ORDER MO-4644

Appeal MA23-00045

York Regional Police Services Board

April 17, 2025

Summary: The police investigated a boat-related injury of a child. They received a request under the Municipal Freedom of Information and Protection of Privacy Act  for their report. The police disclosed parts of the report to the requester but decided that they could not release other parts of it. The reason for this decision to withhold parts of the police report was that disclosing those parts of the report would violate the personal privacy of the people involved (section 38(b) of the Act). In this order, the adjudicator agrees with the police that the information they withheld in the police report should not be disclosed.

Statute Considered: Municipal Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. M.56 , as amended, sections 2(1) (definition of “personal information), 2(2.1), 2(2.2), 14(1), 14(2), 14(3), and 38(b).

Order Considered: Order PO-4607

OVERVIEW:

[1] This order addresses access to personal information (including witness’ statements) that police withheld in a report generated by their investigation into a boat-related injury of a child.

[2] The York Regional Police Services Board (the police) received an access request for an identified police report.

[3] The police issued a decision granting partial access to the requested record. Access to the withheld information was denied under the discretionary exemption at section 38(b) (personal privacy), taking into consideration the presumption weighing against disclosure at section 14(3)(b) (investigation into a possible violation of law) of the Act.

[4] The requester, now the appellant, appealed the police’s decision to the Information and Privacy Commissioner of Ontario (IPC).

[5] The IPC appointed a mediator to explore resolution. During mediation, the appellant advised that he is not interested in the redacted last names or dates of birth, or information that the police redacted as non-responsive to the request. However, no further mediation was possible.

[6] At adjudication, I conducted a written inquiry, inviting and receiving written representations from the parties (first from the police, then from the appellant’s counsel) on the issues in the appeal. I shared the police’s representations with the appellant’s counsel. After seeking and receiving further representations from the appellant about an issue I believed to be relevant (the possible application of a factor weighing against disclosure, at section 14(2)(f) of the Act), I determined that it was not necessary to hear from the parties again.

[7] For the reasons that follow, I dismiss the appeal. I uphold the police’s decision to withhold the portions of the police report that they withheld, under the discretionary exemption at section 38(b) of the Act.

RECORD:

[8] The responsive record is a 28-page police report. Parts of the police report were withheld from disclosure (which is the information at issue).

ISSUES:

1. Does the record contain “personal information” as defined in section 2(1) and, if so, whose personal information is it?
2. Does the discretionary personal privacy exemption at section 38(b) apply to the information at issue?

DISCUSSION:

Issue A: Does the record contain “personal information” as defined in section 2(1) and, if so, whose personal information is it?

[9] To decide which sections of the Act may apply to a specific case, the IPC must first decide whether the record contains “personal information,” and if so, to whom the personal information relates. If a record contains a requester’s own personal information, then access to it will be considered under different sections of the Act, in recognition of the special nature of requests for one’s own personal information and the desire of the Legislature to give institutions the power to grant requesters access to their own personal information.[1] It is not disputed that the record contains the personal information of the appellant. The question here is whether it also contains other individuals’ personal information. For the following reasons, I find that it does.

What is “personal information”?

[10] Section 2(1) of the Act defines “personal information” as “recorded information about an identifiable individual.”

Recorded information

[11] “Recorded information” is information recorded in any format, such as paper records, electronic records, digital photographs, videos, or maps.[2]

About

[12] Information is “about” the individual when it refers to them in their personal capacity, which means that it reveals something of a personal nature about the individual.

[13] Generally, information about an individual in their professional, official or business capacity is not considered to be “about” the individual.[3] See also sections 2(2.1) and (2.2), which state:

(2.1) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

(2.2) For greater certainty, subsection (2.1) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling.

[14] In some situations, even if information relates to an individual in a professional, official or business capacity, it may still be “personal information” if it reveals something of a personal nature about the individual.[4]

Identifiable individual

[15] Information is about an “identifiable individual” if it is reasonable to expect that an individual can be identified from the information either by itself or if combined with other information.[5]

What are some examples of “personal information”?

[16] Section 2(1) of the Act gives a list of examples of personal information, such as age, information relating to employment history of the individual, any identifying number, contact information, views or opinions (whether about another individual or not), and name if appearing with other personal information. These examples are found at paragraphs (a)-(e), (g), and (h), respectively, in the definition of “personal information” at section 2(1).

