ORDER MO-4599

Appeal MA20-00339

York Regional Police Services Board

November 26, 2024

Summary: The records in this appeal relate to the police’s procurement and use of facial recognition technology. The police denied access to approximately 4,000 pages of records, claiming several exemptions under the Act . During the inquiry, the individual who asked for the records raised the application of the public interest override. In this order, the adjudicator finds that a number of records are exempt from disclosure and the public interest override does not apply to these records. She also finds that several records are not exempt from disclosure and she orders these to be disclosed to the individual who requested them.

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. M.56 , as amended, sections 2(1) (definition of personal information), 8(1)(c), 8(2)(a), 10(1)(a), 11(a), 11(b), 11(c), 12, 14(1) and 16.

Orders Considered: Order MO-4286.

OVERVIEW:

[1] This order addresses the issues raised as a result of an appeal of an access decision made under the Municipal Freedom of Information and Protection of Privacy Act  (the Act ) by the York Regional Police Service (the police). The access request was for records relating to the use of Clearview AI’s facial recognition technology, as well as records related to the police’s subsequent process for the procurement of facial recognition technology.

[2] The police identified five records (the Index A records) relating to the police’s use of Clearview AI’s facial recognition technology, and issued a decision denying access to them, claiming the application of the discretionary exemption in section 8(2)(a) (law enforcement report) and the mandatory exemption in section 14(1) (personal privacy) of the Act . The police also denied “access to any records that may exist at this time regarding the procurement process that is not availably publicly….” The police advised the requester that they were claiming the mandatory exemption in section 10(1) (third party information) to deny access to the procurement records.

[3] The requester, now the appellant, appealed the police’s decision to the Information and Privacy Commissioner of Ontario (the IPC).

[4] During the mediation of the appeal, the police located 337 procurement records (the Index B records) and issued a revised decision to the appellant, denying access to them. The police claimed the application of the mandatory exemptions in sections 10(1) (third party information) and 14(1) (personal privacy), as well as the discretionary exemptions in sections 8(1)(c) (law enforcement techniques and procedures), 11(a), (c) and (d) (economic and other interests) and 12 (solicitor-client privilege). At the conclusion of mediation, with respect to the exemption in section 11, the sections at issue were identified as sections 11(a), (b) and (c).

[5] The appellant confirmed that he seeks access to all of the Index A records and all but two of the Index B records,[1] and that the police should not be able to raise discretionary exemptions – sections 8(1)(c), 11 and 12 - after 35 days of being notified of the appeal. Whether the police are able to raise discretionary exemptions late was added as an issue in the appeal.

[6] The appeal was then transferred to the adjudication stage of the appeals process where an adjudicator may conduct an inquiry. The adjudicator originally assigned to the appeal sought representations from the police, the appellant, and four third parties (the affected parties). The police, the appellant and two affected parties submitted representations, which were shared amongst them in accordance with the IPC’s confidentiality criteria as set out in IPC Practice Direction Number 7.[2] In his representations, the appellant raised the application of the public interest override in section 16, which was added as an issue in this appeal. As a result, the adjudicator provided the police and the affected parties with the opportunity to provide representations on the public interest override. The police and two affected parties provided representations on this issue and the appellant was given the opportunity to reply to them, which he did.

[7] The appeal was then transferred to me to complete the inquiry. Upon review of the file and the representations of the parties, I decided not to seek further representations, with one exception relating to the issuance of the IPC’s new Code of Procedure on September 9, 2024, which I discuss under the heading Preliminary Issue.

[8] In this order, I make the following findings:

• I exceptionally allow the police to raise discretionary exemptions outside of the 35-day window for doing so,
• I find that all of the Index A records contain the personal information of identifiable individuals other than the appellant,
• I find that the Index A records are exempt from disclosure under the sections 8(2)(a) and 14(1) exemptions,
• I find that none of the Index B records contain personal information and that the section 14(1) exemption cannot apply to them,
• I find that certain Index B records are exempt from disclosure under sections 8(1)(c), 10(1)(a), 11(c) and/or 12,
• I uphold the police’s exercise of discretion in withholding records I have found to be exempt under sections 8(1)(c), 8(2)(a), 11(c) and 12,
• I find that the public interest override in section 16 does not apply to the information I have found to be exempt from disclosure under sections 10(1)(a) and 11(c), and
• I order the police to disclose to the appellant the remaining Index B records that I have found not to be exempt from disclosure.

RECORDS:

[9] Index A - there are five records totalling 58 pages relating to the use of facial recognition software provided by Clearview AI. These records consist of notes, reports and an email. Records 1 to 5 have been withheld in their entirety under the personal privacy exemption at section 14(1); records 1 to 4 have also been withheld under the law enforcement exemption at section 8(2).

[10] Index B - there are 337 records (approximately 3872 pages)[3] relating to the procurement of facial recognition software, consisting of non-disclosure agreements for the procurement team and for vendors, the RFP in draft and final versions, RFP instructions, vendor submissions, security requirements, project status reports, responses to RFPs with appendices, internal and external email correspondence, vendor contracts, demonstrations, evaluations of proposals and scorings, meeting minutes, internal and external power point presentations, and briefing documents. The police are claiming the exemptions in sections 8(1)(c), 10(1)(a), 11(a), (b) and (c), and 12 to these records.[4]

ISSUES:

Preliminary Issue: Should the IPC permit the police to claim new discretionary exemptions for the Index B records outside of the 35-day window for doing so?

1. Do any of the records contain “personal information” as defined in section 2(1) and, if so, whose personal information is it?
2. Does the mandatory personal privacy exemption at section 14(1) apply to any of the Index A records for which it was claimed?
3. Does the mandatory exemption for third party information at section 10(1) apply to any of the records?
4. Does the discretionary solicitor-client privilege exemption at section 12 apply to any of the records?
5. Do either of the discretionary law enforcement exemptions at section 8(1)(c) or 8(2)(a) apply to any of the records?
6. Does the discretionary exemption at section 11 for economic and other interests of the police apply to any of the records?
7. Did the police exercise their discretion under sections 8, 11 and/or 12? If so, should the IPC uphold the exercise of discretion?
8. Does the public interest override provision at section 16 apply to require the disclosure of any of the records?

DISCUSSION:

Preliminary Issue: Should the IPC permit the police to claim new discretionary exemptions for the Index B records outside of the 35-day window for doing so?

[11] As previously stated, during mediation, the police identified 337 more responsive records relating to the procurement of facial recognition software – the Index B records. They issued a supplementary decision, denying access to these newly located records under section 10(1), as previously claimed, and also under the discretionary exemptions in sections 8(1)(c), 11 and 12, which are exemptions that they had not previously relied upon to deny access to the other responsive records.

[12] The appellant challenged the police’s raising of the newly claimed discretionary exemptions, taking the position that it should not be permitted to raise new discretionary exemptions at this late stage of the appeal. As will be described below, IPC procedure dictates that, as a general rule, institutions may only raise new discretionary claims within 35 days of being notified of the appeal. For the reasons that follow, I find that the police are permitted to raise sections 8(1)(c), 11 and 12 in this case, despite the fact that these exemptions were raised outside of the 35-window for doing so.

[13] If an exemption is discretionary,[5] as are sections 8(1)(c), 11 and 12, the institution can choose to withhold the information, but it can also choose to disclose it.

[14] In the Notice of Inquiry, the parties were invited to consider and provide representations on any prejudice or compromise to the integrity of the appeal process caused by the police’s late raising of the discretionary exemptions. Only the police made submissions on the issue of the late raising of new discretionary exemptions by them.

[15] After the conclusion of the inquiry, the IPC issued a new Code of Procedure (the Code), which came into force on September 9, 2024. The Code provides basic procedural guidelines for parties involved in appeals before the IPC. Sections 12.01 and 12.02 of the Code address circumstances where institutions seek to raise new discretionary exemption claims during an appeal. Although the previous code also permitted the late raising of new discretionary exemptions after the 35-day limit, the new Code is more explicit in stating that such circumstances must be exceptional. The police and the appellant were provided with the opportunity to provide further representations on the application of sections 12.01 and 12.02 of the new Code to the police’s late raising of the discretionary exemptions they claimed. Neither the police nor the appellant provided further representations.

[16] Sections 12.01 and 12.02 of the Code state:

12.01 In an Appeal, an Institution may make a new discretionary exemption claim only within 35 days after the Institution is notified of the Appeal by the IPC. A new discretionary exemption claim made within this period shall be contained in a revised written decision sent to the person making the Request and to the IPC.

