ORDER MO-4632

Appeal MA22-00491

Ottawa Police Services Board

March 4, 2025

Summary: An individual made a request to the Ottawa Police Services Board (the police) for records relating to a specified incident involving a rental car. The police granted partial access to the police report explaining that disclosure of some of the information would endanger the security of a system (section 38(a), read with section 8(1)(i)).

In this order, the adjudicator finds that disclosure of some of the withheld information would endanger the security of a system and upholds the police’s decision to withhold that information. She orders the police to disclose the remaining information.

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. M.56 , as amended, sections 2(1) (the definition of “personal information”), 8(1)(i) and 38(a).

OVERVIEW:

[1] The Ottawa Police Services Board (the police) received a request, under the Municipal Freedom of Information and Protection of Privacy Act  (the Act ), for access to the following:

.... police notes & report in regards to my car incident during the months of September - October (2021-09-15/2021-11-15). Any records containing my own personal information.

[2] The police issued a decision advising that were no responsive records.

[3] Dissatisfied with the police’s decision, the requester (now the appellant) appealed it to the Information and Privacy Commissioner of Ontario (IPC).

[4] During mediation, the police conducted another search and located a police report (report) that was responsive to the request. They issued a revised decision letter granting partial access to it. Access was denied to some information based on the exemption at section 38(a) (discretion to refuse requester’s own information), read with section 8(1)(i) (security), of the Act .[1]

[5] With the police’s consent, the mediator relayed to the appellant that the withheld information is solely about the rental car and does not contain any of the appellant’s personal information. However, the appellant continues to believe that the police have withheld her personal information from the report and, therefore, that she is entitled to access to the withheld information.

[6] As further mediation was not possible, this appeal was transferred to the adjudication stage of the appeal process, where I conducted an inquiry under the Act . I invited the police and the appellant to provide representations on the issues in this appeal. The parties’ representations were shared in accordance with the confidentiality criteria in the IPC’s Practice Direction 7.

[7] For the reasons that follow, I uphold the police’s decision, in part, that section 38(a), read with section 38(1)(i), applies to some of the withheld information. I order the police to disclose the remaining information to the appellant.

RECORDS:

[8] Remaining at issue is the withheld information on page 2 of a 3-page report. [2]

ISSUES:

1. Does the report contain “personal information” as defined in section 2(1) and, if so, whose personal information is it?
2. Does the discretionary exemption at section 38(a), allowing the police to refuse access to a requester’s own personal information, read with the section 8(1)(i) exemption, apply to the withheld information?

DISCUSSION:

Issue A: Does the report contain “personal information” as defined in section 2(1) and, if so, whose personal information is it?

[9] In order to decide whether section 38(a) applies, I must first decide whether the report contains “personal information,” and if so, to whom this personal information relates.

[10] Section 2(1)  of the Act  defines “personal information” as “recorded information about an identifiable individual.” Recorded information is information recorded in any format, including paper and electronic records.[3]

[11] Information is “about” the individual when it refers to them in their personal capacity, meaning that it reveals something of a personal nature about them. Generally, information about an individual in their professional, official, or business capacity is not considered to be “about” the individual if it does not reveal something of a personal nature about them.[4]

[12] Information is about an “identifiable individual” if it is reasonable to expect that an individual can be identified from the information either by itself or if combined with other information.[5]

[13] Section 2(1)  of the Act  gives a list of examples of personal information. The examples that are relevant to this appeal are set out below:

“personal information” means recorded information about an identifiable individual, including,

(e) the personal opinions or views of the individual except if they relate to another individual

...

(g) the views or opinions of another individual about the individual, and

[14] The list of examples of personal information under section 2(1) is not a complete list. This means that other kinds of information could also be “personal information.”[6]

[15] It is important to know whose personal information is in the records. If the records contain the requester’s own personal information, their access rights are greater than if it does not.[7] Also, if the records contain the personal information of other individuals, one of the personal privacy exemptions might apply.[8]

[16] The police submits that the report contains personal information of the appellant. They submit that it refers to her in a personal capacity.

[17] The appellant submits that the report contains her personal information.

[18] Based on my review of the report, I find that it contains the personal information of the appellant given her knowledge of the event and the fact that the police identified this record as responsive to her access request.