[17] The list of examples of personal information under section 2(1) is not a complete list. This means that other kinds of information could also be “personal information.”[6] For example, records reflecting interactions with the police can constitute “personal information” under the introductory wording of the definition of that term (“recorded information about an identifiable individual”) in that they would show the fact of the individual’s interaction with the police.[7]

Whose personal information is in the record?

[18] It is important to know whose personal information is in the record. If the record contains the requester’s own personal information, their access rights are greater than if it does not.[8] Also, if the record contains the personal information of other individuals, one of the personal privacy exemptions might apply.[9]

[19] To decide which sections of the Act may apply to a specific case, the IPC must first decide whether the record contains “personal information,” and if so, to whom the personal information relates.

Representations

The police’s representations

[20] The police explain that they investigated a non-fatal boat accident, reported to them initially as an injured party call. They explain that they released a copy of the police report to the appellant but withholding information such as contact information, and the statements of affected parties listed in the report. (Their representations include a long list of types of information that they obtained during their investigation, which is not necessary to set out here, as it was shared with the appellant). The police submit that the information they withheld is the personal information of the affected parties, under paragraphs (a) to (e) of the definition of that term. They also submit that these individuals could reasonably be identified by disclosure because of other information associated with them that was released, including their names.

[21] The police state that they considered section 2(2.2) of the Act because certain affected parties (the owner and employees of the marina that were questioned). However, the police determined that the information provided from these affected parties was “personal information” under the definition of that term in section 2(1) of the Act. Here I note, for clarification, that the police also later stated that they disclosed the names of the owner and employees of the marina.

The appellant’s representations

[22] The appellant’s counsel submits that the police failed to consider sections 2(2.1) and 2(2.2) of the Act (set out above), sections of the Act which exclude the name, title, contact information that identify an individual in a business, professional or official capacity from the definition of “personal information” under the Act. Counsel says that the police noted that professional capacities of the affected parties in their representations. He states that these individuals must be identified so that a lawsuit for personal injury damages can be brought against what he describes as the “responsible parties.” The appellant submits that the “witnesses’ disclosure of information” should have been disclosed for the same reason.

Analysis/findings

[23] It is undisputed, and I find, that the police report contains the appellant’s personal information.

[24] Based on my review of the police report, I find that it also contains the “personal information” of several identifiable individuals (the affected parties). The parties agree, and I find, that the individuals involved would be identifiable by the information withheld. I also agree with the police that some parties would be identifiable from information already disclosed to the appellant by the police.

[25] I find that the personal information at issue (including the witness’ statements) involves many of the listed examples in the definition of that term at section 2(1).

[26] I find that the witness’ statements as a whole are also “personal information.” Past IPC orders have found that information in records about individuals that is collected and used for a law enforcement purpose is their “personal information,” under the introductory language of the definition of that term in section 2(1) of the Act (“recorded information about an identifiable individual).[10] I agree with this approach and find it relevant here. I find that all witness statements (including those of anyone associated with the marina business), were collected by the police as part of their investigation into the appellant’s injury.

[27] Some of the affected parties are the marina business owner and employees. Despite any identification of them in a professional capacity in the police report, the fact of these parties having interactions with the police and/or being subject to a police investigation is itself “recorded information” about them. In my view, this information reveals something of a personal nature about these individuals, which causes it to cross over from professional information into the realm of “personal information.”

[28] In addition, I find that all witness’ statements contain the inextricably mixed personal information of the witnesses who made the statements and the appellant, and cannot be reasonably severed to disclose information only relating to the appellant.

[29] Since the police report contains the appellant’s personal information, I must determine any right of access that he may have to the affected parties’ personal information under the discretionary personal privacy exemption at section 38(b) of the Act.

Issue B: Does the discretionary personal privacy exemption at section 38(b) apply to the information at issue?

[30] For the following reasons, I find that the discretionary personal privacy exemption at section 38(b) applies to all the personal information at issue in this appeal.

[31] Section 36(1) of the Act gives individuals a general right of access to their own personal information held by an institution. Section 38 provides some exemptions from this right.

[32] Under the section 38(b) exemption, if a record contains the personal information of both the requester and another individual, the institution may refuse to disclose the other individual’s personal information to the requester if disclosing that information would be an “unjustified invasion” of the other individual’s personal privacy.

[33] The section 38(b) exemption is discretionary. This means that the institution can decide to disclose another individual’s personal information to a requester even if doing so would result in an unjustified invasion of the other individual’s personal privacy.