12.02 If the Appeal moves to Adjudication, the Adjudicator may decide in exceptional circumstances to consider a new discretionary exemption claim made after the 35-day period.[6]

[17] The purpose of the policy is to provide an opportunity for institutions to raise a new discretionary exemption without compromising the integrity of the appeal process. Where an institution is aware of the 35-day rule, disallowing a discretionary exemption claimed outside the 35-day period is not a denial of natural justice.[7]

[18] In deciding whether exceptional circumstances are present that allow an institution to claim a new discretionary exemption outside the 35-day period, the adjudicator must balance the relative prejudice to the institution and to the requester in terms of delay.[8] The specific circumstances of the appeal must also be considered in making this decision.[9]

Representations

[19] The police submit that they would be prejudiced by not allowing them to apply additional discretionary exemptions in the circumstances of this appeal. They explain that they were unfamiliar with requests for procurement records as those types of requests are generally dealt with by the Police Services Board, rather than the service itself and therefore, the identification and collection of records was not routine. They note that the procurement team was hesitant to provide the records due to the confidentiality agreements and solicitor-client privilege. The police also note that the appellant did not reveal his reasons for requesting the records and suggest that had it done so, they may have been able to direct him to another process. The police also submit that the records were voluminous and their collection took several weeks because COVID-19 restrictions affected the ability for staff to work in the office and in turn, affected the time taken to respond and access the responsive records.

[20] The police further submit that allowing them to claim the additional discretionary exemptions would not compromise the appeal process. They submit that they worked diligently with the IPC to mediate this appeal and assist the appellant. They submit that they tried their best to meet the time limits despite the type and volume of records.

[21] The appellant’s representations did not address this issue.

Analysis and findings

[22] Based on my review of the circumstances in this appeal, I have decided to permit the police to claim the additional discretionary exemptions in sections 8(1)(c), 11, and 12 outside the 35-day period provided for in the Code. I am persuaded that given the circumstances of this appeal, allowing the police to claim the additional discretionary exemptions would not cause prejudice to the appellant relative to the institution in terms of delay, nor compromise the integrity of the appeal.

[23] In the specific circumstances of this appeal, the request was received and processed during the peak of the COVID-19 pandemic, a situation outside of the police’s control that directly affected the processing of the request.

[24] In deciding whether these circumstances warrant allowing the late raising of discretionary exemptions, I must consider whether doing so would prejudice the appellant in terms of delay. The appellant was able to fully participate in both the mediation and adjudication stages of this appeal; the appellant was aware of the newly raised exemption claims during mediation and prior to providing representations at adjudication. Therefore, he was provided with a reasonable opportunity to attempt to mediate and, later, provide his views on the applicability of the newly raised exemptions to the records for which they were claimed. The addition of these discretionary exemptions did not delay any disclosure of the records to the appellant because the police had already made overlapping claims that the mandatory exemption in section 10(1) applied to them.

[25] I must also consider the potential prejudice to the police if I deny the late raising of these exemptions. In this appeal, I must consider the importance and significance of the law enforcement exemption at section 8(1)(c),[10] the economic interests of an institution exemption at section 11,[11] and the solicitor-client privilege exemption at section 12, which is a substantive right at common law codified in the Act .[12] I find that the prejudice that might be caused by not allowing the police to claim these three exemptions outweighs any prejudice that might result from their late raising and that there are therefore exceptional circumstances present to permit the police to raise these claims.

[26] Although I am exceptionally permitting the police to raise the additional discretionary exemptions, to be clear, it is not based on the police’s submission that had the appellant revealed his reasons for requesting the records, they may have been able to direct him to another process. Under the Act, requesters are not obliged to provide a reason for requesting access to records. As a result, I do not accept that police’s suggestions that the appellant’s failure to provide a reason for his request supports a conclusion that the late raising of discretionary exemptions should be permitted in such circumstances. Neither am I permitting the police to raise these discretionary exemptions due to the volume of records. The police have at their disposal tools in the Act  to obtain additional time to properly process requests.

[27] Based on my reasoning above, and given the totality of the circumstances, I will exceptionally allow the police to raise the discretionary exemptions at sections 8(1)(c), 11 and 12, despite the fact that these exemptions were raised outside of the 35-window for doing so. As a result, I will consider their application to the records for which they were claimed in this order.

Issue A: Do any of the records contain “personal information” as defined in section 2(1) and, if so, whose personal information is it?

[28] In order to determine whether the mandatory personal privacy exemption at section 14(1)  of the Act  applies, I must first consider whether the records for which it was claimed contain “personal information” and if so, to whom the personal information relates. The police claim that section 14(1) applies to records 1-5 of Index A and records 14-18, 112,[13] 280 and 331-336 of Index B. For the following reasons I agree with the police regarding Records 1-5 of Index A. However, for all of records 14-18, 112, 280 and 331-336 of Index B, I disagree and find that they do not contain information that qualifies as personal information. I explain below.

[29] Section 2(1)  of the Act  defines “personal information” as “recorded information about an identifiable individual.” Information is “about” the individual when it refers to them in their personal capacity, which means that it reveals something of a personal nature about the individual. Generally, information about an individual in their professional, official or business capacity is not considered to be “about” the individual.[14]

[30] Section 2(1)  of the Act  gives a list of examples of personal information, including, information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual [paragraph (a)], identifying numbers assigned to an individual [paragraph (c)], the address, telephone number, fingerprints or blood type of the individual [paragraph (d)], and the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual [paragraph (h)].

[31] The list of examples of personal information under section 2(1) is not a complete list; other kinds of information that reveal something personal about an individual are also “personal information.”[15]

[32] Although both parties submitted representations, the appellant did not make representation addressing whether any of the records contain personal information.

Index A – Records 1-5

[33] The police submit and I agree that records 1-5 of Index A all contain information that qualifies as personal information within the meaning of the definition at section 2(1)  of the Act .

[34] The police submit that these records were generated by members of the police who used a 30-day free trial of Clearview AI’s facial recognition web-based application software. The police further submit that the records include reports prepared by either members who had used the software themselves or by their superiors who reported on the use of the software to the Chief of Police. The police submit that the reports describe how the software was used as an investigative tool during a number of fraud investigations and include references to specific elements of the investigations, including personal information of involved individuals, some of whom were victims of identity fraud.

[35] The police submit that the personal information in these records includes names, images, employment information, addresses, dates of birth, sex, driver licence number and email addresses of the individuals described above.

[36] From my review, it is clear that 43 pages of records 1-5 contain a significant amount of personal information of identifiable individuals. In describing how the software was used in several investigations, the reports include many details about identifiable individuals considered to be either suspects or victims in the investigation; the information includes photographs, photocopies of drivers’ licences’ and other recorded information, the disclosure of which would reveal personal information about identifiable individuals including their names, dates of birth, sex, race, addresses, and drivers’ licence numbers. Additionally, the identification of an individual by name in these reports would reveal other personal information about them, namely that they were involved in some manner, in a police investigation. I further note that of the 58 pages of Index A records, 43 of these pages, in their entirety, contain personal information.

[37] Accordingly, I accept that records 1-5 of Index A all contain personal information within the meaning of the definition in section 2(1)  of the Act , in particular, the types contemplated by paragraphs (a), (c), (d) and (h) of the definition. I will consider whether these records are exempt under section 14(1) below.

Index B – Records 14-18, 112, 280 and 331-336

[38] The police also submit that within the procurement records identified in Index B, records 14-18, 112, 280 and 331-336 contain the personal information of the procurement team. As I set out below, I disagree with the police that these records contain personal information within the meaning of the definition of that term in section 2(1)  of the Act .

[39] For these records, the police submit that although the members were acting in their business capacity, some of the information in these records qualifies as personal information “as it relates to their work responsibilities, work schedules, team members and assignments.”

[40] Records 14-18 are emails that indicate that certain individuals accepted meeting invites for meetings in particular rooms on particular dates regarding the facial recognition RFP project. Record 112 is an email to the individuals assigned to the Facial Recognition Project with a link to work schedules.[16] Record 280 is an email between employees in the IT and Procurement departments regarding the assignment of a particular individual as an evaluator for the facial recognition RFP project. Record 331 is an email enclosing a draft copy of a Memorandum of Understanding between the York Regional Police and Peel Regional Police. Records 332-336 are emails from the York Regional Police Service Desk to procurement members regarding work orders that were either received or completed. In my view, none of these records contain information that qualifies as personal information within the meaning of the definition of that term in section 2(1)  of the Act  as all of this information relates to the individuals in their professional capacity and the specific information at issue is related to their work, and would not reveal anything of a personal nature about them.

[41] As I have found that records 14-18, 112, 280, 331, and 332-336 do not contain the personal information of identifiable individuals, the exemption at section 14(1) cannot apply to them. The police claimed only section 14(1) for record 112. As section 14(1) cannot apply to a record that does not contain personal information, I will order the police to disclose record 112 to the appellant. The police have claimed that other exemptions apply to records 14-18, 280 and 331-336. Therefore, their disclosure remains at issue, and I will discuss them below under the other exemption claims relevant to each record.

