ORDER PO-4622

Appeal PA23-00014

McMaster University

March 25, 2025

Summary: This order considers the format in which a university should provide a record to an appellant for three records located after a search that was subject to previous orders. The appellant sought records from McMaster University under the Freedom of Information and Protection of Privacy Act  in a specified format.

The university denied the appellant access to the records in the requested specified format. In this order, the adjudicator orders the university to provide the appellant with the three responsive email records in specified format.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31, section 2(1)  (definition of record), 30; R.R.O. 1990, Regulation 460 under FIPPA, sections 2 and 3.

Orders Considered: Orders PO-4114-I, PO-4143-R, and PO-4160-F.

OVERVIEW:

[1] This order considers the format in which a university should provide records to a requester regarding records located after a search that was subject to previous orders.

The previous request

[2] McMaster University (McMaster or the university) received a request under the Freedom of Information and Protection of Privacy Act  (FIPPA  or the Act ) for the requester’s “entire record” from a specific office at the university, the Ontario Physician Human Resources Data Centre (the Data Centre) and all communications that the Data Centre had with another university (the other university) regarding the requester.

[3] The university granted partial access to records. The requester, now the appellant, appealed the university’s decision to the Information and Privacy Commissioner (the IPC) and IPC file PA19-00512 was opened to deal with the issue of the reasonableness of the university’s search for responsive records.

[4] Interim Order PO-4114-I (the interim order) was issued in that file, in which the adjudicator ordered the university to conduct a further search for the appellant’s records at the Data Centre, as well as all communications the Data Centre had with the other university about the appellant.

[5] The appellant then requested a reconsideration of Interim Order PO-4114-I, seeking to have that order reconsidered for a number of reasons, including the appellant’s submission that the adjudicator failed to consider section 30(2)  of the Act , which reads:

Where a person requests the opportunity to examine a record or a part thereof and it is reasonably practicable to give the person that opportunity, the head shall allow the person to examine the record or part thereof in accordance with the regulations.[1]

[6] In her reconsideration request, she specified the following:

… ‘RECORD – August 8, 2019.pdf,’ which is an email chain, was provided in PDF format. What I requested was the Research Coordinator send me this Record in its original form – as an email attachment with a .eml[2] extension.

[7] In Reconsideration Order PO-4143-R (the reconsideration order), the adjudicator declined to consider the specific format requested by the appellant, as that issue was not at issue in the appeal, which concerned the reasonableness of the university’s search for responsive records.

[8] The university conducted a search in accordance with the interim order and in Final Order PO-4160-F (the final order), the adjudicator upheld the university’s search as reasonable and dismissed the appeal.

[9] In the final order, the adjudicator stated that the appellant had reiterated her request to “be provided with the record ‘Record – August 8, 2019.pdf’ in its original form.”

[10] The adjudicator confirmed in the final order that the university was not invited to respond to the appellant’s submissions regarding her request for the employee to send her a copy of an email in the specified format because, as noted in the reconsideration order, that matter was not at issue in that appeal. In the final order, the adjudicator stated that:

To clarify, in Reconsideration Order PO-4134-R, I concluded that the appellant’s demand for the employee at the university to send her an email does not qualify as a request for access to an original record pursuant to section 30(2)  of the Act ...

This section contemplates that a requester may prefer to examine the original record rather than obtain a copy. Previous orders of this office have typically interpreted section 30(2) to mean that a requester may request to view a record onsite at the institution or otherwise attend somewhere in person to physically examine a record.[3]

The appellant has repeatedly asked that a particular employee at the university send her a copy of an email in a particular format. In my view, receiving an email, regardless of the format, is not the same as examining the original record, as contemplated by section 30(2)  of the Act . The appellant did not raise section 30(2) until she made a reconsideration request, I declined to consider it at that time, and I will not consider it now either.

The Current Request

[11] The university then received the request that is the subject of this appeal: a request for access to three responsive records located by the university as a result of her earlier request, which she had previously received in PDF format from the university.

