party information) of the Act.

[4] The appellant appealed the town’s decision to the Information and Privacy Commissioner of Ontario (the IPC).

[5] The IPC appointed a mediator to explore resolution but mediation was not possible. As such, the appeal was transferred to the adjudication stage of the appeal process, where an adjudicator may conduct a written inquiry under the Act.

[6] The adjudicator initially assigned to this appeal invited and received representations from both the town and the appellant.[1] This appeal was subsequently transferred to me to continue the inquiry. Upon review of the appeal, I decided to send out a Supplemental Notice of Inquiry to the affected parties,[2] inviting them to provide representations on section 10(1). I received representations from one of the three affected parties, affected party A.[3] After reviewing the appellant’s and the town’s representations in response to affected party’s representations, I decided that I did not require further submissions from any of the parties.

[7] For the reasons that follow, I find that the exemptions at section 6(1)(b) and section 8(1)(i) apply to some records. I do not find that the exemption at 10(1) nor the exemption at 11 apply to any of the records for which they were claimed. I order the town to disclose the non-exempt records to the appellant.

RECORDS:

[8] There are ten records remaining at issue consisting of 164 pages. Nine records were fully withheld and one record was partially disclosed.

[9] The table below summarizes the exemption(s) claimed over each record, using the names of the records set out in the town’s index of records.

Records at issue

Record	Name of record	Exemption(s) claimed
1	Closed Session Staff Memo 20/08/20	sections 6(1)(b), 8(1)(i), 11(1)(c), and 11(1)(d)
2	PPT – Municipal Modernization Program – IT System Review	sections 6(1)(b), 8(1)(i), 11(1)(c), and 11(1)(d)
3	Closed Staff Report 20-08-24-01	sections 6(1)(b), 8(1)(i), 11(1)(c), and 11(1)(d)
4[4]	[Affected party A] IT Consolidated Risk Report	sections 8(1)(i), 10(1), 11(1)(c), and 11(1)(d)
5[5]	[Affected party A] Recommended Actions	sections 8(1)(i), 10(1), 11(1)(c), and 11(1)(d)
7[6]	IT System Review [number] – Work plan	section 10(1)
8[7]	Email from [specified individual]	section 10(1) (partially disclosed)
16[8]	Final Report	sections 8(1)(i), 10(1), 11(1)(c), and 11(1)(d)
23[9]	[specified] proposal of affected party B]	section 10(1)
24[10]	[specified] proposal of affected party C]	section 10(1)

ISSUES:

1. Does the discretionary exemption at section 6(1)(b) relating to closed meetings apply to records 1, 2 and 3?
2. Does the discretionary exemption at section 8(1)(i) related to the security of a system apply to records 1, 4, 5 and 16
3. Does the mandatory exemption at section 10(1) for third party information apply to records 7, 8, 16, 23 and 24?
4. Does the discretionary exemption at section 11 for economic and other interests apply to records 1 and 16?
5. Did the town exercise its discretion under sections 6(1)(b) and 8(1)(i)? If so, should I uphold the exercise of discretion?

DISCUSSION:

Issue A: Does the discretionary exemption at section 6(1)(b) relating to closed meetings apply to records 1, 2 and 3?

[10] The town claims the exemption at section 6(1)(b) applies to records 1, 2 and 3.

[11] Section 6 protects certain records relating to a municipal institution’s legislative function or closed meetings of a council, board, commission or other body.

[12] Section 6(1)(b) reads:

A head may refuse to disclose a record,

that reveals the substance of deliberations of a meeting of a council, board, commission or other body or a committee of one of them if a statute authorizes holding that meeting in the absence of the public.

[13] For section 6(1)(b) to apply, the town must show that:

1. a council, board, commission or other body, or a committee of one of them, held a meeting,
2. a statute authorizes the holding of the meeting in the absence of the public, and
3. disclosure of the record would reveal the actual substance of the deliberations of the meeting.[11]

Part 1 – a council, board, commission or other body, or a committee of one of them, held a meeting

[14] The first part of the test for the exemption under section 6(1)(b) requires the town to establish that a meeting was held by a council, board, commission or other body, or a committee of one of them.