Issue B: Does the mandatory personal privacy exemption at section 14(1) apply to any of the Index A records for which it was claimed?

[42] Of the information claimed to be personal information by the police, I have found above that only records 1 to 5 of Index A contain personal information. I will therefore go on to consider whether section 14(1) applies to any of these records or portions of these records.

[43] One of the purposes of the Act  is to protect the privacy of individuals with respect to personal information institutions hold about them. Section 14(1)  of the Act  creates a general rule that an institution cannot disclose personal information about another individual to a requester. This general rule is subject to a number of exceptions.[17]

[44] At issue here is the exception at section 14(1)(f). This exception requires the institution to disclose another individual’s personal information to a requester if disclosure would not be an “unjustified invasion of personal privacy.” Determining whether disclosure is an unjustified invasion of personal privacy requires an assessment of the various factors and presumptions found in sections 14(2) and (3).[18]

[45] I begin with section 14(3). Sections 14(3)(a) to (h) outline several situations where disclosing personal information is presumed to be an unjustified invasion of personal privacy. The Divisional Court has found that if one of these presumptions applies, the personal information is exempt from disclosure under section 14(1) unless the information falls within one of the paragraphs in section 14(4) or the public interest override at section 16 applies. (I address these further below).[19]

[46] The police argue that the presumption at section 14(3)(b) applies. This provision states:

A disclosure of personal information is presumed to constitute an unjustified invasion of personal privacy if the personal information,

was compiled and is identifiable as part of an investigation into a possible violation of law, except to the extent that disclosure is necessary to prosecute the violation or to continue the investigation[.]

[47] The presumption requires only that there be an investigation into a possible violation of law.[20] Even if criminal proceedings were never started against any individual, section 14(3)(b) may still apply.[21]

Representations

[48] The police submit that the disclosure of the personal information at issue would constitute an unjustified invasion of personal privacy, as per the presumption in section 14(3)(b). In particular, the police submit that the records contain information that was initially compiled as part of an investigation conducted by them into possible violations of the Criminal Code of Canada , namely the violations of Fraud and Identity Theft.

[49] The appellant’s representations do not address the section 14(1) exemption.

Analysis and findings

[50] I have reviewed the personal information at issue and I am satisfied, based on the police’s representations and my review of the records themselves, that the presumption in section 14(3)(b) applies to this personal information because it was compiled and is identifiable as part of an investigation into a possible violation of the Criminal Code of Canada . As stated above, if one of the presumptions in section 14(3) applies, the personal information is exempt from disclosure under section 14(1) unless the information falls within one of the paragraphs in section 14(4), or unless the public interest override applies.

[51] I find that none of the personal information at issue falls within one of the paragraphs in section 14(4) and therefore, subject to my discussion of the public interest override under Issue H, I find that this personal information is exempt from disclosure under section 14(1). With respect to whether the personal information can be severed from these Index A records, even if I were to order it severed, the police have claimed the exemption in section 8(2)(a) applies to the remaining information in these records (15 pages), which I consider in Issue E.

Issue C: Does the mandatory exemption for third party information at section 10(1)(a) apply to any of the records?

[52] The police claim that Index B records 1-10, 14-18, 33, 39-44, 52, 56, 62-64, 68, 69, 71-75, 77-84, 86-89, 94-96, 103, 118-121, 123-125, 127, 128, 131, 133, 135, 138, 139, 141, 145-147, 168, 169, 172, 174-176, 178, 192, 195, 198, 202, 203, 205-207, 210-214, 218, 224-226, 230, 231, 235, 256, 257, 262, 272, 273, 284, 285, 289, 296, 311, 313, 314, 317-325, 330-336 are exempt from disclosure under section 10(1) (a) of the Act . For the reasons that follow, I find that some of these records are exempt from disclosure under section 10(1)(a).

[53] Section 10(1) is designed to protect the confidential “informational assets” of businesses or other organizations that provide information to government institutions.[22] Although one of the central purposes of the Act  is to shed light on the operations of government, section 10(1) serves to limit disclosure of confidential information of third parties that could be exploited by a competitor in the marketplace.[23]

[54] The police submit, and the affected parties agree that section 10(1)(a) applies to the records identified above. That section states:[24]

A head shall refuse to disclose a record that reveals a trade secret or scientific, technical, commercial, financial or labour relations information, supplied in confidence implicitly or explicitly, if the disclosure could reasonably be expected to,

prejudice significantly the competitive position or interfere significantly with the contractual or other negotiations of a person, group of persons, or organization[.]

[55] For section 10(1) to apply, the party arguing against disclosure must satisfy each part of the following three-part test:

1. The record must reveal information that is a trade secret or scientific, technical, commercial, financial or labour relations information;
2. The information must have been supplied to the institution in confidence, either implicitly or explicitly; and
3. The prospect of disclosure of the record must give rise to a reasonable expectation that one of the harms specified in paragraph (a), (b), (c) and/or (d) of section 10(1) will occur.

[56] Section 42  of the Act  provides that where an institution refuses access to a record or part of a record, the burden of proof that a record or part of it falls within one of the specified exemptions in the Act  lies upon the institution. Previous orders of the IPC have held that when a third party relies upon the exemption provided by section 10(1)  of the Act , the third party shares with the institution the onus of proving that the exemption applies to the record (or part of it) that is at issue.[25]

Representations

[57] The police submit that the records for which it claimed this exemption consist of non-disclosure agreements, vendor submissions, responses to RFPs with appendices, security requirements, contracts, demonstrations, and evaluations and scorings of proposals. The police submit that these records contain both commercial and/or technical information because they were created for the purpose of entering into a commercial agreement, containing pricing information, as well as technical information such as product specifications, its installation and its maintenance.

[58] The police further submit that the information in the records was supplied explicitly in confidence to the police by the affected parties and that these parties had a reasonable expectation that the information would be kept confidential. The police note that there is a confidentiality provision in the RFP, and that all parties involved in the procurement process signed confidentiality agreements.

[59] With respect to part three of the test in section 10(1), the police submit that the disclosure of the technology initiatives and the vendor’s submissions in the records could reasonably be expected to prejudice significantly the competitive position of these vendors and interfere significantly with their negotiating powers.

[60] One of the affected parties submits that it is a for-profit commercial company specializing in biometric technology, and this technology is largely algorithmic in nature. The affected party further submits that the algorithms, methods and implementing code qualifies as confidential scientific, technical and trade secret information, the disclosure of which would compromise its competitive advantage in the global marketplace. The affected party goes on to state:

. . . [I]ts proposal further contains sensitive commercial information that it does not publish, but was provided in response to the Government’s solicitation for proposals with the expectation that the response would be treated as confidential as provided for in the RFP; and that the prospect of disclosing the records would give rise to a reasonable expectation that their release would prejudice significantly the affected party’s competitive position or interfere significantly with the contractual or other negotiations or a person, group of persons, or organization.

[61] The second affected party submits that it agrees to disclose the records relating to its proposal, with the exception of certain sections.[26] The second affected party further submits that the information it objects to disclosing contains confidential details of the components and features of its hardware and software offering in the proposal, and that the disclosure of this information could reasonably be expected to result in material financial loss and prejudice to its competitive position in the very competitive market of facial recognition solutions.

[62] In his representations, the appellant does not address the application of this exemption to the records at issue.

Analysis and findings

[63] As stated above, for the third party information exemption in section 10(1) to apply, the party resisting disclosure must establish that all three parts of the test are met. I have considered the parties’ representations and reviewed the records at issue.

Part One – type of information

[64] With respect to part one of the three-part test in section 10(1), I am satisfied that most of the records for which the police have claimed section 10(1)(a) contain information that qualifies as either commercial or technical information for the purposes of section 10(1). These two types of information are described as follows:

Technical information is information belonging to an organized field of knowledge in the applied sciences or mechanical arts. Examples of these fields include architecture, engineering or electronics. Technical information usually involves information prepared by a professional in the field, and describes the construction, operation or maintenance of a structure, process, equipment or thing.[27]

Commercial information is information that relates only to the buying, selling or exchange of merchandise or services. This term can apply to commercial or non-profit organizations, large or small.[28] The fact that a record might have monetary value now or in future does not necessarily mean that the record itself contains commercial information.[29]

[65] In particular, I find that most of the records contain commercial information because they relate to the proposed buying and selling of a facial recognition system to the police by the affected parties. Further, I find that most of the records also contain technical information because they describe the operation, maintenance and process of their respective facial recognition systems. As a result, all of the Index B records[30] with the exception of records 14-18, 62 and 148-164 have met the first part of the three-part test and I will go on to consider whether the second and third parts of the test have been met with respect to them.