[12] In her request, the appellant asked that she have access to “… the original version of the responsive records in the email mailboxes of [two university staff members] … in accordance with section 30(2)  of the Freedom of Information and Protection of Privacy Act .” As will become clear, the appellant sought to be able to be logged in to the email account holder’s email account to view the three emails.

[13] In response, the university did not agree to allow the appellant access to the email mailboxes of its two staff members. It proposed an onsite review of the emails on a university computer.

[14] The appellant replied that she did not accept those terms. The appellant proposed an alternative acceptable means of her reviewing the responsive emails, which were previously provided by McMaster in PDF format. She proposed that the three responsive emails be sent to her as unaltered .eml files attached to a new email.

[15] In response, the university continued to deny the appellant’s request to obtain access to by viewing any employees’ email inbox to view the emails and advised also that it was not agreeable to providing the appellant with .eml files, as it would enable the appellant to reply, forward and otherwise manipulate the content of such email chains.

[16] The appellant appealed the university’s decision to the Information and Privacy Commissioner of Ontario (the IPC).

[17] During mediation, the appellant advised that she would be satisfied if the university sent her the records in the proposed .eml file format if the university would not permit an in-person examination of the records in the email accounts of two specified individuals who were senders or recipients of the email chains.

[18] The university told the mediator that it would not permit the appellant to view the emails from the email accounts of the two specified staff members because of privacy and operational concerns. The university explained that it did not generally provide email records in .eml file format because of concerns that the records could be misused or altered. However, the university would allow the appellant supervised access to the email chains forwarded to a university computer. The appellant would be required to sign a release form prior to an on-site review.[4]

[19] The parties were unable to resolve this issue through the process of mediation. Accordingly, the file was referred to adjudication, where I was assigned and decided to conduct an inquiry.

[20] I sought the university’s and the appellant’s representations. In so doing, I have considered the university’s argument that this issue had already been decided in the final order. However, I note in the final order, the adjudicator:

• was considering the reasonableness of the university’s search for records following the interim order, not the issue of the format of the records.

• did not share the appellant’s representations on section 30(2) with the university and seek its representations on the application of this section, and

• did not specifically make a finding on the application of section 30(2) to the appellant’s request for .eml versions of the three email chains at issue in this order.

[21] Therefore, in this order, I considered whether the appellant should be granted access to the three records at issue in the format that she has requested – that, is as .eml files.

[22] In deciding on this issue, I am not considering whether the appellant should have direct access to the university staff members’ email mailboxes. I agree with the university that this could constitute an unjustified invasion of their personal privacy, especially without these staff members being notified of the appellant’s request to view their email mailboxes directly. As the appellant has indicated that it is acceptable to her to receive the records as unaltered .eml attachments to a new email, I have decided to proceed with this appeal on the issue of whether the appellant should be provided access to the .eml files for the records.

[23] In this order, I order the university to provide the appellant with the three responsive email records as unaltered .eml files.

DISCUSSION:

[24] The sole issue being adjudicated in this order is whether the university is required to provide the appellant with the three responsive records in .eml format.

[25] The definition of a “record” in section 2(1)  of the Act  states:

In this Act , “record” means any record of information however recorded, whether in printed form, on film, by electronic means or otherwise, and includes,

(a) correspondence, a memorandum, a book, a plan, a map, a drawing, a diagram, a pictorial or graphic work, a photograph, a film, a microfilm, a sound recording, a videotape, a machine readable record, any other documentary material, regardless of physical form or characteristics, and any copy thereof, and

(b) subject to the regulations, any record that is capable of being produced from a machine readable record under the control of an institution by means of computer hardware and software or any other information storage equipment and technical expertise normally used by the institution.

[26] The rules governing the method of access that an institution must provide are set out in section 30  of the Act , which states:

(1) Subject to subsection (2), a person who is given access to a record or a part thereof under this Act  shall be given a copy thereof unless it would not be reasonably practicable to reproduce the record or part thereof by reason of its length or nature, in which case the person shall be given an opportunity to examine the record or part thereof in accordance with the regulations.