[15] The town submits that council held a meeting on August 24, 2020. Neither the appellant nor the affected parties dispute this fact.

[16] Based on the evidence provided by the town, I accept that a meeting was held by council. Therefore, I find that the first part of the three-part test under section 6(1)(b) has been met.

Part 2 – a statute authorizes the holding of the meeting in the absence of the public

[17] The second part of the test requires that the town establish a meeting was properly held in camera (in the absence of the public)[12] by identifying the relevant statutory authority to support it. In determining whether there was statutory authority to hold a meeting in camera under part two of the test, I must consider whether the purpose of the meeting was to deal with the specific subject matter identified in the statute authorizing the holding of a closed meeting.[13]

[18] The town submits that during this meeting, council resolved to move into closed session. In its representations, the town included the minutes of the open session of council, which document the resolution to move into closed session. The minutes from the open session of council state:

That Council move into Closed Session regarding One (1) matter to discuss a trade secret or scientific, technical, commercial, financial or labour relations information, supplied in confidence to the municipality or local board, which, if disclosed, could reasonably be expected to prejudice significantly the competitive position or interfere significantly with the contractual or other negotiations of a person, group of persons, or organization pursuant to Section 239(2)(i) of the Municipal Act (IT Review).

[19] Under section 239(1) of the Municipal Act, 2001 ,[14] all meetings must be open to the public unless they fall within the prescribed exceptions. Section 239(2)  of the Municipal Act, 2001  sets out the exceptions that authorize the convening of a meeting in the absence of the public.

[20] The town submits that the closed session of council was authorized by the exception at section 239(2) (i) of the Municipal Act, 2001 , which states:

(2) A meeting or part of a meeting may be closed to the public if the subject matter being considered is,

(i) a trade secret or scientific, technical, commercial, financial or labour relations information, supplied in confidence to the municipality or local board, which, if disclosed, could reasonably be expected to prejudice significantly the competitive position or interfere significantly with the contractual or other negotiations of a person, group of persons, or organization.

[21] The town submits that the purpose of the closed session was to discuss the IT system review, specifically the report received from affected party A. It also submits that the records at issue contain technical information relating to the town’s IT infrastructure and the outcome of the IT system review. The town submits that the disclosure of the information contained in the records at issue have the potential to significantly interfere with affected party A’s competitive position as the report (record 2) is proprietary.

[22] I have reviewed records 1, 2 and 3 in light of the town’s representations. Based on this review, I find that the town was authorized to hold a meeting in camera under section 239  of the Municipal Act, 2001 . Specifically, section 239(2)(i) of the Municipal Act, 2001  provides the town with the statutory authority to hold the meetings on August 24, 2020 in camera when the subject matter is technical information, which if disclosed could reasonably be expected to prejudice significantly the competitive position of affected party A. Therefore, I find that the second part of the section 6(1)(b) test has been met.

Part 3 – disclosure of the records would reveal the actual substance of the deliberations of the meeting

[23] With respect to the third part of the test, the wording of the provision and previous IPC decisions establish that in order to qualify for exemption under section 6(1)(b), there must be more than merely the authority to hold a meeting in the absence of the public. Section 6(1)(b) of the Act specifically requires that disclosure of the records would reveal the actual substance of deliberations which took place at the town’s closed meeting, not only the subject of the deliberations.[15]

[24] The town has the onus of establishing how disclosure of records 1, 2 and 3 would reveal the actual substance of the deliberations at the meeting and not merely the subject of the deliberations.

[25] The town submits that disclosure of records 1, 2 and 3 would reveal the substance of the deliberations that took place during the closed meeting. Moreover, it submits that disclosure of these records would reveal more than merely the substance of the deliberations but would reveal the deliberations themselves as these records form the basis for the discussion that took place during the closed meeting. The town submits that this is true for all parts of each of records 1, 2 and 3 and no part of the records can be disclosed without providing detail as to the deliberations that took place during the meeting.