[19] I note that the appellant has been granted access to all the information in the report (including her own personal information) except for the information from a Canadian Police Information Centre (CPIC) query (which does not contain her personal information).

[20] Since the report (as a whole) contains the personal information of the appellant, the appropriate exemption to consider is at section 38(a) (discretion to refuse access to requester’s own personal information), read with section 8(1)(i).

Issue B: Does the discretionary exemption at section 38(a), allowing the police to refuse access to a requester’s own personal information, read with the section 8(1)(i) exemption, apply to the withheld information?

[21] The police claims that section 38(a), read with section 8(1)(i), applies to the withheld information.

[22] Section 36(1)  of the Act  gives individuals a general right of access to their own personal information held by an institution. Section 38 provides some exemptions from this general right of access to one’s own personal information.

[23] Section 38 (a) of the Act  reads:

A head may refuse to disclose to the individual to whom the information relates personal information,

if section 6, 7, 8, 8.1, 8.2, 9, 9.1, 10, 11, 12, 13 or 15 would apply to the disclosure of that personal information. [Emphasis added]

[24] The discretionary nature of section 38(a) (“may” refuse to disclose) recognizes the special nature of requests for one’s own personal information and the desire of the Legislature to give institutions the power to grant requesters access to their own personal information.[9]

[25] If the institution refuses to give an individual access to their own personal information under section 38(a), the institution must show that it considered whether a record should be released to the requester because the record contains their personal information.

[26] Section 8(1)(i) states:

A head may refuse to disclose a record if the disclosure could reasonably be expected to,

(i) endanger the security of a building or the security of a vehicle carrying items, or of a system or procedure established for the protection of items, for which protection is reasonably required.

[27] Many of the exemptions listed in section 8, including section 8(1)(i), apply where a certain event or harm “could reasonably be expected to” result from disclosure of the record.

[28] Parties resisting disclosure of a record under section 8(1)(i) cannot simply assert that the harms under section 8 are obvious based on the record.[10] They must provide detailed evidence about the risk of harm if the record is disclosed. While harm can sometimes be inferred from the records themselves and/or the surrounding circumstances, parties should not assume that the harms under section 8 are self-evident and can be proven simply by repeating the description of harms in the Act .[11]

[29] Parties resisting disclosure must show that the risk of harm is real and not just a possibility.[12] However, they do not have to prove that disclosure will in fact result in harm. How much and what kind of evidence is needed to establish the harm depends on the context of the request and the seriousness of the consequences of disclosing the information.[13]

[30] For section 8(1)(i) to apply, there must be a reasonable basis for concluding that disclosure of the information at issue could be expected to endanger the security of a building or the security of a vehicle carrying items, or of a system or procedure established for the protection of items, for which protection is reasonably required.

[31] Although this exemption is found in a section of the Act  that deals primarily with law enforcement matters, it is not restricted to law enforcement situations. It can cover any building, vehicle, system or procedure that requires protection, even if those things are not connected to law enforcement.[14]

Representations

[32] The police explain that CPIC is a computerized system that provides the law enforcement community with informational tools to assist in combating crime by providing information on crimes, individuals, and vehicles. They explain that CPIC is operated by the RCMP under the stewardship of the National Police Services, on behalf of the Canadian law enforcement community. The police submit that unauthorized access to the information on the CPIC system has the potential to compromise investigations and other law enforcement activities, and the privacy and safety of individuals.

[33] The police submit that the withheld information is the result of a CPIC query of the rental vehicle only. They submit that the withheld information does not relate to or is about the appellant.

[34] The police submit that the withheld information is housed in a secure database to which only authorized law enforcement personnel have access. They submit the disclosure of the CPIC information has the potential to compromise the integrity and ongoing security of the CPIC system and facilitate unauthorized access to information held by the CPIC system.

[35] In response, the appellant submits that the physical description of a building and surrounding is not personal information as she would not necessarily be able to identify third parties or confidential law enforcement information. She also submits that the CPIC query may be about the rental vehicle only but the response would include information about her as she was the driver of the rental vehicle.

Analysis and findings

[36] To establish that section 38(a), read with 8(1)(i) applies, the police were required to provide sufficient evidence to satisfy me that disclosure of the withheld information could reasonably be expected to endanger the security of a system or procedure established for the protection of items and, further, that such protection is reasonably required.