(2) Where a person requests the opportunity to examine a record or a part thereof and it is reasonably practicable to give the person that opportunity, the head shall allow the person to examine the record or part thereof in accordance with the regulations.

(3) Where a person examines a record or a part thereof and wishes to have portions of it copied, the person shall be given a copy of those portions unless it would not be reasonably practicable to reproduce them by reason of their length or nature.

[27] Section 3 of the regulations[5] provides:

3. (1) A head who provides access to an original record must ensure the security of the record.

(2) A head may require that a person who is granted access to an original record examine it at premises operated by the institution.

(3) A head shall verify the identity of a person seeking access to his or her own personal information before giving the person access to it.

[28] In a letter dated October 26, 2022, addressed to the university, the appellant provided her reasons for asking for the records in .eml format. She disput ed the university’s claim that by providing the records in an .eml format it would enable the appellant to reply, forward and otherwise manipulate the content of such email chains, as she could still be able to forward and manipulate the content of the email chains contained in the PDF. She stated that regarding the requested .eml format that:

[She] would not be able to reply to the .eml attachment itself.

While the .eml attachment can be forwarded, it is far more difficult to manipulate it than the provided PDF file. In fact, this is the reason for requesting this means of viewing the original record.

Moreover, FIPPA does not preclude the requester of a record of disseminating that record to which access has been granted...

[29] I asked the university to provide representations that explain why and how section 30 of the Act and section 3 of Regulation 460 support its position not to provide the records to the appellant in the requested .eml format, and to provide a response to the appellant’s representations in its October 26, 2022 letter to the university.

[30] In response, the university submits that the appellant’s demand for a McMaster employee to send her an email in .eml format does not qualify as a request for access to an original record pursuant to section 30(2)  of the Act , as section 30(2) contemplates that a requester may prefer to examine an original record rather than obtain a copy.

[31] It states that section 30(2) has been interpreted to mean that a requester may request to view a record onsite at the institution, or otherwise attend somewhere in person to physically examine a record and that receiving an email, regardless of the format, is not the same as examining the original record, as contemplated by section 30(2)  of the Act .

[32] The university further states that section 30 also does not permit or oblige an institution to provide an opportunity to review the copies of records produced by an institution in response to a request in whatever manner or form requested, and that as long as the record itself is in a “comprehensible form” and a copy of it has been produced, the institution’s obligations have been met.

[33] The university submits that section 30(2) does not entitle a requester to dictate the means by which access to an original record is granted; it only obliges the institution to allow for such access to an original when it is reasonably practicable to do so. As such, so long as access to an original record is granted, the institution has complied with its statutory obligations.

[34] Therefore, it states that an email does not cease to be an original record simply because it is not being viewed in a specific person’s inbox or on a specific person’s computer. So long as an email is saved in its original digital format, its integrity as an “original record” is preserved, regardless of whether it is viewed in an employee’s private inbox or a generic outlook account on a McMaster computer.

[35] In response, the appellant refers to the definition of “record” in section 2(1)  of the Act  (referred to above) and points out that this definition explicitly indicates that a record means any record of information including one recorded by electronic means and includes “correspondence” and “any record that is capable of being produced from a machine readable record … by means of computer hardware.”

[36] She states that McMaster unilaterally chose to provide the three responsive email chains in PDF format instead of in .eml format. She states that two McMaster employees had exchanged emails with the other university named in her request in PDF format and that a portion of one of these emails was provided as an .eml attachment (i.e. in .eml format).

[37] She states that PDFs can be manipulated and that an .eml file is not the original email; it is a copy of an email and are usually simple text files and can be opened in Notepad or a web browser, either by changing the extension from .eml to txt or HTML, or by changing the file association to Notepad. Given that .eml files are plain text files, they can therefore be easily manipulated, modified or altered.

[38] The appellant submits that she would like to receive the records as .eml files sent as attachments to a new email, as this allows a rudimentary digital forensic examination to be undertaken of the .eml file. She states that, while this is an imperfect mechanism, it does provide some information that may assist in authenticating the .eml file.