[66] As for Index B records 14-18 and 62, I find that they contain neither commercial nor technical information. They consist of emails or in the case of record 62 a screenshot. I find that these records consist solely of communications of an administrative nature amongst police staff, for example, responding to a meeting request. There is no content in these records that would qualify as either commercial or technical information. As a result, I find that these records do not meet part one of the three-part test and are, therefore, not exempt from disclosure under section 10(1)(a). I note that other exemptions have been claimed with respect to these records, which I consider below.

Part Two – supplied in confidence

[67] With respect to part two of the three-part test, there is a requirement that the information has been “supplied in confidence” to the institution. This requirement reflects the purpose in section 10(1) of protecting the informational assets of third parties.[31]

[68] Information may qualify as “supplied” if it was directly supplied to an institution by a third party, or where its disclosure would reveal or permit the drawing of accurate inferences with respect to information supplied by a third party.[32]

[69] The party arguing against disclosure must show that both the individual supplying the information and the recipient expected the information to be treated confidentially, and that their expectation is reasonable in the circumstances. This expectation must have an objective basis.[33]

[70] Relevant considerations in deciding whether an expectation of confidentiality is based on reasonable and objective grounds include whether the information:

• was communicated to the institution on the basis that it was confidential and that it was to be kept confidential,
• was treated consistently by the third party in a manner that indicates a concern for confidentiality,
• was not otherwise disclosed or available from sources to which the public has access, and
• was prepared for a purpose that would not entail disclosure.[34]

[71] As previously stated, I have reviewed the records at issue. I find that some of the Index B records qualify as having been “supplied in confidence” for the purposes of the second part of the test in section 10(1), while others do not. I find that the records that meet the second part of the three-part test[35] were either supplied directly by the affected parties to the police in their responses to the RFP for the provision of facial recognition technology or would reveal information that was contained in the proposals. I further find that two of these records were supplied by another third party police service to the police regarding facial recognition. I am also satisfied that the information that was supplied to the police by the affected parties and the third party police service was done so in confidence and with a reasonable expectation that this information would remain confidential. As a result, I find that these records contain information that meets the requirements of the second part of the three-part test and I will go on to consider whether the harms part of the test is met with respect to them.

[72] I further find that the remaining Index B records[36] for which the police claimed section 10(1) do not meet the second part of the three-part test because I have not been provided with sufficient evidence either in the representations or on my review of the records themselves that they were supplied by the affected parties or any other third party to the police. Instead, I find that some of the these records were created by the police and do not contain information that had been supplied by the affected parties, such as a list of the name of vendors who provided proposals in response to the RFP, unsigned confidentiality and non-disclosure agreements, scoring sheets of the proposals submitted in response to the RFP, project status reports, timetables, questions to be posed to the affected parties, briefing documents prepared for the affected parties, and emails relating to these records. I find that other records consist of agreements that were negotiated between the police and third parties, such as signed confidentiality and non- disclosure agreements and policy provisions. In both cases, I find that these records do not contain information that was “supplied” by third parties to the police. As a result, I find that the second part of the three-part test has not been met with respect to these records and they are not exempt from disclosure under section 10(1). I note that the police have claimed further exemptions with respect to these records, which I consider below.

Part Three - harms

[73] Concerning the third part of the test, the party resisting disclosure cannot simply assert that the harms under section 10(1) are obvious based on the record. They must provide detailed evidence about the risk of harm if the record is disclosed.

[74] Harm can sometimes be inferred from the records themselves and/or the surrounding circumstances, but parties should not assume that the harms under section 10(1) are self-evident so that they can be proven simply by repeating the description of harms in the Act .[37] The amount and kind of evidence needed to establish the harm depends upon the context of the request and the seriousness of the consequences of disclosing the information.[38]

[75] Recently, in Liquor Control Board of Ontario v. Ontario (Information and Privacy Commissioner),[39] the Court of Appeal reaffirmed the governing principles surrounding the “could reasonably be expected to” standard of proof required under the Act  which was previously articulated by the Supreme Court of Canada in relation to access to information statutes.[40] The Supreme Court found that the reasonable expectation of probable harm standard should be used wherever the “could reasonably be expected to” language is used, and that this standard attempts to establish a middle ground between harm that is probable and harm that is merely possible.

[76] Applying the standard set out in LCBO, I find that the harms in section 10(1)(a) have been met with respect to Index B records 1-8, 39-41, 43-44, 48-51, 64, 103, 145, 178, 262, 284, 314-315 and 318-320 in whole. I also find that the harms test in section 10(1)(a) applies to records 10, 12-13, 42, 71-74, 77, 79, 81-82, 84, 86-87, 118-121, 128, 147, 168, 172, 174-176, 207-208, 272, 311, 317 and 321-325, but only in part.

[77] I find that the police and the affected parties have provided sufficient evidence that the disclosure of some or all of the information contained in these records could reasonably be expected to cause the harms set out in section 10(1)(a), namely that the disclosure of the information would prejudice significantly the competitive position or interfere significantly with the contractual or other negotiations of the affected parties. I find that some of this information could be used by a competitor in future proposals in response to RFPs. I find that the nature of the technical information regarding facial recognition technology is so detailed that it is reasonably expected that it could be used wholesale by competitors, causing significant prejudice to the competitive position of the affected parties. As a result, I find that the third part of the three-part test has been met with respect to this information. It is therefore exempt from disclosure under section 10(1).

[78] The appellant has raised the possible application of the public interest override in section 16 to the records that I have found to be exempt under section 10(1)(a), which I consider under Issue H.

[79] The police have claimed the application of sections 8(1)(c) and/or 11(a), (b) and (c) to the records either in whole or in part that I have found not to be exempt under section 10(1), which I consider under Issues E and F.

Issue D: Does the discretionary solicitor-client privilege exemption at section 12 apply to any of the records?

[80] Based on my review of the records, I find that the solicitor-client privilege exemption in section 12 applies to Index B records 48-51, 129, 132, 134, 173, 177, 179-181, 185-186, 188-190, 195, 197, 246-249, 253-258, 268, 273, 278, 286 and 290-291, subject to my review of the police’s exercise of discretion, for the reasons that follow.

[81] Section 12 exempts certain records from disclosure, either because they are subject to solicitor-client privilege or because they were prepared by or for legal counsel for an institution. It reads:

A head may refuse to disclose a record that is subject to solicitor-client privilege or that was prepared by or for counsel employed or retained by an institution for use in giving legal advice or in contemplation of or for use in litigation.

[82] Section 12 contains two different exemptions, referred to in previous IPC decisions as “branches.” The first branch (“subject to solicitor-client privilege”) is based on common law. The second branch (“prepared by or for counsel employed or retained by an institution…”) is a statutory privilege created by the Act . The police must establish that at least one branch applies.

Representations

[83] The police submit that the procurement process for the police is overseen by Senior Counsel of the Regional Municipality of York who approves all contracts that involve “technology and risk.” They submit that “[s]everal of the documents prepared in relation to the procurement of the FRS by [the police] were forwarded to the Senior Counsel for legal review and consultation.” The police also submit that several of the emails contained in the records passed between the procurement team and the Senior Counsel for the purpose of seeking legal advice or opinion in relation to the content of the records, the RFP and non-disclosure agreements.

[84] The appellant does not make any representations that address the possible application of section 12 and solicitor-client privilege.

Analysis and findings

[85] For the following reasons, I find that the common law branch of the solicitor-client communication privilege applies to all of the records for which section 12 was claimed.

[86] The rationale for the common law solicitor-client communication privilege is to ensure that a client may freely confide in their lawyer on a legal matter.[41] This privilege protects direct communications of a confidential nature between lawyer and client, or their agents or employees, made for the purpose of obtaining or giving legal advice. [42]The privilege covers not only the legal advice itself and the request for advice, but also communications between the lawyer and client aimed at keeping both informed so that advice can be sought and given.[43] The privilege may also apply to the lawyer’s working papers directly related to seeking, formulating or giving legal advice.[44]

[87] Confidentiality is an essential component of solicitor-client communication privilege. For the privilege to apply, the communication must have been made in confidence, either expressly or by implication.[45]

[88] I find that the records at issue consist of email communications between police staff and the police’s in-house legal counsel in which information and documents are provided to legal counsel for the purpose of seeking and obtaining legal advice, as well as for the purpose of reviewing documents. In return, legal counsel reviews and provides legal advice regarding the documents in question. I accept the police’s evidence that these records consist of solicitor-client privileged communications, and I find that there is no evidence that the police have waived their privilege over any of these records. Based on the police’s arguments, and my independent review of the records, I find that these email communications, plus attachments, are subject to the common-law solicitor-client communication privilege under branch 1 of section 12 and exempt from disclosure, subject to my findings regarding the police’s exercise of discretion under Issue G, below.

[89] The appellant has raised the public interest override, which is discussed at Issue H, below. The public interest override in section 16 cannot apply to information found exempt under section 12.

Issue E: Do either of the discretionary law enforcement exemptions at sections 8(1)(c) or 8(2)(a) apply to any of the records?