[37] For the reasons that follow, I find that section 38(a), read with section 8(1)(i), applies to some, but not all, of the withheld information for which the police have claimed this law enforcement exemption.

[38] In the specific context of section 8(1)(i), I accept that CPIC is an information management system and that its security, or protection, is reasonably required. In this appeal, with regard for the representations provided, as well as the withheld information, I find that there is limited evidence to support a conclusion that disclosure of the entire withheld portion could reasonably be expected to endanger the security of that system.

[39] Previous orders have established that disclosure of CPIC system code information, including transmission access codes, could reasonably be expected to facilitate the commission of an unlawful act – the unauthorized use of CPIC content – according to section 8(1)(l).[15] I note that the police did not claim section 8(1)(l). However, I am satisfied nevertheless that certain code information contained in the withheld portion is also exempt under section 8(1)(i). In my view, the same unauthorized access to CPIC that these past orders accept as a harm under section 8(1)(l) could also reasonably be expected to endanger the security of CPIC, which is a system for which protection is reasonably required.

[40] However, and notwithstanding that the code information contained in the withheld information qualifies for exemption under section 8(1)(i), I am not persuaded that the remaining withheld information is also exempt under section 8(1)(i).

[41] I am not persuaded that disclosure of the remaining withheld information could reasonably be expected to endanger the security of the CPIC system. I also am not persuaded that its disclosure would reveal information about the CPIC system, provide any information that would compromise its integrity or facilitate unauthorized access to it. Rather, I find that the remaining withheld information consist of information about the vehicle rental company and the rental vehicle. To be clear, the remaining withheld information does not contain information about the appellant. As no other exemptions have been claimed for this information, I will order it disclosed.

[42] In sum, I find that some of the withheld information, specifically certain CPIC code information, is exempt under section 38(a), read with 8(1)(i), of the Act . As section 38(a) is a discretionary exemption, my finding is subject to my review of police’s exercise of discretion.

Exercise of Discretion

[43] The exemption in section 38(a) is discretionary and permits an institution to disclose the information subject to the exemption despite the fact that it could withhold it. An institution must exercise its discretion. On appeal, the IPC may determine whether the institution failed to do so.

[44] The police submit that they properly exercised their discretion. They submit that prior to making their decision, they considered the following factors:

• Should the information be available to the public?
• Does the appellant have the right to this information?
• Is this the appellant’s personal information?
• Is this information the appellant would have knowledge of?
• Is this information required or beneficial for public safety?

[45] The police submit that they determined the appellant did not have prior knowledge of the CPIC information and it is not about her. They also considered that the protection of confidential law enforcement information is paramount and outweighs the appellant’s right to the withheld information.

[46] The appellant submits that the police did not properly exercise their discretion. She submits that the police erred in exercising their discretion as they did so for an improper purpose.[16] The appellant also submits that the police erred in exercising their discretion as they took into account irrelevant consideration.[17] She submits that the withheld information was supplied and is about her in a personal capacity, and, accordingly, the police did not exercise their discretion properly. The appellant finally submits that the withheld information (based on a CPIC search query) is inconsistent with the purpose of the exemption as the matter was non-criminal in nature.

[47] After considering the parties’ representations and the circumstances of this appeal, I find that the police did not err in their exercise of discretion with respect to withholding the information that I have found to be exempt under section 38 (a) of the Act . I am satisfied that the police considered relevant factors and did not consider irrelevant factors in their exercise of discretion. In particular, I am satisfied that the police considered the appellants’ right of access to her own information but also the importance of maintaining the confidentiality of certain law enforcement. I also have no evidence to suggest that the police acted in bad faith or for an improper purpose. Accordingly, I uphold the police’s exercise of discretion in deciding to withhold information pursuant to section 38(a).

ORDER:

1. I uphold the police’s decision, in part.
2. I order the police to disclose the non-exempt information in accordance with the highlighted record accompanying this order by April 1, 2025.
3. In order to verify compliance with this order, I reserve the right to require the police to provide me with a copy of the record disclosed to the appellant upon request.

Original Signed by:		March 4, 2025
Lan An
Adjudicator