ORDER PO-4657

Appeal PA21-00630

Ontario Securities Commission

May 16, 2025

Summary: An individual made a request under the Freedom of Information and Protection of Privacy Act  for records related to complaints made about them to the Ontario Securities Commission. The OSC disclosed to the individual some records. It withheld some records on the basis that their disclosure could reasonably be expected to reveal investigative techniques and procedures currently in use or likely to be used by the OSC (section 49(a), read with section 14(1)(c)) and would result in an unjustified invasion of other individual’s personal privacy (section 49(b)).

The individual disagreed with the OSC’s decision and claimed that the OSC’s search for records was not reasonable.

In this order, the adjudicator orders the OSC to disclose additional information to the appellant and otherwise upholds the OSC’s decision.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, sections 2(1) (definition of “personal information”), 21(1), 21(3)(b), 24, and 49(b).

Orders Considered: Orders P-1321 and PO-1929.

OVERVIEW:

[1] This order determines whether the information at issue qualifies as “personal information” under the Freedom of Information and Protection of Privacy Act  (the Act ) and if so, whether it is exempt from disclosure under the personal privacy exemption (section 49(b)) of the Act . This order also determines whether the Ontario Securities Commission (the OSC) conducted a reasonable search for records responsive to the appellant’s request.

[2] The OSC’s Inquiries and Contact Centre received a complaint about the appellant. The complaint was assigned to an investigator in the Enforcement Branch (the OSC investigator) who investigated the allegations raised by the complaint. At the conclusion of the investigation, the OSC investigator closed the file.

[3] Subsequently, the appellant made a request under the Act  to the OSC for all records within specified period of time involving complaints made against them or any company to which they were or are related.

[4] The Ministry of Finance[1] (the ministry), on behalf of the OSC, issued a decision, granting partial access to records. The ministry denied access to some records on the basis of “sections 14  and 49 ” of the Act .

[5] The appellant sought access to the withheld information and appealed the decision to the Information and Privacy Commissioner of Ontario (the IPC).

[6] During mediation, the OSC clarified that the exemptions it claimed were the discretionary exemptions in section 49(a) (discretion to refuse requester’s own information), read with section 14(1)(c) (reveal investigative techniques and procedures), and section 49(b) (personal privacy). In addition, during mediation, the OSC granted the appellant further access to some information in the records.

[7] The appellant raised the issue of whether the OSC conducted a reasonable search. The mediator shared with the appellant the information that the OSC provided about its search. The appellant confirmed that they wished to pursue the issue of reasonable search in this appeal. Accordingly, the issue was added to this appeal.

[8] The mediator attempted but was unable to obtain consent from an affected party to allow the OSC to disclose additional information to the appellant.

[9] Since the appeal did not resolve at mediation, it was transferred to the adjudication stage of the appeals process, where an IPC adjudicator decided to conduct an inquiry under the Act . The adjudicator sought, received and shared representations of the OSC and the appellant in accordance with the IPC’s Code of Procedure and Practice Direction Number 7.

[10] During the inquiry, the appellant narrowed the scope of the request to the complaint filed against them, any document that the OSC received from the complainant in relation to the complaint, and any record of any information that the OSC received from the complainant (the information at issue).

[11] The appeal was then transferred to me to continue the inquiry. I reviewed the records and the materials submitted by the appellant and the OSC, and decided to seek representations from an affected party who provided confidential representations.

[12] For the reasons that follow, I partially uphold the OSC’s decision. I find that some information withheld under the personal privacy exemption is not exempt, and I order the OSC to disclose it to the appellant. I uphold the OSC’s decision to withhold the remaining information. I also uphold the OSC’s search as reasonable.

RECORDS:

[13] Having reviewed the records, I determined that two out of twelve withheld records contain the information at issue on the basis of the scope as narrowed by the appellant:

1. An attachment to an email at pages 24 and 25 of the package of records disclosed to the appellant (record 1); and
2. Inquiries and Contact Centre record at pages 58 to 60 of the package of records disclosed to the appellant (record 2).

[14] The OSC claims only the discretionary personal privacy exemption at section 49(b) to the information at issue in records 1 and 2. Therefore, it is not necessary to discuss the other pages at issue and corresponding exemption claims.