[39] She states that, according to previous IPC orders, the appellant should be afforded with the opportunity to request the “means of viewing” the original record and that the burden is on the institution to demonstrate that said means is not reasonably practicable. She states that, as per Orders PO-2514 and PO-3480:

Section 30(2) is a mandatory provision, subject only to the requirement of reasonable practicability. The burden is on the institution to demonstrate that the means of viewing requested by the appellant is not reasonably practicable.

[40] Therefore, she submits that her request of having the .eml files emailed to her in order for her to view them is consistent with a “means” of viewing the original record.

[41] In reply, the university states that an .eml file is an email message saved in a standard format by various email clients (including Microsoft, Apple and Google) and the file format typically includes the full message headers and the body of the email, which can be plain text or HTML.

[42] In sur-reply, the appellant states that Outlook cannot analyze an .eml file and determine that it is a genuine copy of an original email record. She further states that when Outlook opens the .eml file, it does not change it, however an .eml file may have been altered (using different software) prior to being opened by Outlook. That is why she is seeking an unaltered copy of the emails in .eml format.

[43] She repeats her request that send McMaster send her unaltered .eml copies of the original email records as attachments to a new email.

Findings

[44] The issue before me is whether the university should comply with the appellant’s request for access the three responsive email chains in an .eml format.

[45] The university’s position is that it already complied with section 30(2) and the request in general as it has provided the appellant with PDF copies of the emails and also offered the appellant an opportunity to view the records as .eml attachments on the university’s computer.

[46] As the appellant has agreed that this format is acceptable to her, I am not deciding whether she is instead entitled to view the responsive emails in the two university staff members’ email mailboxes, and I will not order the university to allow her access to these email mailboxes.

[47] By asking for the records in an unaltered .eml format, the appellant is not asking to examine the original record, which according to the appellant would be examining the emails themselves in email mailboxes. She is asking that copies of the records be provided to her in a certain format.

[48] Specifically, the appellant is asking for the records to be provided to her in a different format than the PDF format that it was already provided to her. She has made a specific request under the Act  for the records in the .eml format and has agreed to not pursue her request to view the original records in the email boxes of the university’s employees if these copies are provided to her.

[49] The appellant has indicated that the requested .eml format will allow her to undertake a rudimentary digital forensic examination of the records to assist in verifying if they are authentic copies of the original records.

[50] The university has pointed out that .eml format records can be altered and disseminated. However, the appellant has also demonstrated how PDF records can also be altered and disseminated, therefore, the ability to alter and disseminate records is not specific to the format requested by the appellant. As well, the appellant has provided evidence that the university has already provided a portion of one of the records to the other university in an .eml format attached to another email.

[51] I have no evidence that the university is unable to provide the three responsive records in the unaltered .eml format sought by the appellant.

[52] A record is defined in section 2(1)  of the Act  as “means any record of information however recorded, whether in printed form, on film, by electronic means or otherwise” (emphasis added). The emails in .eml format constitute a record.

[53] The university has already demonstrated that it is capable of providing records in the .eml format requested by the appellant in two ways:

• it has offered the appellant to view the records in this format on the university’s own computer, and
• it has provided the appellant with an .eml format of a portion of one record as an attachment to another email.

[54] The appellant has specifically asked for these emails at issue to be provided in an unaltered .eml format. These are records under the Act . The university prefers not to provide the appellant with a copy of the emails in an unaltered .eml format; however, it has not argued or demonstrated that providing this copy would “not be reasonably practicable to reproduce the record or part thereof by reason of its length or nature.”

[55] Accordingly, I will order the university to disclose to the appellant the three responsive email records in an unaltered .eml format.

ORDER:

1. I order the university to disclose to the appellant the three responsive emails in an unaltered .eml format by April 29, 2025.
2. In order to verify compliance with this order, I reserve the right to ask the university to provide me with a copy of these records.

Original Signed by:		March 25, 2025
Diane Smith
Adjudicator