[26] The appellant submits that the substance of deliberations is not in any way revealed even in a general way in the agenda or minutes and, therefore, the deliberations were not substantive. He also submits that the presentation on the IT review would normally follow industry norms and practices and, therefore, would be very general in nature.

[27] The evidence before me is that during the closed session of the August 24, 2020 meeting, council discussed the IT system review. Record 1 is a covering memorandum addressed to council, which attaches record 2. Records 2 and 3 are respectively a presentation deck and a staff report, both of which relate to the IT system review. I understand that record 2 (the presentation deck) was presented to council during the closed session portion of the meeting while record 3 directly relates to the presentation and discussion of its contents. These discussions resulted in a decided course of action. I am unable to reveal more without revealing the actual content of the records.

[28] Having reviewed all of the materials and submissions before me, I accept the town’s assertion that disclosure of records 2 and 3 could be expected to reveal the substance of deliberation by council about its course of actions with respect to the IT system review at the closed session meeting. I find that the information in records 2 and 3 form both the subject and substance of deliberation and are intrinsically linked to council’s deliberations of August 24, 2020. In this regard, I find that the town has provided me with sufficient evidence to conclude that disclosure of records 2 and 3 would permit the drawing of accurate inferences about the substance[16] of council’s discussions. However, from my review, I find that while disclosure of record 1 (the covering memorandum addressed to council) would reveal the subject matter that was to be deliberated upon by council, it would not reveal the actual substance of those deliberations.

[29] As I find that the town has established that disclosure of records 2 and 3 would reveal the substance of the deliberations of council at the closed session meeting in question, these records qualify for exemption under section 6(1)(b) of the Act, subject to my finding on the town’s exercise of discretion below in Issue E.

Issue B: Does the discretionary exemption at section 8(1)(i) related to the security of a system apply to records 1, 4, 5 and 16?

[30] The town relies on section 8(1)(i) to withhold records 1, 2, 3, 4, 5 and 16. As I have upheld the town’s application of section 6(1)(b) to records 2 and 3, I do not need to consider the application of section 8(1)(i) to those two records.

Sections 8(1)(i) states:

A head may refuse to disclose a record if the disclosure could reasonably be expected to,

(i) endanger the security of a building or the security of a vehicle carrying items, or of a system or procedure established for the protection of items, for which protection is reasonably required;

[31] The exemption in section 8(1)(i) applies where the identified harm “could reasonably be expected to” result from disclosure of the record.

[32] Parties resisting disclosure of a record cannot simply assert that the harms under section 8 are obvious based on the record. They must provide detailed evidence about the risk of harm if the record is disclosed. While harm can sometimes be inferred from the records themselves and/or the surrounding circumstances, parties should not assume that the harms under section 8 are self-evident and can be proven simply by repeating the description of harms in the Act.[17]

[33] Parties resisting disclosure must show that the risk of harm is real and not just a possibility.[18] However, they do not have to prove that disclosure will in fact result in harm. How much and what kind of evidence is needed to establish the harm depends on the context of the request and the seriousness of the consequences of disclosing the information.[19]

[34] For section 8(1)(i) to apply, there must be a reasonable basis for concluding that disclosure of the information at issue could be expected to endanger the security of a building or the security of a vehicle carrying items, or of a system or procedure established for the protection of items, for which protection is reasonably required.

[35] Although this exemption is found in a section of the Act that deals primarily with law enforcement matters, it is not restricted to law enforcement situations. It can cover any building, vehicle, system or procedure that requires protection, even if those things are not connected to law enforcement.[20]

Parties’ representations

[36] The town explains that records 1, 4, 5 and 16 contain information identifying vulnerabilities in its IT system, reviewing the outcome of the IT system review report and highlighting weaknesses in its IT infrastructure. It argues that disclosure of this information would reveal the limitations of its IT infrastructure.

