ORDER MO-4671

Appeal MA23-00423

Toronto District School Board

June 25, 2025

Summary: This order considers an individual’s access under the Municipal Freedom of Information and Protection of Privacy Act to an agreement between a third party and a school board. The agreement is for the board’s student information system, which stores and manages student data.

The board disclosed the main agreement and withheld the exhibits to the agreement under the mandatory exemption for information of a third party (section 10(1)) and the discretionary exemption that considers the institution’s economic and other interests (sections 11(a), (c) and (d)).

In this order, the adjudicator finds that the records are not exempt under either section 10(1) or section 11 and orders the board to disclose them.

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act, sections 10(1), 11(a), 11(c) and 11(d).

Orders Considered: MO-2299, MO-3129, MO-2801, PO-4529 and PO-4084.

Cases Considered: Miller Transit Limited v. Information and Privacy Commissioner of Ontario et al., 2013 ONSC 7139.

OVERVIEW:

[1] The appellant, a member of the media, made a request to the Toronto District School Board (the board) under the Municipal Freedom of Information and Protection of Privacy Act (the Act) for “a copy of the contract with the third-party vendor responsible for conducting the random selection process for the Elementary Alternative Schools Central Application Process.”

[2] The board identified a responsive record and notified an affected party. The board then issued a decision denying access to the record in full, claiming sections 10(1) (third party information) and 11(a), (c), and (d) (economic and other interests) of the Act. The requester (now the appellant) appealed the board’s decision to the Information and Privacy Commissioner of Ontario (IPC).

[3] During mediation, the board issued a revised decision letter clarifying that there is “no specific contract…for conducting the random selection process for the Elementary Alternative Schools Central Application Process,” but that there is a contract for the board’s Student Information System (SIS).[1] The board decided to disclose this contract in part, and continued to claim sections 10(1) and 11(a), (c), and (d) of the Act to withhold the remaining portions. After notifying the affected party of its revised decision, the board disclosed the contract, in part, to the appellant.

[4] The appellant continued to seek access to the withheld portions of the contract and claimed the public interest override in section 16 of the Act. The board confirmed its access decision.

[5] As mediation did not resolve the appeal it was transferred to the adjudication stage of the appeals process, where an adjudicator may conduct an inquiry. The adjudicator originally assigned to this appeal sought and received representations from the board and the appellant.[2] The affected party was invited to submit representations, but did not provide any. The file was assigned to me to continue the adjudication of the appeal. I determined that it was not necessary for me to seek further representations from the parties.

[6] For the reasons that follow, I find that the records at issue are not exempt from disclosure under sections 10(1), 11(a), 11(c) and 11(d). I order the board to disclose them to the appellant.

RECORDS:

[7] The “Main Service Agreement and Service Level Agreement” for the provision of the board’s SIS (the main agreement) was disclosed to the appellant during mediation. The exhibits to the main agreement remain at issue.

[8] The following table outlines which exemptions were claimed for each of these exhibits, as well as Schedule 1 to Exhibit D (Schedule 1), and Annex A and B to Schedule 1 (Annex A and B).[3]

Record	Pages	Exemptions Claimed
Exhibit A “Support Policy”	16-17	10(1), 11(c), 11(d)
Exhibit B “Professional Services Policy”	18-19	10(1), 11(c), 11(d)
Exhibit C “Hosting Services Policy”	20-21	10(1), 11(c), 11(d)
Exhibit D “Data Privacy and Security”	22-27	10(1), 11(c), 11(d)
Schedule 1 – Exhibit D “Standard Contractual Clauses”	28-34	10(1), 11(c), 11(d)
Annex A	35-36	10(1), 11(c), 11(d)
Annex B	37	10(1), 11(c), 11(d)
Exhibit E “Product Specific Terms”	38-40	10(1), 11(c), 11(d)
Exhibit F “Certificate of Insurance”	41-43	10(1), 11(c), 11(d)
Exhibit G “Hosting Services & SLA”	44-54	10(1), 11(c), 11(d)
Exhibit H “TDSB Cyber Risk and Privacy Checklist”	55-67	10(1), 11(a)

[9] The signature page at page 15 of the main agreement also remains at issue.

ISSUES:

1. Does the mandatory exemption at section 10(1) apply to the records?
2. Do the discretionary exemptions at sections 11(a), (c), and/or (d) apply to the records?