[15] The reasonableness of the OSC’s search continues to be at issue.

ISSUES:

1. Do the records contain “personal information” as defined in section 2(1) and, if so, whose personal information is it?
2. Does the discretionary personal privacy exemption at section 49(b) apply to the information at issue in records 1 and 2?
3. Did the OSC conduct a reasonable search for records?

DISCUSSION:

Issue A: Do the records contain “personal information” as defined in section 2(1) and, if so, whose personal information is it?

[16] The OSC withheld the information at issue on the basis that it is exempt from disclosure under section 49 (b) of the Act . For section 49(b) to apply, the records must contain “personal information” of the requester (in this case who is the appellant) and “personal information” of other individuals. If the records contain the appellant’s own personal information, the appellant’s access rights are greater than if they do not.[2] If the records contain the personal information of other individuals, one of the personal privacy exemptions might apply.[3]

[17] Section 2(1)  of the Act  defines “personal information” as “recorded information about an identifiable individual.” “Recorded information” is information recorded in any format, such as paper records, electronic records, digital photographs, videos, or maps.[4] Information is “about” the individual when it refers to them in their personal capacity, which means that it reveals something of a personal nature about the individual. Information is about an “identifiable individual” if it is reasonable to expect that an individual can be identified from the information either by itself or if combined with other information.[5]

[18] Section 2(1)  of the Act  gives a list of examples of personal information. It states, in part:

“personal information” means recorded information about an identifiable individual, including,

(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(d) the address, telephone number, fingerprints or blood type of the individual,

(h) the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.

[19] The list of examples of personal information under section 2(1) is not a complete list. This means that other kinds of information could also be “personal information.”[6]

Parties’ representations

[20] The OSC submits that records 1 and 2 contain personal information of the individual who made a complaint about the appellant to the OSC. The OSC says that both records contain the complainant’s full name, and one record also contains the complainant’s personal email. The affected party makes similar submissions.

[21] On the issue of severance, the OSC submits that the information in the records cannot be severed. The OSC says that if the complainant’s personal information is severed from the records, the remaining information would comprise of meaningless snippets of information and text that would not be useful to the appellant.

[22] The appellant’s representations do not address this issue.

Analysis and finding

[23] I find that both records contain the appellant’s personal information. The records relate to an investigation of the appellant’s activities and consist of information of a personal nature about the appellant.

[24] In addition to the appellant’s personal information, the records contain the complainant’s personal information, such as the complainant’s name, email, sex and other information in accordance with paragraphs (a), (d), and (h) of section 2(1) of the Act and the introductory wording of the definition of “personal information.”

[25] Section 10(2)  of the Act  obliges the OSC to disclose as much information as can reasonably be severed without disclosing information which is exempt. I find that in both records, the complainant’s personal information can be severed from the remaining information at issue. After the complainant’s personal information is severed, the remaining information at issue is the substance of the complaint made to the OSC. Neither the OSC nor the affected party provided me with sufficient evidence to establish that the disclosure of the substance of the complaint without the complainant’s personal information would reveal the complainant’s identity. Accordingly, after the complainant’s personal information is severed from records 1 and 2, the only personal information remaining on these pages is the appellant’s.

[26] Given that the complainant’s personal information can be severed from the remaining information at issue in both records; that the OSC did not claim any other discretionary exemption with respect to the information that is not the complainant’s personal information; and no mandatory exemptions apply, I will order the OSC to disclose this information to the appellant. I highlighted in blue on a copy of the pages of records that I will provide to the OSC the information that I order the OSC to disclose.

[27] The appellant, however, seeks access to all of the information provided to the OSC by the complainant, which would include the information that I have found above to be the complainant’s personal information. Therefore, I will next consider whether the complainant’s personal information is exempt under the personal privacy exemption at section 49(b).

Issue B: Does the discretionary personal privacy exemption at section 49(b) apply to the information at issue in records 1 and 2?

[28] Records 1 and 2 contain the appellant’s personal information. Section 47(1)  of the Act  gives individuals a general right of access to their own personal information held by an institution. Section 49 provides some exemptions from this right.