[37] The town also argues that individual(s) or organizations could use the information about its IT system’s vulnerabilities to breach its systems. Such breaches could result in accessing the personal information of its residents and employees, besides compromising the intellectual property of its contractors. It could also result in negative service disruptions for periods of time. The town argues that a breach would require it to expend significant resources on investigating and remediating the impacts of the breach, besides undermining the trust its residents have in it.

[38] In response, the appellant submits that section 8(1)(i) is found in a section that relates to exemptions in the context of law enforcement. He argues that the information contained in records 1, 4, 5 and 16 do not relate to anything that could be law enforcement. The appellant points out that there is no investigation activity here.

[39] The appellant submits that disclosure of the records would help determine whether the town’s expenditures on IT services are well managed. He argues that the alleged harm resulting from disclosure is pure speculation on the part of the town.

Analysis and finding

[40] To establish a valid exemption claim under section 8(1)(i), the town must provide detailed evidence to establish a “reasonable expectation of harm”. I have carefully reviewed records 1, 4, 5 and 16 which are withheld under section 8(1)(i) and find that disclosure of records 4 and 5 could reasonably be expected to result in the harms identified by the town.

[41] In making this determination, I have considered Order P-900, where the adjudicator considered whether section 14(1)(i)[21] (the provincial equivalent to section 8(1)(i)) was restricted to law enforcement matters. In that order, the adjudicator found that although “section 14(1)(i) is included in the section of the Act which specifically addresses law enforcement concerns, there is nothing in the section which indicates that it is restricted to law enforcement matters.” The adjudicator found that section 14(1)(i) did not refer to a law enforcement matter and therefore “this section relates to security for the protection of any building, vehicle or system for which such protection is reasonably required.” I agree with and adopt this reasoning for the purpose of this appeal.

[42] I have also considered Order MO-3728, where the adjudicator found that the disclosure of certain information in the records could reasonably be expected to permit individuals to interfere with the orderly operation of the city’s internet voting systems. The adjudicator accepted the City of Toronto’s claim that section 8(1)(i) applied to the withheld information which addressed potential vulnerabilities of the internet voting systems, along with steps to be taken to address those vulnerabilities. I agree with and adopt this reasoning for the purpose of this appeal.

[43] After reviewing records 4 and 5, I agree that they highlight the vulnerabilities of the town’s IT system, along with a summary of actions recommended to address those vulnerabilities, and, therefore, could reasonably be expected to allow individuals to interfere with the town’s IT system. I agree with the town that the section 8(1)(i) exemption applies to these records on the basis that the information contained in these records may be used for the purpose of attacking or breaching the town’s IT system.

[44] I find that the section 8(1)(i) exemption does not apply to records 1 and 16 as I do not accept that those records contain information about the vulnerabilities or weaknesses in the town’s IT system or recommended actions to be taken to address these vulnerabilities or weaknesses. As such, I am not satisfied that the disclosure of records 1 and 16 could reasonably be expected to endanger the security of the town’s IT system.

[45] Having regard to the above, I am satisfied that disclosure of records 4 and 5 qualify for exemption under section 8(1)(i), subject to my finding on the town’s exercise of discretion below in Issue E.

Issue C: Does the mandatory exemption at section 10(1) for third party information apply to records 7, 8, 16, 23 and 24?

[46] The town relies on section 10(1) to withhold records 4, 5, 7, 8, 16, 23 and 24. As I have upheld the town’s application of section 8(1)(i) to records 4 and 5, I do not need to consider the application of section 10(1) to those two records.

[47] The purpose of section 10(1) is to protect certain confidential information that businesses or other organizations provide to government institutions,[22] where specific harms can reasonably be expected to result from its disclosure.[23]

[48] The relevant portions of section 10(1) states:

A head shall refuse to disclose a record that reveals a trade secret or scientific, technical, commercial, financial or labour relations information, supplied in confidence implicitly or explicitly, if the disclosure could reasonably be expected to,

(a) prejudice significantly the competitive position or interfere significantly with the contractual or other negotiations of a person, group of persons, or organization;

[49] For section 10(1) to apply, the party arguing against disclosure must satisfy each part of the following three-part test:

1. the record must reveal information that is a trade secret or scientific, technical, commercial, financial or labour relations information;
2. the information must have been supplied to the institution in confidence, either implicitly or explicitly; and
3. the prospect of disclosure of the record must give rise to a reasonable expectation that one of the harms specified in paragraph (a), (b), (c) and/or (d) of section 10(1) will occur.