DISCUSSION:

[10] I have reviewed the parties’ representations in full and only refer to the portions most relevant to the issues in this appeal. The appellant did not make representations about whether the records are exempt under section 10(1) or section 11 of the Act, therefore only the board’s representations are referred to below.

Issue A: Does the mandatory exemption at section 10(1) apply to the records?

[11] The board submits that Exhibits A through H, Schedule 1, and Annex A and B are subject to the mandatory exemption for third party information. The board did not specify which subsections of section 10(1) apply. Based on its representations, I find that sections 10(1)(a) and (c) may be relevant.

A head shall refuse to disclose a record that reveals a trade secret or scientific, technical, commercial, financial or labour relations information, supplied in confidence implicitly or explicitly, if the disclosure could reasonably be expected to,

(a) prejudice significantly the competitive position or interfere significantly with the contractual or other negotiations of a person, group of persons, or organization;

(c) result in undue loss or gain to any person, group, committee or financial institution or agency[.]

[12] For section 10(1) to apply, the board or affected party must satisfy each part of the following three-part test:

1. the record must reveal information that is a trade secret or scientific, technical, commercial, financial or labour relations information;
2. the information must have been supplied to the institution in confidence, either implicitly or explicitly; and
3. the prospect of disclosure of the record must give rise to a reasonable expectation that one of the harms specified in paragraph (a), (b), (c) and/or (d) of section 10(1) will occur.

Part 1: Type of information

[13] As noted above, to satisfy part one of the section 10(1) test, the board or the affected party must show that the records contain information that is a trade secret or scientific, technical, commercial, financial or labour relations information.

[14] The board submits that the records contain either trade secrets, technical information or both.

[15] These have been discussed by the IPC in previous orders and described as follows:

Trade secret includes information such as a formula, pattern, compilation, programme, method, technique, or process or information contained or embodied in a product, device or mechanism which:

a) is, or may be used in a trade or business;

b) is not generally known in that trade or business;

c) has economic value from not being generally known; and

d) is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.[4]

Technical information is information belonging to an organized field of knowledge in the applied sciences or mechanical arts. Examples of these fields include architecture, engineering or electronics. Technical information usually involves information prepared by a professional in the field, and describes the construction, operation or maintenance of a structure, process, equipment or thing.[5]

Commercial information is information that relates only to the buying, selling or exchange of merchandise or services. This term can apply to commercial or non-profit organizations, large or small.[6]

[16] Based on my review of the records, I find that they contain either commercial or technical information. The records are exhibits to the main agreement. Each elaborates on different aspects of the commercial relationship between the board and the affected party for the provision of a SIS. The exhibits specify the terms governing the matters identified in each of their titles. For instance, Exhibit A is entitled “Support Policy” and contains terms relating to the provision of support services for the SIS by the affected party to the board. Exhibit F does not contain terms between the board and the affected party, however it still relates to the purchase of a service. Exhibit F contains certificates of insurance between the affected party and third-party providers that detail insurance coverage for specified periods of time. In light of the above, I am satisfied that all of the records at issue contain commercial information.

[17] The board submits that Exhibits C, D, G and H, Schedule 1 and Annex B contain technical information relating to the functionality and capability of IT systems. Based on my review of the records, I agree that these records contain some technical information relating to the operation or maintenance of an information system prepared by an IT professional or programmer.

[18] I do not agree with the board that Exhibits A, B, D, E, F, G and Annex A contain trade secrets. According to the board, “these records contain trade secrets that refer to methods and processes which are embodied in a product…are not generally known, have economic value from not generally being known, and are the subject of efforts that are reasonable under the circumstances to maintain secrecy.” The board points to a confidentiality clause at section 3.3 of the main agreement as evidence to the parties’ efforts to keep the information confidential. The board also submits that some of these records are directly related to the affected party’s business model and product offering, and others contain information about the software and technical operation of the SIS.

[19] I am not persuaded by the board’s representations. The board declares that the above-noted records contain trade secrets, however it does not explain how they meet the criteria listed above. The board does not describe how their content might qualify as a formula, pattern, compilation, programme, method, technique, or process or information contained or embodied in a product, device or mechanism. Nor does it explain how the other parts of the definition are met beyond the presence of a confidentiality clause.

[20] Having found that all of the exhibits at issue contain either commercial or technical information, the requirements of part 1 have been met and I will consider part 2 next.