[90] The police claim that some of the records are exempt from disclosure because the law enforcement exemptions at sections 8(1)(c) and/or 8(2)(a) apply to them. Both of these exemptions contain the term “law enforcement” which has been defined in section 2(1), in part, as follows:

“law enforcement” means,

(a) policing,

(b) investigations or inspections that lead or could lead to proceedings in a court or tribunal if a penalty of sanction could be imposed in those proceedings,

Section 8(1)(c) - reveal investigative techniques and procedures

[91] The records for which the police claim section 8(1)(c) are Index B records 9-38, 42, 45-47, 52-63, 65-87, 90-109, 111-121, 123-128, 135-137, 140, 142-144, 146-176, 179, 181-184, 187, 191-209, 215-217, 219-245, 250-252, 259-267, 269-272, 274-277, 279-283, 285 and 287-318, 321-337.

[92] For the reasons that follow, I find that records 22, 86, 92, 97, 105 and 292 are exempt in full from disclosure under section 8(1)(c) and that records 10-11, 13, 19-21, 33, 35, 38, 42, 63, 68, 69, 71-75, 77-83, 85, 87, 93, 96, 118-121, 127-128, 135, 142, 146-147, 168-172, 174-176, 205-207, 221, 228-232, 236-237, 240-241, 243, 252, 272, 285, 311-314, 317, 321-325 are exempt in part under section 8(1)(c), subject to my findings regarding the police’s exercise of discretion.

[93] Section 8(1)(c) states:

A head may refuse to disclose a record if the disclosure could reasonably be expected to,

reveal investigative techniques and procedures currently in use or likely to be used in law enforcement

[94] As with many of the exemptions listed in section 8, section 8(1)(c) applies where a certain harm “could reasonably be expected to” result from disclosure of the record.

[95] The law enforcement exemption must be approached in a sensitive manner, because it is hard to predict future events in the law enforcement context, and so care must be taken not to harm ongoing law enforcement investigations.[46]

[96] However, the exemption does not apply just because a continuing law enforcement matter exists,[47] and parties resisting disclosure of a record cannot simply assert that the harms under section 8 are obvious based on the record. They must provide detailed evidence about the risk of harm if the record is disclosed. While harm can sometimes be inferred from the records themselves and/or the surrounding circumstances, parties should not assume that the harms under section 8 are self-evident and can be proven simply by repeating the description of harms in the Act .[48]

[97] Parties resisting disclosure must show that the risk of harm is real and not just a possibility.[49] However, they do not have to prove that disclosure will in fact result in harm. How much and what kind of evidence is needed to establish the harm depends on the context of the request and the seriousness of the consequences of disclosing the information.[50]

[98] For section 8(1)(c) to apply, the institution must show that disclosing the investigative technique or procedure to the public could reasonably be expected to interfere with its effective use. The exemption normally will not apply where the technique or procedure is generally known to the public.[51]

[99] The technique or procedure must be “investigative”; that is, it must be related to investigations. The exemption will not apply to techniques or procedures related to “enforcing” the law.[52]

Representations

[100] The police submit that the investigative technique referred to in the wording of section 8(1)(c) is the facial recognition system that they will be using in future – not Clearview AI - as an investigative tool in order to:

• aid in the investigation of criminal offences,
• enhance operational efficiency and response times, and
• leverage data through efficiencies with emerging technologies to be more effective in keeping communities safe.

[101] The police further submit that the disclosure of the procurement records would expose and compromise the security of the system and the systems that the software may need to interact with and, therefore, interfere with its use. The police go on to argue that because the facial recognition system and process deals with the personal information of individuals, the security of the system is critical.

[102] The police further state:

Although the concept of facial recognition may be well known, how its use (sic) by police may not be. Only a few police services in Ontario are currently using the technology and the guidelines around the use of the technology are still being established. As well the system will be used and accessed by only specifically trained members of the police service. Access to the system will not be granted to the majority of the members of the service.

[103] The appellant did not provide representations on this issue.

Analysis and findings

[104] I find that the records listed above, either in whole or in part are exempt from disclosure under section 8(1)(c), subject to my findings regarding the police’s exercise of discretion. Based on my consideration of the police’s representations and on my review of the records, I find that the disclosure of the information contained in them could reasonably be expected to reveal investigative techniques and procedures currently in use in law enforcement by the police. I am satisfied that the police have demonstrated that the risk of harm to the investigative techniques, should they be disclosed, is real and not simply a possibility. I am also satisfied and find that these techniques or procedures are not generally known to the public. I find that the exempt information consists of the “functional” tabs in Excel spreadsheets, meeting minutes, an email, portions of the both the final and draft RFP, and portions of one of the affected party’s submission in response to the RFP.

[105] I find that the remaining information for which section 8(1)(c) was claimed is not exempt from disclosure because it does not reveal any investigative techniques and/or procedures currently in use by the police. The police have claimed the application of the discretionary exemption in section 11 to this information which I consider in Issue E.

Section 8(2)(a) – law enforcement report

[106] The police claim that section 8(2)(a) applies to Index A records 1 to 4. I have already found 43 of the 58 pages of these records to be exempt under section 14(1). The following analysis therefore pertains to the remaining 15 pages.

[107] Section 8(2)(a) reads:

A head may refuse to disclose a record,

that is a report prepared in the course of law enforcement, inspections or investigations by an agency which has the function of enforcing and regulating compliance with a law[.]

[108] For a record to be exempt under section 8(2)(a), it must be

1. a report,
2. prepared in the course of law enforcement, inspections or investigations, and
3. prepared by an agency that has the function of enforcing and regulating compliance with a law.[53]

[109] A report is a formal statement or account of the results of the gathering and consideration of information. “Results" do not generally include mere observations or recordings of fact.[54] The title of a document does not determine whether it is a report, although it may be relevant to the issue.[55]

Representations

[110] The police submit that the records for which they claim this exemption are reports prepared by police service members in the course of their law enforcement duties. The reports relate to the use of a 30-day trial of a facial recognition system – Clearview AI. The police officer who initially obtained the 30-day trial of the technology compiled a report for his superiors, who in turn compiled reports for the Chief of Police. The police further submit that the reports were not available to other members of the police service who were not involved in the use of the technology, and that the distribution of the report was limited to members of the Fraud Bureau.

[111] The appellant’s representations do not address this exemption.

Analysis and findings

[112] I have reviewed these records, and I find that they are exempt from disclosure under section 8(2), subject to my findings regarding the police’s exercise of discretion. I am satisfied that these records consist of reports that were prepared in the course of investigations. I find that these records qualify as reports because they constitute the formal statements and accounts of the results of the gathering and consideration of information, including officers’ investigative findings and conclusions. The reports also include officers’ and their superiors’ assessments of the use of the Clearview AI facial recognition technology in these investigations. Consequently, I find that these pages consist of law enforcement reports for the purposes of section 8(2)(a) and are exempt from disclosure.

[113] Because the Index A records are exempt from disclosure in their entirety under both sections 8(2)(a) and 14(1), they cannot be severed. In addition, the appellant has claimed the public interest override to these records. I note that the public interest override in section 16 cannot apply to information that is exempt under the law enforcement exemption in section 8.

Issue F. Does the discretionary exemption at section 11 for economic and other interests of the police apply to any of the records?

[114] The police applied sections 11(a), (b) and/or (c) to withhold the remaining Index B records from disclosure.

[115] The purpose of section 11 is to protect certain economic and other interests of institutions. It also recognizes that an institution’s own commercially valuable information should be protected to the same extent as that of non-governmental organizations.[56]

[116] Section 11 states, in part:

A head may refuse to disclose a record that contains,

(a) trade secrets or financial, commercial, scientific or technical information that belongs to an institution and has monetary value or potential monetary value;

(b) information obtained through research by an employee of an institution where the disclosure could reasonably be expected to deprive the employee of priority of publication;

(c) information whose disclosure could reasonably be expected to prejudice the economic interests of an institution or the competitive position of an institution;

[117] The purpose section 11(a) is to permit an institution to refuse to disclose information where its disclosure would deprive the institution of its monetary value.[57]

[118] The purpose of section 11(b) is to protect an employee’s priority of publication of information obtained through research.

[119] Section 11(c) recognizes that institutions may have economic interests and compete for business with other public or private sector entities, and it provides discretion to refuse to disclose information on the basis of a reasonable expectation of prejudice to these economic interests or competitive positions.[58] Section 11(c) is broader than section 11(a) and requires only that disclosure of the information could reasonably be expected to prejudice the institution’s economic interests or competitive position.[59]

Representations

[120] With respect to the first part of the three-part test in section 11(a), the police submit that the Index B records contain commercial, financial and technical information of a new technology to be used by the police. The records, the police argue, contain detailed technical proposals for the provision of facial recognition software, including its installation and its maintenance, as well as the police’s scoring and evaluation materials of the proposals received in response to its RFP. The police go on to submit that all of these records were created for the purpose of entering into a commercial arrangement.