[50] All three parts of the three-part test must be met to establish the exemption.

[51] Parties resisting disclosure must establish a risk of harm from disclosure of the record that is well beyond the merely possible or speculative, but need not prove that disclosure will in fact result in such harm.[24]

[52] Parties should provide detailed evidence to demonstrate the harm. How much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences.[25] The failure of a party resisting disclosure to provide detailed evidence will not necessarily defeat the claim for exemption where harm can be inferred from the records themselves and/or the surrounding circumstances. However, parties should not assume that the harms under section 10(1) are self-evident or can be proven simply by repeating the description of harms in the Act.[26]

Parties’ representations

[53] The town submits that the disclosure of records 7, 8, 16, 23 and 24 could reasonably give rise to the section 10(1)(a) harms. It submits that disclosure could cause a chilling effect on the relationship between it and the affected parties and the relationship that those affected parties have with other clients.

[54] The town submits that disclosure could also reasonably be expected to prejudice the affected parties’ competitive position within the marketplace. It explains that the affected parties have established themselves as the forerunners in the technology consulting industry. The town submits that disclosure of the records at issue would prejudice their competitive positions in an unfair manner by providing competitors with knowledge of their costing structure, existing clients, and specifics of the services received by clients. It further submits that disclosure would provide competitors with direct insight into the work product affected party A provides its clients, effectively eliminating any competitive advantage entirely.

[55] Only affected party A provided representations. Its representations reiterated the submissions made by the town on the section 10(1)(a) harms.

[56] The appellant submits that the harms alleged are not self-evident. He submits that it is inconceivable how disclosure of the records at issue could have a chilling effect on the affected parties’ relationship with the town. The appellant also submits that there has been no history of the harms alleged being experienced by the town.

[57] The appellant submits that disclosure of the records at issue could not reasonably give rise to the section 10(1)(a) harms. He submits that product pricing sheets from large manufacturers and the standard network designs are fluid and changes occur rapidly in the IT marketplace and, as such, any perceived competitive advantage affected party A has are “ephemeral and fleeting”. The appellant submits that the information in the records at issue are mundane and ordinary. Finally, he submits that the design and framework/process to conduct a gap analysis or diagnostic to build a marketing proposal is widely available in generic form in the marketplace.

Analysis and findings

[58] To find that any of the section 10(1) harms could reasonably be expected to result from disclosure, I must be satisfied that there is a reasonable expectation of the specified harm. I can reach this conclusion either based on my review of the records at issue, the circumstances of this appeal, and/or the representations made by the parties.

[59] Based on my review of records 7, 8, 16, 23 and 24 and the representations of the town, the appellant and affected party A, I find that the town and affected party A have not established that disclosure of these records could reasonably be expected to result in the harms enumerated in section 10(1)(a) of the Act, or any of the other harms listed in section 10(1).

[60] The town argues that disclosure of the records at issue could cause a chilling effect on the relationship between it and the affected parties and the relationship that those affected parties have with their clients.[27] However, it does not provide sufficient evidence to substantiate this claim.

[61] The town also argues that disclosure could reasonably be expected to prejudice the affected parties’ competitive position within the marketplace. It submits that disclosure of the records at issue would prejudice their competitive positions in an unfair manner by providing competitors with knowledge of their costing structure, existing clients, and specifics of the services received by clients.

[62] In Order MO-2833, the adjudicator found that although a tender process may become more competitive in the future due to disclosure of pricing information, it does not significantly prejudice prospective proponents. I agree and adopt this reasoning for the purpose of this appeal.