[34] If disclosing another individual’s personal information would not be an unjustified invasion of personal privacy, then the information is not exempt under section 38(b).

[35] Also, the requester’s own personal information, standing alone, cannot be exempt under section 38(b) as its disclosure could not, by definition, be an unjustified invasion of another individual’s personal privacy.[11]

Would disclosure be “an unjustified invasion of personal privacy” under section 38(b)?

[36] Sections 14(1) to (4) provide guidance in deciding whether disclosure would be an unjustified invasion of the other individual’s personal privacy.

Section 14(1) – do any of the exceptions in sections 14(1)(a) to (e) apply?

[37] If any of the section 14(1)(a) to (e) exceptions apply, disclosure would not be an unjustified invasion of personal privacy and the information is not exempt from disclosure under section 38(b).

[38] It is undisputed, and I find (having reviewed the record), that none of these exceptions apply.

Sections 14(2), (3) and (4)

[39] Sections 14(2), (3) and (4) also help in deciding whether disclosure would or would not be an unjustified invasion of personal privacy under section 38(b). Section 14(4) lists situations where disclosure would not be an unjustified invasion of personal privacy, in which case it is not necessary to decide if any of the factors or presumptions in sections 14(2) or (3) apply. (In this appeal, it is undisputed, and I find, that section 14(4) does not apply, so I do not discuss it below.)

[40] Otherwise, in deciding whether the disclosure of the personal information in the records would be an unjustified invasion of personal privacy under section 38(b), the decision-maker[12] must consider and weigh the factors and presumptions in sections 14(2) and (3) and balance the interests of the parties.[13]

Section 14(3) - is disclosure presumed to be an unjustified invasion of personal privacy?

[41] Sections 14(3)(a) to (h) list several situations in which disclosing personal information is presumed to be an unjustified invasion of personal privacy under section 38(b).

[42] The police rely on the presumption at section 14(3)(b). This presumption requires only that there be an investigation into a possible violation of law.[14] The presumption applies if the personal information at issue was clearly compiled and is identifiable as part of an investigation into a possible violation of law. The appellant’s counsel notes the police’s claim about section 14(3)(b) and does not dispute it. In these circumstances and considering the nature of the record (a police report generated as part of an investigation into a boating accident), I find that the presumption at section 14(3)(b) applies. This weighs significantly against disclosure of the personal information at issue.

Section 14(2): Do any factors in section 14(2) help in deciding if disclosure would be an unjustified invasion of personal privacy?

[43] Section 14(2) lists several factors that may be relevant to determining whether disclosure of personal information would be an unjustified invasion of personal privacy.[15] Some of the factors weigh in favour of disclosure, while others weigh against disclosure.

[44] The list of factors under section 14(2) is not a complete list. The institution must also consider any other circumstances that are relevant, even if these circumstances are not listed under section 14(2).[16]

[45] Each of the first four factors, found in sections 14(2)(a) to (d), if established, would tend to support disclosure of the personal information in question, while the remaining five factors found in sections 14(2) (e) to (i), if established, would tend to support non-disclosure of that information.

[46] The police say that none of the section 14(2) factors apply, however, they made arguments about the heightened sensitivity required due to the age of the people involved in the incident. In the circumstances, I invited the appellant to make representations about the possible application of the factor weighing against disclosure at section 14(2)(f) for highly sensitive information.

[47] The appellant says that section 14(2)(d) is the most important section that applies and does not cite any other listed factor as applying.

14(2)(d): the personal information is relevant to the fair determination of requester’s rights

[48] This section supports disclosure of someone else’s personal information where the information is needed to allow them to participate in a court or tribunal process. The IPC uses a four-part test to decide whether this factor applies. For the factor to apply, all four parts of the test must be met:

1. Is the right in question a right existing in the law, as opposed to a non-legal right based solely on moral or ethical grounds?
2. Is the right related to a legal proceeding that is ongoing or might be brought, as opposed to one that has already been completed?
3. Is the personal information significant to the determination of the right in question?
4. Is the personal information required in order to prepare for the proceeding or to ensure an impartial hearing?[17]

[49] The appellant’s counsel submits that all four parts of the test are met. He states that the appellant needs to pursue legal action only against the “responsible parties” to prevent wrongly pursuing anyone, and to save time and money and to limit unnecessary stress. He also submits that the witnesses would be able to disclose who “the responsible parties [are] whose negligence led to the unfortunate accident” involving the appellant. Notably, for part three of the test, the appellant’s counsel claims that “the appellant proceedings can only be commenced once the information is made available so that only the responsible parties would be impacted” (emphasis added).