[21] Lastly, the final page of the main agreement, the signature page, remains undisclosed. It contains the parties’ names, their representatives, their signatures, and the date. As the signature page is part of the main agreement, which is a contract containing commercial information, I find that it also contains commercial information. Accordingly, I will also consider it under part 2.

Part 2: supplied in confidence

Supplied

[22] The requirement that the information was “supplied” to the institution reflects the purpose in section 10(1) of protecting the informational assets of third parties.[7]

[23] Information may qualify as “supplied” if it was directly supplied to an institution by a third party, or where its disclosure would reveal or permit the drawing of accurate inferences with respect to information supplied by a third party.[8]

[24] The contents of a contract involving an institution and a third party will not normally qualify as having been “supplied” for the purpose of section 10(1). The provisions of a contract, in general, have been treated as mutually generated, rather than “supplied” for the purpose of section 10(1). Past IPC orders have, in general, treated the provisions of a contract as mutually generated, rather than “supplied” by the third party, even where the contract is preceded by little or no negotiation or where the final agreement reflects information that originated from a single party. This approach was approved by the Divisional Court in Boeing Co. v. Ontario (Ministry of Economic Development and Trade).[9]

[25] There are two exceptions to this general rule, which are described as the “inferred disclosure” and “immutability” exceptions. The “inferred disclosure” exception applies where disclosure of the information in a contract would permit accurate inferences to be made with respect to underlying non-negotiated confidential information that the affected party supplied to the institution. The “immutability” exception applies to information that is immutable or is not susceptible to change.[10]

Representations, analysis and findings

[26] As mentioned above, the records at issue are exhibits to the main agreement between the board and the affected party for a SIS. The board explains that the SIS stores and manages student records for current and past students, including personal information like demographic data, grades, parent/guardian information, attendance, and medical information.

[27] In Order MO-2299, the adjudicator considered whether a proposal, which was appended as a series of schedules to an agreement, was supplied. He stated:

I have carefully examined Schedules F, G and H. These three schedules are referred to by the third party as its “proposal” (Schedule F) and two “complement[s]” to its proposal (Schedules G and H). On my review of these documents, they do appear to be a confidential proposal and two related records, provided by the third party to the City. I accept that at the time these records were provided to the City (which appears to have been during the time that the agreement was being negotiated), these records may well have been “supplied” to the City in confidence for the purpose of section 10(1). However, the parties subsequently chose to incorporate these records into the agreement entered into between them. The agreement clearly refers to these three schedules as forming part of the agreement, and as containing certain terms of the agreement.

In my view, by incorporating these documents into the agreement, and by having them form part of the agreement, these documents can no longer be considered to have been “supplied” by the third party. Rather, these documents constitute the agreed, negotiated terms of the agreement.

[Emphasis added]

[28] In Order PO-4529, the adjudicator, cited Order MO-2299 and applied the same approach with respect to whether a schedule to an agreement was supplied under part 2.[11] She stated:

[31] From my review of Schedule I, I find that it was not supplied by the appellant for the purposes of section 17(1). Schedule I is one of several schedules attached to the agreement between the ministry and the appellant in which the appellant agreed to operate a training program for Home Support Workers in return for receiving funds from the ministry. It describes the appellant’s SDF project and plan.

[32] Similar to the circumstances in Order MO-2299, the agreement clearly refers to Schedule I as forming part of the agreement and as containing certain terms of the agreement. By incorporating Schedule I into the agreement, and by having it form part of the agreement, I find Schedule I can not be considered to have been “supplied” by the appellant.

[29] I agree with and adopt the approach in Orders MO-2299 and PO-4529 for the purposes of this appeal.

[30] As mentioned above, the provisions of a contract have generally been treated as mutually generated, and not “supplied” under section 10(1). Based on my review of the records, I find that the exhibits form part of the main agreement. Similar to the schedules in the above-mentioned orders, the main agreement makes direct reference to the exhibits at issue. The table of contents in the main agreement lists each section of the main agreement, followed by each of the exhibits. In Section 1 of the main agreement on definitions, the word “agreement” is defined to include the main agreement “and all referenced exhibits.”[12] There is a similar reference in Section 14 on general provisions.[13] The exhibits at issue outline terms and conditions that flow from the main agreement, or otherwise elaborate on it. Furthermore, except for Exhibits G and H, all the exhibits are explicitly referenced in the body of the main agreement. I have also reviewed the contents of the exhibits and, aside from Exhibit F addressed below, they contain different terms and conditions about various aspects of the main agreement, as denoted in their titles.