[121] Concerning the second and third parts of the three-part test in section 11(a), the police state:

The information does belong to the police as it relates to new technology that York Regional Police is obtaining in order to aid in the investigation of criminal offences.

. . .

There is an inherent monetary value in the information to the police service resulting from the expenditure of money or the application of skill and effort to development the information. [sic]

[122] Although the police claim that the records are also exempt under section 11(b), they do not address section 11(b) in their representations.

[123] Regarding section 11(c), the police submit that disclosure of the information in the records could reasonably be expected to prejudice their economic interests because the disclosure would affect the security and integrity of the facial recognition system and reveal the police’s financial risk tolerance in entering into a public-private partnership for major technological projects.

[124] The appellant’s representations do not address the section 11 exemption.

Analysis and findings

Section 11(a)

[125] I find that the records are not exempt under section 11(a). For section 11(a) to apply, the police must show that the information:

1. is a trade secret, or financial, commercial, scientific or technical information,
2. belongs to an institution, and
3. has monetary value or potential monetary value.

[126] The types of information listed in section 11(a) have been discussed in prior orders, such as technical and commercial information, as follows:

Commercial information is information that relates only to the buying, selling or exchange of merchandise or services. This term can apply to commercial or non-profit organizations, large or small.[60] The fact that a record might have monetary value now or in future does not necessarily mean that the record itself contains commercial information.[61]

Technical information is information belonging to an organized field of knowledge in the applied sciences or mechanical arts. Examples of these fields include architecture, engineering or electronics. Technical information usually involves information prepared by a professional in the field, and describes the construction, operation or maintenance of a structure, process, equipment or thing.[62]

[127] For information to “belong to” the police, they must have some proprietary interest in it, either “intellectual property” in the information, such as copyright, trade mark, patent or industrial design, or another type of proprietary interest that the law says could be damaged if another party were to misappropriate the information.

[128] The type of information “belonging” to an institution is information that has monetary value to the institution because it has spent money, skill or effort to develop it. Some examples are trade secrets, business-to-business mailing lists,[63] customer or supplier lists, price lists, or other types of confidential business information. If this information is consistently treated in a confidential manner, and its value to the institution comes from its not being generally known, the information will be protected from misappropriation by others.[64]

[129] To have “monetary value,” the information itself must have an intrinsic value. The mere fact that the institution spent money to create the record does not mean it has monetary value for the purposes of this section.[65] Nor does the fact, on its own, that the institution has kept the information confidential.[66]

[130] I find that the records are not exempt under section 11(a) because they do not meet the requirements of the three-part test in the exemption. I find that even if the records contain commercial, financial or technical information for the purpose of part one of the test, they do not meet part two of the test.

[131] First, I find that many of these records consist of confidentiality and non-disclosure agreements, which do not meet the second part of the test because they do not “belong to” the police. I find that the police do not have a proprietary interest in the general language that is used in these confidentiality agreements. In addition, I find that these agreements do not qualify as intellectual property or that the police have another type of proprietary interest that could be damaged if another party were to misappropriate the information. Other records, I find, contain summary scores, instructions for scorers and general RFP requirements, including requiring general information about the history and corporate health of the proponents who bid in response to the RFP. I find that this information does not “belong” to the police in that the police have not established that they have a proprietary interest that could be damaged if another party were to misappropriate the information, nor does the information qualify as “intellectual property.”

[132] Finally, I find that while other portions of the records contain technical information, meeting the requirements of part 1 of the three-part test, they do not meet the second part of the test. The police’s position is that the technical information in the records belongs to them because it relates to new technology they are obtaining in order to aid in the investigation of crime. For information to “belong to” the police, they must have some proprietary interest in it, either “intellectual property” in the information, such as copyright, trade mark, patent or industrial design, or another type of proprietary interest that the law says could be damaged if another party were to misappropriate the information. I find based on the police’s evidence that they have not established that they have a proprietary interest in the technical information in the records that could be damaged if another party were to misappropriate the information. I further find that the police have not established that the technical information qualifies as “intellectual property.”

[133] As a result, I find that these records do not meet the second part of the three-part test and are not exempt from disclosure under section 11(a). The police have also claimed sections 11(b) and (c) to these records, which I consider below.

Section 11(b)

[134] I find that none of the records are exempt from disclosure section 11(b). Under section 42 of the Act , where an institution refuses access to a record or part of a record, the burden of proof that the record or part of the record falls within one of the specified exemptions in the Act  lies upon the institution.[67] The police provided no evidence regarding the application of section 11(b) to the records. In addition, on my review of the records I find that none of the records contain information obtained through research by an employee of the police where the disclosure could reasonably be expected to deprive the employee of priority of publication. As a result, I find that this exemption does not apply to the records.

Section 11(c)

[135] I find that Index B records 23-27, 30-32, 34, 36-37, 45-47, 65-66, 70, 84, 102, 112, 123-126, 136-137, 140, 144, 182-184, 187, 191, 194, 196-198, 208-215, 219-220, 222, 224-227, 242, 251, 262-267, 271, 276-277, 283, 287-288, 300-310, 316, 318, 326-330 and 337 are exempt in their entirety from disclosure under section 11(c) and that records 10-12, 19-21, 35, 42, 63, 68-69, 71-75, 77-83, 86-87, 94-96, 99, 106-108, 109, 110-111, 113-114, 115-116, 118-121, 142-143, 146-147, 169-172, 174-176, 205-207, 216, 218, 221, 223, 228-232, 238-241, 244-245, 250, 252, 261, 272, 281, 285, 311-314, 317 and 321-325 are exempt in part under section 11(c), subject to my findings regarding the police’s exercise of discretion.[68]

[136] As previously stated, section 11(c) recognizes that institutions may have economic interests and compete for business with other public or private sector entities, and it provides discretion to refuse to disclose information on the basis of a reasonable expectation of prejudice to these economic interests or competitive positions.[69]

[137] The police’s position is that the disclosure of the records could reasonably be expected to prejudice their economic interests because the disclosure would affect the security and integrity of the facial recognition system, as well as reveal their financial risk tolerance.

[138] An institution resisting disclosure of a record on the basis of section 11(c) cannot simply assert that the harms mentioned in those sections are obvious based on the record. It must provide detailed evidence about the risk of harm if the record is disclosed. While harm can sometimes be inferred from the records themselves and/or the surrounding circumstances, the institution should not assume that the harms are self- evident and can be proven simply by repeating the description of harms in the Act .[70]

[139] The institution must show that the risk of harm is real and not just a possibility.[71] However, it does not have to prove that disclosure will in fact result in harm. How much and what kind of evidence is needed to establish the harm depends on the context of the request and the seriousness of the consequences of disclosing the information.[72]

[140] In their representations, the police argue that the disclosure of the information in the records could reasonably be expected to prejudice their economic interests because the disclosure would affect the security and integrity of the facial recognition system and reveal the police’s financial risk tolerance in entering into a public-private partnership for major technological projects.

[141] With respect to the technical information in the records, I find that the police have established that the disclosure of this information could reasonably be expected to prejudice their economic interests or competitive position. In particular, I find that the disclosure of this information could reasonably be expected to adversely impact the police’s ability to negotiate future contracts in the subject matter, or could reasonably be expected to adversely impact the security and integrity of the facial recognition system if publicly known. As a result, I find that the records containing the technical information are exempt from disclosure under section 11(c).[73]

[142] With respect to other records, I find that the police’s representations alone do not establish or provide detailed evidence to show how the disclosure of the information at issue about a facial recognition system or their financial risk tolerance could reasonably be expected to prejudice their economic interests or competitive position.

[143] However, when I consider the arguments made by the police in the context of the records themselves (which form part of the evidence before me[74]), I find that the disclosure of certain information could reasonably be expected to prejudice the police’s competitive position. I reach this conclusion because the records reveal a picture of the police’s positions and strategies in the negotiations or lead-up to the negotiations with vendors, which could be used by third parties to achieve a competitive edge in possible future negotiations with the police. The information in this category that I find is exempt from disclosure under section 11(c)[75] includes:

• drafts of documents that have internal track changes comments, such as the RFP, vendor submission requirements, and confidentiality agreements,
• detailed breakdown of hours worked on the process,
• discussions about how to proceed with negotiations, including background information provided in preparation for the negotiations,
• instructions to vendors on pricing breakdown, and
• drafts of correspondence to vendors.