[63] Similarly, I do not accept that the fact that the bidding process may become more competitive in the future due to disclosure of the costing structure of the affected parties would significantly prejudice the affected parties’ competitive position.

[64] With respect to records 23 and 24, which are proposals of affected parties B and C, I note that these two affected parties did not provide any representations. They have not established that disclosure of records 23 and 24 could reasonably be expected to result in any of the harms set out in section 10(1), including section 10(1)(a). On my review of these records, I find that the harm in their disclosure is not inferable on their face.

[65] Similarly, from my review of records 7, 8, [28]and 16, I also find that the harm in their disclosure is not inferable on their face. Record 7 is the workplan for the IT system review while record 8 is an email chain between the town and affected party A.[29] Record 16 is a final report for the Municipal Modernization Program prepared for the Ontario government by the town. Although affected party A provided representations, its representations did not specifically address how it would be harmed if these records were disclosed.

[66] I find that the town and affected party A’s representations fall short of the sort of detailed evidence that is required to establish part three of the test. Instead, their representations amount to speculation of possible harms in section 10(1)(a). I also find that the evidence they provided does not establish that disclosure could give rise to any of the other harms set out in section 10(1). As such, I find that part 3 of the test have not been met.

[67] All parts of the three-part test must be met for the mandatory exemption at section 10(1) to apply. Since the town and affected party A have not established part 3 of the section 10(1) test, I find that section 10(1) does not apply to exempt records 7, 8, 16, 23 and 24 from disclosure.

Issue D: Does the discretionary exemption at section 11 for economic and other interests apply to records 1 and 16?

[68] The town relies on section 11 to withhold records 1, 2, 3, 4, 5 and 16. As I have upheld the town’s application of section 6(1)(b) for records 2 and 3 and the town’s application of section 8(1)(i) for records 4 and 5, I do not need to consider the application of section 11 to those records. I will consider its application to records 1 and 16.

[69] The town relies on sections 11(c) and (d), which state:

A head may refuse to disclose a record that contains,

(c) information where the disclosure could reasonably be expected to prejudice the economic interests of an institution or the competitive position of an institution;

(d) information whose disclosure could reasonably be expected to be injurious to the financial interests of the Government of Ontario or the ability of the Government of Ontario to manage the economy of Ontario;

[70] The purpose of section 11 is to protect certain economic interests of institutions. Generally, it is intended to exempt commercially valuable information of institutions to the same extent that similar information of non-governmental organizations is protected under the Act. [30]

[71] The purpose of section 11(c) is to protect the ability of institutions to earn money in the marketplace. This exemption recognizes that institutions sometimes have economic interests and compete for business with other public or private sector entities, and it provides discretion to refuse disclosure of information on the basis of a reasonable expectation of prejudice to these economic interests or competitive positions.[31]

[72] For sections 11(c) and (d) to apply, the institution must provide detailed evidence about the potential for harm. It must demonstrate a risk of harm that is well beyond the merely possible or speculative although it need not prove that disclosure will in fact result in such harm. How much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences.[32]

[73] The failure to provide detailed evidence will not necessarily defeat the institution’s claim for exemption where harm can be inferred from the surrounding circumstances. However, parties should not assume that the harms under section 11 are self-evident or can be proven simply by repeating the description of harms in the Act.[33]

Parties’ representations

[74] The town submits that if records 1 and 16 are disclosed, it would negatively affect the town’s economic and financial interests. It explains that the records at issue contain information relating to its IT infrastructure, including details about the vulnerabilities in the town’s IT system that could possibly be exploited if disclosed. The town submits that a third party were able to access its IT system for nefarious reasons, it might be required to pay large sums of money to resolve the error and may be subject to legal action from any individuals whose information is accessed as a result.

[75] The town also submits that any potential data breaches could impact its ability to maintain and obtain insurance coverage for cyber risks.

[76] Finally, the town submits that a third party could access information on its IT infrastructure that is critical to its economic prosperity, such as information relating to resource allocation. It also submits that a third party could access information on its IT infrastructure, such as sensitive information, which would be injurious to its financial interests.