[31] The board submits that the “inferred disclosure” exception applies in this case. In its view, disclosure would permit accurate inferences to be made with respect to underlying non-negotiated confidential information supplied by the affected party. I have reviewed the board’s confidential representations. Without revealing their substance, in my view, the board does not explain how the exception is applicable.

[32] In Miller Transit Limited v. Information and Privacy Commissioner of Ontario et al. (Miller Transit),[14] the Ontario Divisional Court explained the “inferred disclosure” exception in the following way:

The inferred disclosure exception arises where information actually supplied does not appear on the face of a contract but may be inferred from its disclosure. The onus is on the party to show “convincing evidence that disclosure of the information ...would permit an accurate inference to be made of underlying non-negotiated confidential information supplied by the affected party...”: see Order MO-1706, Peel District School Board, [2003] O.I.P.C. No. 238, at paras. 52-53 [.]

[33] At paragraph 43 the court wrote:

... It applies where contractual information gives rise to an inference, not that the very same information may be found in materials provided by a third party, but that other, confidential, information belonging to the third party may be gleaned by reference to contractual information. That is not the situation here: Miller Transit argues that contractual terms and information mirror documents provided by it to York Region.

[Emphasis added]

[34] The board asserts that disclosure of most of the exhibits at issue would permit accurate inferences to be made with respect to underlying non-negotiated confidential information supplied by the affected party to the board. Aside from listing broad categories of information, the board does not specify what underlying non-negotiated confidential information may be gleaned from disclosure of the records, or how the records might be used to make such inferences. I have also reviewed the exhibits in detail, and am unable to identify information that would allow such inferences. Based on the evidence before me, I am not satisfied that the inferred disclosure exception applies in this case. With one exception addressed below, I find that the board has not established that the exhibits at issue were supplied to it by the affected party. It is therefore unnecessary for me to address whether the information was supplied in confidence. As a result, I find that Exhibits A, B, C, D, E, G and H, Schedule 1, and Annex A and B are not exempt under section 10(1). I will consider whether they are exempt under section 11 below.

[35] The board also submits that similar records were found exempt under section 10(1) in Order MO-2801, which involved records related to a municipality’s contract for a Contact Management System. The board’s representations are confidential, and therefore, I cannot reproduce them here. Without revealing the substance of these representations, the board submits that some of the records withheld in Order MO-2801 are analogous to several of the records at issue.

[36] I have reviewed the records and the board’s confidential representations in detail, and I am not persuaded that the relevant records in Order MO-2801 are analogous to those at issue here. In Order MO-2801, the adjudicator found that the relevant records were supplied in confidence, either because they did not form part of the successful bid in response to the municipality’s request for proposals, or they fell under the inferred disclosure exception. Neither are the case here. As I found above, apart from Exhibit F, the records at issue form part of the main agreement and do not fall under the inferred disclosure exception.

[37] The board makes confidential representations with respect to Exhibit F. Without revealing the substance of these representations, I understand that the board raises the immutability exception with respect to Exhibit F. As noted above, Exhibit F is titled “Certificate of Insurance”.

[38] The immutability exception arises where the contract contains information supplied by the third party and the information is not susceptible to negotiation. Examples are financial statements, underlying fixed costs and product samples or designs.[15]

[39] Based on my review of Exhibit F, I find that it is information supplied by the affected party to the board. I am satisfied that Exhibit F contains information that is not susceptible to negotiation, namely certificates of insurance between the affected party and their insurance providers.

[40] Finally, I have also considered whether the inferred disclosure and immutability exceptions apply to the signature page. Based on my review of the signature page, it is part of the contract and does not reveal non-negotiated information nor can such information be inferred from it. I find that neither of the exceptions apply, that the signature page is not supplied for the purposes of part two and therefore not exempt under section 10(1). Accordingly, I will consider whether it is exempt under section 11.

In confidence

[41] I will now address whether Exhibit F was supplied in confidence.