[144] I also find that the remaining records at issue are not exempt from disclosure under section 11(c).[76] My finding regarding these records is based on the insufficiency of the police’s evidence in establishing that disclosure of these records could reasonably be expected to prejudice their economic interests or competitive position, as well as my own review of the records. The information that I find is not exempt from disclosure consists of the following:

• general updates, background information and overviews,
• instructions for scorers of vendors’ submissions,
• summary scores,
• general – not technical or security – requirements of vendors,
• negotiated and signed confidentiality agreements,
• general procedural information about the procurement process,
• general terms in the RFP, and
• emails about internal IT work orders.

[145] The appellant has raised the public interest override to the records I have found to be exempt under section 11(c), which I consider in Issue H.

[146] The police have not claimed any further exemptions with respect to the information I have found not to be exempt under sections 8, 10 and/or 11. As a result, I will order the police to disclose this information to the appellant as set out in Order provisions 1 and 2.

Issue G: Did the police exercise their discretion under sections 8, 11 and/or 12? If so, should the IPC uphold the exercise of discretion?

[147] The exemptions in sections 8, 11 and 12 are discretionary, meaning that the institution can decide to disclose information even if the information qualifies for exemption. An institution must exercise its discretion. On appeal, the IPC may determine whether the institution failed to do so.

[148] In addition, the IPC may find that the institution erred in exercising its discretion where, for example, it does so in bad faith or for an improper purpose, it takes into account irrelevant considerations, or it fails to take into account relevant considerations.

[149] In either case, the IPC may send the matter back to the institution for an exercise of discretion based on proper considerations.[77] The IPC cannot, however, substitute its own discretion for that of the institution.[78]

[150] Some examples of relevant considerations are listed below. However, not all of these will necessarily be relevant, and additional considerations may be relevant:[79]

• the purposes of the Act , including the principles that information should be available to the public and exemptions from the right of access should be limited and specific,
• the wording of the exemption and the interests it seeks to protect,
• whether the requester has a sympathetic or compelling need to receive the information
• whether the requester is an individual or an organization,
• the relationship between the requester and any affected persons,
• whether disclosure will increase public confidence in the operation of the institution,
• the nature of the information and the extent to which it is significant and/or sensitive to the institution, the requester or any affected person,
• the age of the information, and
• the historic practice of the institution with respect to similar information.

Representations

[151] The police submit that in exercising their discretion under sections 8, 11 and/or 12 to withhold the records in full, they took into account the purpose of the Act and the manner in “which disclosure would be permissible.” The police further submit that they took into account the fact that the appellant is not seeking his own personal information and there is no sympathetic or compelling need for him to receive the records. The police go on to submit that they considered whether partial disclosure would be appropriate, but decided against it given that inferences could be made from disclosed information about information that was withheld. Finally, the police submit that they took into account the purpose of the exemptions in section 8 and 11, noting that disclosure of the records could reasonably be expected to prejudice the police’s economic interests and affect the security and integrity of the facial recognition system.

[152] The appellant submits that an important consideration is that the disclosure of the records may shed light on whether the public should have confidence in the police.

Analysis and findings

[153] Based on the police’s representations, I find that they adequately exercised their discretion because they took into account relevant considerations and did not take into account irrelevant considerations. I find that the police turned their minds to the appellant’s interests in the disclosure of the records, balancing those interests with the importance of the law enforcement, economic interests and solicitor-client exemptions. As a result, I uphold the police’s exercise of discretion to the information that I have found to be exempt from disclosure under sections 8, 11 and 12.

Issue H: Does the public interest override provision at section 16 apply to require the disclosure of any of the records?

[154] The appellant claims the possible application of the public interest override in section 16  of the Act  to the records which I have found to be exempt. Section 16 states:

An exemption from disclosure of a record under sections 7, 9, 9.1, 10, 11, 13 and 14 does not apply if a compelling public interest in the disclosure of the record clearly outweighs the purpose of the exemption.

[155] As previously stated, the public interest override cannot apply to override the application of the exemptions in sections 8 and 12, which are not listed in section 16. However, I will consider whether the public interest override applies to the records I have found to be exempt under sections 10, 11 and 14 in this appeal.

[156] For section 16 to apply, two requirements must be met:

• there must be a compelling public interest in disclosure of the records; and
• this interest must clearly outweigh the purpose of the exemption.

[157] The Act  does not state who bears the onus to show that section 16 applies. The IPC will review the records with a view to determining whether there could be a compelling public interest in disclosure that clearly outweighs the purpose of the exemption.[80]

[158] In considering whether there is a “public interest” in disclosure of the record, the first question to ask is whether there is a relationship between the record and the Act ’s central purpose of shedding light on the operations of government.[81] In previous orders, the IPC has stated that in order to find a compelling public interest in disclosure, the information in the record must serve the purpose of informing or enlightening the citizenry about the activities of their government or its agencies, adding in some way to the information the public has to make effective use of the means of expressing public opinion or to make political choices.[82]

[159] A “public interest” does not exist where the interests being advanced are essentially private in nature.[83] However, if a private interest raises issues of more general application, the IPC may find that there is a public interest in disclosure.[84]

[160] The IPC has defined the word “compelling” as “rousing strong interest or attention”.[85]

[161] The IPC must also consider any public interest in not disclosing the record.[86] A public interest in the non-disclosure of the record may bring the public interest in disclosure below the threshold of “compelling.”[87]

[162] The existence of a compelling public interest in disclosure alone is not enough to trigger disclosure under section 16. This interest must also clearly outweigh the purpose of the exemption in the specific circumstances. An important consideration in balancing a compelling public interest in disclosure against the purpose of the exemption is the extent to which denying access to the information is consistent with the purpose of the exemption.[88]

Representations

[163] The appellant submits that there is a public interest in the disclosure of the records given the police’s use of a database operated by Clearview AI, which contains more than three billion images of the public “scraped” from the internet including social media platforms. These images, the appellant argues, are scraped without the consent of the individuals captured in the images. The appellant further submits that it is in the public interest to know how police are using the images, including reasons other than policing.[89]

[164] The appellant goes on to state:

In early 2020 the [police] initially denied their use of Clearview AI’s software, further bringing this request into the public interest due to the fact that several months later the [police] reversed course and did admit to their members using Clearview AI’s software. The admission on the part of the [police] that its members did use such software only came once a leaked customer list from Clearview AI did, in fact, confirm that the [police] used such software. Much of this has been reported in the media.[90]

[165] The police submit that there are two sets of records, the first being investigative records created as a result of a 30-day free trial of the Clearview AI software (the Index A records) and the second being procurement records regarding the supply, delivery and implementation of facial recognition software to the police (the Index B records).

[166] With respect to the Index A records, the police submit that there is no compelling public interest in their disclosure that outweighs the purpose of the personal privacy exemption in section 14(1), which is to prevent an unjustified invasion of privacy. The Index A records, the police argue, contain personal information about individuals that was obtained during criminal investigations conducted by their Fraud Unit, using the Clearview AI application.

[167] The police go on to state:

As the appellant himself states there has already been wide public coverage and debate on the use of the Clearview AI software by police services including York Regional Police and it is the police service’s opinion that the records that exist in relation to the use of the software would not shed further light on the matter. As well a significant amount of information regarding how York Regional Police used the software has already been disclosed to the appellant and the coverage by other media outlets to adequately address any public interest considerations.

[168] With respect to the Index B records, the police submit that there is no compelling public interest in their disclosure that outweighs the purpose of the exemptions which the police claim with respect to these records. In particular, with regard to the exemption in section 10(1), the police argue that there is no relationship between third party commercial information and the central purpose of the Act , which is to shed light on the operations of government.

[169] The police also argue that there is no compelling public interest in the disclosure of the Index B records that overrides the purpose of the section 11 exemption, which is to protect certain economic interests of institutions including where disclosure would deprive an institution of monetary value. The records, the police submit, contain information about the assessed risk of the project and reveal the police’s financial risk tolerance in entering into a public-private partnership for a major technological project.

[170] One of the affected parties whose records are contained in the Index B records submits that it does not believe that there is a compelling public interest in the disclosure of confidential details of the components and features of its hardware and software offering, and that the disclosure of this information would not serve the purpose of informing the public to make choices or express public opinions.

[171] The second affected party, whose records are also in the Index B records, submits that there is not a compelling public interest in the disclosure of its confidential information and that, in fact, there is a public interest in the non-disclosure of the information because of the chilling effect on open and transparent communications that would result between government and commercial research and development companies should the information be disclosed. The communications and proposals contained in the records, the affected party argues, relate to solving law enforcement, border control, anti-terrorism and other public safety problems. The affected party further submits that public disclosure of this information would permit criminals, adversaries and enemies of the state to frustrate or defeat law enforcement and other public safety methods and efforts.

[172] The second affected party also submits that the appellant appears to focus his arguments on the Clearview AI records, and that the affected party is a separate business which has no business relationship whatsoever with Clearview AI. It argues that the appellant has not met the burden of articulating a compelling public interest in the disclosure of its records relating to its products and services, which do not deliver databases of facial images to the police. Finally, the affected party submits that there is already a significant amount of information available to the public on the topic of facial recognition, including global debate about it.