[50] Based on my review of the police report and the representations, I am not persuaded that the four-part test for section 14(2)(d) is met.

[51] While possibly pursuing additional individuals could add stress, time, and expense to the determination of the appellant’s rights, that possibility in itself does not necessarily lead to the conclusion that the four-part test for section 14(2)(d) is met.

[52] In my view, the appellant’s counsel’s arguments are unpersuasive about section 14(2)(d) because he does not dispute that the police disclosed many affected parties’ names and contact information already and does not acknowledge that the name of the marina business is also known. In these circumstances, keeping in mind that section 14(2)(d) supports disclosure of someone else’s personal information where the information is needed to allow participation in a court process, I am not persuaded that disclosure of the personal information at issue is needed to allow the appellant to participate in a court process. I reject the position that a legal process “can only be commenced” once the withheld information is disclosed. Therefore, I do not accept that disclosure of the information at issue is significant to determine the appellant’s right in question (under part three of the test) or to prepare for the proceeding or ensure an impartial hearing (under part four of the test).

[53] As a result, based on the evidence before me, I find that the factor at section 14(2)(d) does not apply.

14(2)(f): the personal information is highly sensitive

[54] Section 14(2)(f) is intended to weigh against disclosure when the evidence shows that the personal information is highly sensitive. To be considered “highly sensitive,” there must be a reasonable expectation of significant personal distress if the information is disclosed.[18] For example, personal information about witnesses, complainants or suspects in a police investigation may be considered highly sensitive.[19]

[55] The appellant’s counsel states that it is the injured appellant and his family who have been distressed by the withheld information. He submits that there is no reasonable expectation of significant personal distress to other parties if the information is disclosed because the intent is not “to put potential [d]efendants in distress,” but rather, to ascertain the names and details of any potential defendants, to file a lawsuit.

[56] The appellant’s counsel acknowledges that the personal information about witnesses, complainants or suspects in a police investigation may be considered highly sensitive. However, he submits that the information at issue “would not be sensitive” because it is not requested from an unrelated accident for any malicious purposes. He argues that the boat operators and the company owners were characterized as “related persons,” not as “witnesses, complainants or suspects.” He states that “there were many parties involved in the accident . . . and this mechanism is being used to ascertain” only the relevant parties and not unjustly include irrelevant ones. Therefore, counsel submits that the information requested is not highly sensitive.

[57] Having reviewed the personal information at issue and the representations, I find that the factor at section 14(2)(f) is relevant and weighs against disclosure.

[58] While I accept that the circumstances leading to the police report created distress for the appellant and his family, this is not what is considered under section 14(2)(f). That is because, under section 38(b), what is being considered is whether the personal information of individuals other than the requester should be disclosed. (As discussed, the requester’s own personal information, standing alone, cannot be exempt under section 38(b) as its disclosure could not, by definition, be an unjustified invasion of another individual’s personal privacy.[20])

[59] I do not accept counsel’s argument that the personal information is not “sensitive” because it is not regarding an unrelated incident or because it is not requested for malicious purposes. Such considerations are not necessary for a finding that the personal information is “highly sensitive” under section 14(2)(f). Rather, I find that the personal information at issue is highly sensitive because it relates to individuals who were questioned by police. The fact that they were questioned about a boating accident and a child’s injury only adds to the sensitivity of the matter for these individuals, in my view. In some cases, the witnesses are also young people, which increases the sensitivity of this information.

[60] I reject the submission that any boat operators or owners who may have been questioned by police do not qualify as “witnesses, complainants, or suspects.” Section 14(2)(f) does not require that individuals be characterized as that; the IPC has simply recognized such individuals’ personal information as being an example of personal information to which the factor at section 14(2)(f) may apply. In any event, I find that all affected parties whose personal information is at issue in this appeal (whether they are associated with the company or not) qualify as “witnesses, complainants, or suspects,” in circumstances where the police had been interviewing them in an investigation about a possible violation of law. As a result, I find there is a reasonable expectation of significant personal distress if any personal information is disclosed about any affected party.

[61] Therefore, I find that the factor at section 14(2)(f) applies to the personal information at issue, and that this weighs significantly against disclosure.