[29] Under the section 49(b) exemption, if a record contains the personal information of both the requester (the appellant in this case) and another individual, the institution may refuse to disclose the other individual’s personal information to the requester if disclosing that information would be an “unjustified invasion” of the other individual’s personal privacy.

[30] The section 49(b) exemption is discretionary. This means that the institution can decide to disclose another individual’s personal information to a requester even if doing so would result in an unjustified invasion of another individual’s personal privacy.[7] If disclosing another individual’s personal information would not be an unjustified invasion of personal privacy, then the information is not exempt under section 49(b).

[31] Sections 21(1) to (4) provide guidance in deciding whether disclosure would be an unjustified invasion of another individual’s personal privacy.

[32] If any of the exceptions in section 21(1)(a) to (e) apply, disclosure would not be an unjustified invasion of personal privacy, and the information is not exempt from disclosure under section 49(b). I find that none of the exceptions in sections 21(1)(a) to (e) apply.

[33] Sections 21(2), (3) and (4) help in deciding whether disclosure would or would not be an unjustified invasion of personal privacy under section 49(b). Section 21(4) lists situations where disclosure would not be an unjustified invasion of personal privacy, in which case it is not necessary to decide if any of the factors or presumptions in sections 21(2) or (3) apply. I find that none of the situations listed in section 21(4) are present in this appeal.

[34] Otherwise, in deciding whether the disclosure of the personal information in the records would be an unjustified invasion of personal privacy under section 49(b), the decision-maker[8] must consider and weigh the factors and presumptions in sections 21(2) and (3) and balance the interests of the parties.[9]

Appellant’s representations

[35] The appellant asks that I review and determine whether the personal privacy exemption was properly applied by the OSC.

OSC’s representations

[36] The OSC submits that the disclosure of the complainant’s personal information would constitute an unjustified invasion of their personal privacy. The OSC relies on one presumption and three factors that weigh against the disclosure of the complainant’s personal information. The OSC argues that there are no factors that weigh in favour of the disclosure of the complainant’s personal information.

[37] The OSC submits that the disclosure of the complainant’s personal information is presumed to be an unjustified invasion of their personal privacy because the personal information was compiled as part of an investigation into a possible violation of law (the presumption at section 21(3)(b)). The OSC says that it started an investigation into the appellant as a result of the complainant’s communication with the OSC.

[38] The OSC made arguments about the relevance of factors at section 21(2). Because of my finding below that the section 21(3)(b) presumption applies and because the appellant has not raised any arguments about factors that weigh in favour of disclosure, I did not need to consider these arguments, and I do not repeat them in this order.

Analysis and findings

21(3)(b): investigation into a possible violation of law

[39] I find that the presumption at section 21(3)(b) applies to the complainant’s personal information because it was compiled and is identifiable as part of an investigation into a possible violation of law.

[40] The presumption at section 21(3)(b) applies to different types of investigations, including those relating to by-law enforcement,[10] and enforcement of environmental laws,[11] occupational health and safety laws,[12] or the Ontario  Human Rights Code .[13] Prior IPC orders have held that the presumption applies to an OSC investigation.[14]

[41] This presumption requires only that there be an investigation into a possible violation of law.[15] There is no dispute between the parties that the OSC investigated the appellant with respect to a possible violation of the Ontario Securities Act . Therefore, even if legal proceedings were never started against the appellant, section 21(3)(b) still applies.[16]

[42] Having reviewed the records, I am satisfied that the complainant’s personal information was compiled as part of an OSC investigation. The complainant made a complaint about the appellant to the OSC, which resulted in an OSC investigation. The OSC gathered the complainant’s personal information when it received the complaint.

[43] This presumption weighs against the disclosure.

Balancing of factors, presumptions, and interests of the parties

[44] I find that the disclosure of the complainant’s personal information would constitute an unjustified invasion of the complainant’s personal privacy and therefore qualifies for an exemption under section 49(b).