[173] In response, concerning the Index A records, the appellant submits that the police initially publicly denied using Clearview AI’s software and eventually admitted that it had used that software. As a result of the reversal of the police’s use of Clearview AI, the appellant argues, there is a public interest in the disclosure of the records that would shed light on the reasons why, how and under whose direction the police decided to deny using the software despite having already used it. The appellant also clarifies that he is not seeking names or other identifying details of suspects or offenders. Instead, the appellant submits, he seeks higher level records pertaining to the police’s use of the software. The appellant goes on to argue that the police’s position that there is already ample information in the public domain is “ridiculous at best and harmful at worst” because the information provided by media outlets does not meet the threshold for information being in the public domain. The information already in the public domain, the appellant submits, was obtained through uncited sources and not through the primary data which he seeks.

[174] With respect to the Index B records, the appellant submits that there is a public interest in the disclosure of these records because they reveal, in a transparent way, the monetary costs of the police’s business dealings with respect to facial recognition software.

Analysis and findings

[175] I will address the Index A records first, which I have found to be exempt under section 14(1) (personal privacy). [91]I acknowledge the appellant’s concern and find that there is a compelling public interest in the use of facial recognition technology, particularly the use of Clearview AI. I am also attuned to the public policy concerns about the use of Clearview AI. For example, there has been significant enforcement action against Clearview AI in Canada, the UK, Europe and Australia in relation to its practice of harvesting billions of photographs of individuals from the internet without lawful authority and, in turn, offering its intelligence and investigative services, including these photographs, to law enforcement agencies.[92]

[176] I have also taken into consideration the appellant’s position that he is not seeking personal information, such as the names or other identifying details of suspects or offenders; instead, he seeks higher level records pertaining to the police’s use of the software, including for reasons other than policing. The Index A records – which are the only records relating to Clearview AI - contain a significant amount of personal information about identifiable individuals, consisting mainly of photographs of individuals, their name and address. In fact, 43 of the 58 pages of these records, in their entirety, consist of the personal information of identifiable individuals. In describing how the Clearview AI software was used in several investigations, the records include many details about identifiable individuals considered to be either suspects or victims in investigations. As previously stated, I found that this information is exempt from disclosure under the personal privacy exemption in section 14(1) and cannot be severed.

[177] While I agree that there is a compelling public interest in the privacy and safety implications of the use of Clearview AI technology as a whole, I must also consider the specific records at issue in this appeal. In particular, I must consider first, whether the compelling public interest is addressed in the records and second, whether that compelling public interest outweighs the purpose of the exemption – in this appeal the privacy of specific individuals contained in the records.

[178] Based on my review of the Index A records, I find that the records in question do not respond or refer to the issues of public interest raised by the appellant. In particular, I find that the personal information at issue in these records does not address the appellant’s pursuit of higher level information pertaining to the police’s use of Clearview AI, including if the police use it for purposes other than policing. In addition, I find that to the extent there is any compelling public interest in the Index A records, it is outweighed by the purpose of the exemption in section 14(1), which is to protect the personal privacy of the affected individuals referred to in the records.

[179] Turning to the Index B records, none of these records relate to Clearview AI. The procurement process for the provision of facial recognition technology to the police did not involve Clearview AI. The appellant’s position with respect to these records is that there is a public interest in their disclosure because they reveal the monetary costs of the police’s business dealings with respect to facial recognition software. I have already found that the limited amount of financial information in these records is not exempt from disclosure and the appellant will receive this disclosure as a result of this order. My consideration as to whether the public interest override applies to the information I have found to be exempt under sections 10(1) and 11 is based on my actual review of the records themselves. I find that the records do not contain the information which the appellant claims to be in the public interest and there is no compelling public interest in the information in the records that outweighs the purpose of the exemptions.

[180] In the case of the exemption in section 10(1), I found that disclosure of that information would prejudice significantly the competitive position or interfere significantly with the contractual or other negotiations of the affected parties. Based on my review of the records, I find there is not a compelling public interest in this information that outweighs the purpose of the exemption in section 10(1), which is to protect the economic interests of third parties.

[181] Turning to the information I found exempt under section 11(c), on my review of the records, I find that there is not a compelling public interest in the disclosure of the information in these records that outweighs the purpose of the exemption in section 11(c), which is to protect the economic interests of the police. I found that it would be reasonably foreseeable that the disclosure of this information would prejudice significantly the police’s competitive position in future negotiations and could reasonably be expected to cause the police economic harm. While I am cognizant of, and sympathetic to the public’s interest in facial recognition technology, the test that the IPC has applied in considering the public interest override is whether there is a compelling public interest in the disclosure of the exempt information that outweighs the purpose of the exemption. In the circumstances of this appeal and the records before me, I am unable to find a compelling public interest in the disclosure of the records that outweighs the purpose of the exemption in section 11(c).

[182] I further find that the disclosure of the information which I have found to be exempt under sections 10(1) and 11(c) would not serve the subject matter of the public interest raised by the appellant. The appellant raises the public interest in the monetary costs of the police’s business dealings with respect to facial recognition software. As previously stated, I have already ordered that information to be disclosed.

[183] In reaching these conclusions, I have also taken into consideration that the appellant has been partially successful in this appeal and his request will result in additional information being disclosed to him.

[184] In conclusion, I find that the public interest override in section 16 does not apply to the information I have found to be exempt under sections 10(1), 14(1) and 11(c).

ORDER:

1. I order the police to disclose Index B records 9, 14-18, 28-29, 52-59, 62, 67, 76, 98, 100-101, 104, 112, 117, 131, 133, 138-139, 141, 192-193, 200-202, 217, 233-235, 269-270, 274-275, 279-280, 282, 289, 293-299 and 331-336 in their entirety to the appellant by January 6, 2025, but not before December 30, 2024.
2. I order the police to disclose the Index B records in part, as set out in the Appendix, to the appellant by January 6, 2025, but not before December 30, 2024. To be clear, the information set out in the Appendix is to be disclosed to the appellant, unless otherwise indicated.
3. I find the remaining records to be exempt under sections 8(1)(c), 8(2)(a), 10(1)(a), 11(c), 12 and 14(1).
4. I reserve the right to require the police to provide to the IPC the records it discloses to the appellant.

Original Signed by:		November 26, 2024
Cathy Hamilton
Adjudicator

 

 

APPENDIX[93]

RECORD NUMBER	PORTIONS TO BE DISCLOSED
10	Cover page and Section 1
19	Introduction, Points 1, 2 and 4
20 and 21	Introduction, Points 1, 2, 3 and 5
33, 38, 236, 237, 240 and 241	Instructions for Functional tabs Instructions for RFP General tabs RFP General tabs
35	Rated Functional Instructions tab
42, 146, 168, 174 and 321	General Requirements portion of the Scoring Sheets except comments
60 and 61	Background and Project Team Sections
63 and 69	General Requirements Scoring Sheet tabs
68	Instructions tab Summary Scores tab
71, 72, 73 and 74	General Requirements Scoring Sheet tabs except comments
75	Summary Scores tab Instructions tab RFP General tab
77, 78, 79 and 80	Summary Scores tabs Instructions tabs
81 and 313	RFP General tabs
82, 83, 206, 231, 232, 252, 285, 312, 314, 322 and 323	Summary Scores tabs RFP General tabs
85	Disclose all except the clarification questions
87 and 272	RFP General tabs except comments Cover emails
93	Whole record except Item 2 on the agenda and in the notes
94	Scoring Overview tab Cover email
95, 99, 109, 113, 114, 261 and 281	Page 1 Cover emails
13, 96 and 135	Instructions RFP General tabs Instructions Functional tabs RFP General tabs except answers Cover email
106, 107, 108, 110, 111, 115 and 116	Page 1 except Draft Goals Cover emails
118, 119, 120, 121, 127 and 128	RFP General tabs except comments
142 and 317	Summary Scores tabs RFP General tabs Cover emails
143	Scoring Overview tab Cover email
147, 172, 175, 176, 207, 311, 324 and 325	Summary Scores tabs RFP General tabs except comments
171	Instructions tab
205	Title, Table of Contents, Part Two except sections 2.1 and 2.3.2, Part 3, Part 4, Appendix B – disclose only the first page, Appendix C, Appendix D, Appendix E – disclose only A 2.1, 2.2, 2.3, 2.8, Table 1.4 and Table 1.5.
216 and 218	Notes below the Power Point Presentations
221	All except sections 2.1 and 2.3.2 of Part Two
223	Title, Background, Project Team and Hours of Work sections
238 and 239	Instructions for Rated Security Requirements tabs
243	Instructions for Rated Functional Requirements section
244	Instructions for Rated Security Requirements section