Other factors or relevant circumstances

[62] Other considerations [besides the ones listed in sections 14(2)(a) to (i)] must be considered under section 14(2) if they are relevant. These may include, for example, inherent fairness issues[21] or benefit to unknown heirs.[22]

[63] The appellant’s counsel repeatedly notes the desire to avoid naming the wrong parties in a lawsuit. He does not raise this as an unlisted factor but, in my view, it is. I find that this factor weighs in favour of disclosure. However, I do not give it significant weight because, as I found earlier, the appellant’s counsel has several pieces of information with which he can begin a lawsuit (and from there, narrow or expand the list of parties to sue).

Analysis/findings

[64] Under the discretionary personal privacy exemption at section 38(b) (which is considered here because the record contains the requester’s personal information), I must weigh the factors and balance the interests of the parties. That is because the requester would have a higher right of access to records that contain his personal information. Above, I found that a section 14(3) presumption and a section 14(2) listed factor weigh significantly against disclosure, and that one unlisted factor has some weight in favour of disclosure. Weighing the presumption and factors, and the interests of the parties, I find that disclosure of any of the personal information at issue in the police report would be an unjustified invasion of personal privacy to the involved individuals.

[62] Since the personal information withheld had to be considered under the discretionary personal privacy exemption, the police could potentially disclose it even if it qualified for the exemption. I discuss the police’s exercise of that choice (discretion), next.

Did the police exercise its discretion under section 38(b)? If so, should the IPC uphold the exercise of discretion?

[65] The section 38(b) exemption is discretionary, meaning that the institution can decide to disclose information even if the information qualifies for exemption. An institution must exercise its discretion. On appeal, the IPC may determine whether the institution failed to do so.

[66] In addition, the IPC may find that the institution erred in exercising its discretion where, for example,

• it does so in bad faith or for an improper purpose;
• it takes into account irrelevant considerations; or
• it fails to take into account relevant considerations.

[67] In either case, the IPC may send the matter back to the institution for an exercise of discretion based on proper considerations.[23] The IPC cannot, however, substitute its own discretion for that of the institution.[24]

[68] The police explain that all personal information of the appellant was released to him, as well as information regarding the marina business information, including the owner’s names, addresses and telephone numbers.

[69] The police explain that when determining whether or not to release the personal information of the affected parties to the appellant, they considered the purpose of the Act, which states that individuals should have a right of access to their own personal information and that the privacy of individuals should be protected. The police submit that revealing this personal information does not take away from the findings of the police investigation or affect its outcome. I note that in other parts of their representations, the police indicate that they considered the heightened sensitivity required due to the age of the people involved in the incident. Considering these factors, the police submit that they used their discretion not to release the affected parties’ personal information to the appellant because protecting the privacy of the affected parties outweighed any factor that would convince the police to grant access to this type of personal information to the appellant.

[70] The appellant’s counsel again disputes that the information relating to the owner or employees is “personal information” (a position that I rejected under Issue A). He also reiterates that the information is needed to ascertain the proper parties to sue. After noting the police’s view about the significance of protecting the privacy of the affected parties, counsel argues that the age and extent of the injury of his client is a factor that has “enough merit” to lead to disclosure. He submits that the police failed to consider “the relevant issues,” and that the requester (the appellant) had a compelling need to receive the information, so he could pursue his proper legal remedies.

[71] Based on my review of the parties’ representations, the information at issue, and the information disclosed to the appellant, I find that the police exercised their discretion under section 38(b) of the Act. I accept that they did so considering all relevant factors. In my view, the extent of their disclosure to the appellant – including the name and contact information of the marina business – reflects consideration that the appellant is seeking his own personal information, and that the information is significant to him in his overall sensitive circumstances (including his age and injury, and his sympathetic need to receive the information). I also accept that the police considered the purpose of the Act, including the principles that individuals should have a right of access to their own personal information, and the privacy of individuals should be protected.

[72] There is no evidence before me that the police exercised their discretion in bad faith or for improper purposes, or that they considered irrelevant factors in coming to their decision to apply section 38(b) of the Act to the information at issue.

[73] For these reasons, I uphold the police’s decision to withhold the information at issue under section 38(b), and I dismiss the appeal.

ORDER:

I uphold the police’s decision and I dismiss the appeal.

Original Signed by:		April 17, 2025
Marian Sami
Adjudicator