[77] In response, the appellant submits that the town has not made the case that there is a risk of harm to its commercial and economic interests.

Analysis and findings

[78] For sections 11(c) or (d) to apply, the town must demonstrate that disclosure of records 1 and 16 “could reasonably be expected to” lead to the specified result. To meet this test, the town must provide detailed evidence to establish a “reasonable expectation of harm”.

[79] The town argues that the records at issue contain information relating to its IT infrastructure, including details about the vulnerabilities in the town’s IT system that could possibly be exploited if disclosed. However, as mentioned above, record 1 is a covering memorandum addressed to members of council that attaches the presentation deck considered by council at a closed meeting (record 2).[34] It provides a high level summary of the town’s IT system review. From my review of its content, I do not accept that record 1 contains details about the vulnerabilities in the town’s IT system.

[80] As mentioned above, record 16 is the final report for the Municipal Modernization Program prepared for the Ontario government by the town. On my review, it does not contain details about the vulnerabilities in the town’s IT system or any information that, in my view, could reasonably be expected to lead to the harms contemplated by section 11(c) or (d).

[81] I have carefully reviewed records 1 and 16 together with the town’s representations on those records. I am not persuaded that the town has established that disclosure of these records could reasonably be expected to prejudice its economic interests or its competitive position or be injurious to the financial interests of the Government of Ontario or the ability of the Government of Ontario to manage the economy of Ontario. Accordingly, I find that records 1 and 16 are not exempt under sections 11(c) and 11(d) of the Act.

Issue E: Did the town exercise its discretion under sections 6(1)(b) and 8(1)(i)? If so, should I uphold the exercise of discretion?

[82] The exemptions in sections 6(1)(b) and 8(1)(i) are discretionary and permits an institution to disclose the information subject to the exemption despite the fact that it could withhold it. An institution must exercise its discretion. On appeal, the IPC may determine whether the institution failed to do so.

[83] The IPC may find the institution erred in exercising its discretion where, for example, it does so in bad faith or for an improper purpose; it takes into account irrelevant considerations or fails to take into account relevant considerations. In either case, this office may send the matter back to the institution for an exercise of discretion based on proper considerations.[35] However, the IPC may not substitute its own discretion for that of the institution.[36]

[84] The town submits that it properly exercised its discretion. Specifically, the town submits that it considered the appellant’s interest in receiving the records and the public interest in transparency but also its need for confidentiality. It also submits that it did not apply a blanket approach to the exemptions but disclosed as much of the records as possible to the appellant. The town submits that it further considered that the potential harm from disclosure outweighed any public interest in disclosure.

[85] The appellant submits that the town has not properly exercised its discretion. He submits that the town has treated all discretionary exemptions as mandatory as is its usual practice in any access request. He submits that the town does not believe in the right of access to information or the objectives of the Act.

[86] Based on my review of the town’s representations and the nature and content of records 2, 3, 4, and 5, I find that the town properly exercised its discretion to withhold these records pursuant to the discretionary exemptions at sections 6(1)(b) and 8(1)(i) of the Act. I note that the town took into account the following relevant considerations: the nature of the information, the wording of the exemptions and the interests it seeks to protect. I am also satisfied that the town did not consider any irrelevant considerations or acted in bad faith or for an improper purpose. Accordingly, I uphold the town’s exercise of discretion in deciding to withhold records 2, 3, 4 and 5 pursuant to the section 6(1)(b) exemption and the 8(1)(i) exemption.

ORDER:

1. I uphold the town’s application of section 6(1)(b) for records 2 and 3.
2. I also uphold the town’s application of section 8(1)(i) for records 4 and 5.
3. I order the town to disclose records 1, 7, 8, 16, 23 and 24 to the appellant by April 10, 2024 but not before April 3, 2024.

4. In order to verify compliance with this order, I reserve the right to require the town to provide me with a copy of the records disclosed to the appellant upon request.

Original signed by:		March 6, 2024
Lan An
Adjudicator