[45] To reach this conclusion, I balanced the interests of the appellant and the complainant. I considered that the appellant seeks access to information about an investigation that relates to them. I balanced the appellant’s interests with the interests of the complainant in their personal information being protected. In particular, I have considered the type of personal information at issue. The interests of privacy protection weighed more heavily because one of the purposes of the Act  is to protect the privacy of individuals with respect to their personal information held by institutions.[17]

[46] To reach my conclusion, I also considered that there is a presumption that weighs against the disclosure and that there are no factors that weigh in favour of the disclosure.

Exercise of discretion

[47] The section 49(b) exemption is discretionary, which means that the institution can decide to disclose information even if the information qualifies for exemption. An institution must exercise its discretion. On appeal, the IPC may determine whether the institution failed to do so. In addition, the IPC may find that the institution erred in exercising its discretion where it does so in bad faith or for an improper purpose; takes into account irrelevant considerations; or fails to take into account relevant considerations.

[48] It is apparent from the OSC’s representations that it considered the following factors in making its decision with respect to the request:

1. The disclosure of the records would reveal the complainant’s personal information, potentially causing harm to them and dissuading others from making complaints to the OSC;
2. The appellant does not have a compelling need to receive the withheld information and has not articulated a meaningful reason for seeking it; and
3. The information is sensitive to the OSC. The disclosure of information would diminish the integrity of the OSC’s enforcement investigations and decrease public confidence in the OSC’s ability to effectively investigate breaches of capital markets law and achieve its mandate.

[49] I find that the OSC properly exercised its discretion. The OSC considered the interests that the personal privacy exemption seeks to protect, the reason for the appellant’s request, and the impact of the disclosure of the information on public confidence in its operation.

[50] There is no evidence before me that the OSC exercised its discretion in bad faith, for improper purpose or taking into account irrelevant considerations.

Issue C: Did the OSC conduct a reasonable search for records?

[51] The appellant claims that the OSC did not conduct a reasonable search for records as required by section 24  of the Act .[18]

[52] A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request makes a reasonable effort to locate records that are reasonably related to the request.[19] The Act  does not require the institution to prove with certainty that further records do not exist. However, the institution must provide enough evidence to show that it has made a reasonable effort to identify and locate responsive records;[20] that is, records that are "reasonably related” to the request.[21]

[53] Although a requester will rarely be in a position to indicate precisely which records the institution has not identified, they still must provide a reasonable basis for concluding that such records exist.[22]

Analysis and finding

[54] As explained in more detail below, the OSC provided detailed evidence of its search. The appellant did not make representations about this issue.

[55] For the reasons that follow, I find that the OSC’s search was reasonable. I reached this conclusion on the basis of the evidence provided by OSC that:

• A Law Clerk of the OSC’s General Counsel’s Office and the OSC investigator conducted searches in response to the request;
• The searches of both OSC databases that contain records of third-party complaints revealed that the OSC had received only one complaint about the appellant. This was the complaint that was assigned to, investigated by, and closed by the OSC investigator;
• The OSC investigator provided all records related to their investigation, including email correspondence with the appellant, notes and other investigative records. The OSC investigator was the only staff involved in the investigation;
• The Law Clerk conducted searches in both OSC databases and located responsive records; and
• The OSC disclosed to the appellant all responsive records that were located as a result of the searches, except for records or portions of records with respect to which it claimed exemptions under the Act .

[56] I am satisfied that the OSC employees who conducted the searches for responsive records are experienced employees knowledgeable in the subject matter of the request. I am also satisfied that these employees made a reasonable effort to locate records responsive to the request. The Law Clerk conducted searches in both databases that would contain information about third-party complaints. The OSC investigator who investigated the only complaint about the appellant provided all investigative records.

[57] The appellant did not provide any representations to establish that additional records might exist.

ORDER:

1. I order the OSC to disclose to the appellant the information that I have highlighted in blue on a copy of the pages of the records that I have provided to the OSC together with a copy of this order. The OSC is to send the information to the appellant by June 20, 2025, but not before June 16, 2025.
2. In order to ensure compliance with paragraph 1, I reserve the right to require the OSC to send me a copy of the pages of the records as disclosed to the appellant.
3. In all other respects, I uphold the OSC’s decision.

Original Signed by:		May 16, 2025
Anna Kalinichenko
Adjudicator