[42] In order to satisfy the “in confidence” component of part two, the party resisting disclosure must establish that, as the supplier of the information, it had a reasonable expectation of confidentiality, implicit or explicit, at the time the information was provided.[16]

[43] In determining whether an expectation of confidentiality is based on reasonable and objective grounds, all the circumstances of the case must be considered, including whether the information was:

• communicated to the institution on the basis that it was confidential and that it was to be kept confidential,
• treated consistently by the third party in a manner that indicates a concern for confidentiality,
• not otherwise disclosed or available from sources to which the public has access, and
• prepared for a purpose that would not entail disclosure.[17]

Representations, analysis and findings

[44] The board submits that the affected party supplied the records to the board in confidence. The board cites the confidentiality clause at section 3.3 of the main agreement which states that the contract must be kept confidential and must not be shared without the affected party’s consent. The board also notes that the records are not publicly available.

[45] In the circumstances at hand, I agree with the board that the affected party supplied Exhibit F to the board in confidence. Exhibit F and the other exhibits at issue form part of the main agreement, however, unlike the other exhibits at issue, Exhibit F contains information that was not susceptible to negotiation. As noted above, Exhibit F contains certificates of insurance between the affected party and third-party companies – the board was not party to the agreements that produced these certificates.

[46] Previous IPC orders have also found that agreements between private, non-governmental entities are supplied in confidence under part 2 of the Section 10(1) test.[18]

[47] Taking into account these previous orders, the presence of the confidentiality clause in the main agreement, and that the information in Exhibit F would not be generally known, I accept that the affected party supplied this information with a reasonably held expectation of confidentiality.

Part 3: harms

[48] Parties resisting disclosure of a record cannot simply assert that the harms under section 10(1) are obvious based on the record. They must provide detailed evidence about the risk of harm if the record is disclosed. While harm can sometimes be inferred from the records themselves or the surrounding circumstances, parties should not assume that the harms under section 10(1) are self-evident and can be proven simply by repeating the description of harms in the Act.[19]

[49] Parties resisting disclosure must show that the risk of harm is real and not just a possibility.[20] However, they do not have to prove that disclosure will in fact result in harm. How much and what kind of evidence is needed to establish the harm depends on the context of the request and the seriousness of the consequences of disclosing the information.[21]

Representations, analysis and findings

[50] As noted above, the board did not specify which subsections of section 10(1) apply. Based on its representations, I find that sections 10(1)(a) and (c) may be relevant. Sections 10(1)(a) and (c) seek to protect information that could be exploited in the marketplace.[22]

[51] In its representations, the board does not address Exhibit F specifically. It argues that harms could reasonably result from the disclosure of all the records at issue. As I have found the other records at issue are not supplied for the purposes of part 2, I will consider the board’s representations with respect to Exhibit F, the record remaining at issue under Section 10(1).

[52] The board submits that disclosure could reasonably be expected to result in harm from an increased risk of cybersecurity incidents. The board argues that the risk of cybersecurity attacks to large public institutions with significant financial resources is high because they are attractive targets. It notes that in the last three years at least three school boards in Ontario have publicly acknowledged a cyber incident. The board claims that to disclose to a member of the media the information at issue, which relates to an application that stores sensitive student data, creates a significant risk of harm. The board also makes confidential representations under part 3, which, at a high level, address the potential consequences of disclosing the type of information at issue.

[53] In its representations the board points to its vulnerability to cyber incidents as a large public institution, to potential harms in the event of a cyber incident, and to other school boards targeted in cyber incidents. However, the board does not explain how disclosure of the information at issue, and specifically Exhibit F, could reasonably give rise to harms under sections 10(1)(a) or (c). Based on my review of Exhibit F, I am also not satisfied that harm can be inferred from the record itself.

[54] Furthermore, several orders have found that insurance information is not exempt under section 10(1) and does not meet part 3 of the test. In Order PO-4084, the adjudicator canvassed the other relevant orders in her analysis:[23]

[68] With regard to Record 13, I also fail to see how its release could be harmful and/or prejudicial to the appellant’s economic interests […] The remaining information in Record 13 is comprised of a cheque and an outdated Certificate of Insurance. The certificate expired in 2017 and the appellant has not explained how any of this information could be harmful or prejudicial to its economic interests.

[69] I note that in Orders PO-3158 and PO-3841, adjudicators concluded that affected parties’ Certificates of Insurance did not provide the kind of insight into their current and proposed business strategies that could reasonably be expected to lead to the harms contemplated by section 17(1). Similar to these findings, I cannot identify any information in the last two pages of Record 13 that would be valuable to a competitor or allow it to infer information about the appellant’s current business.

[55] I accept and adopt the reasoning in PO-4084. Similarly, the certificates of insurance in the present case are also outdated, and the board did not explain the harm or prejudice to the affected party’s or to its own economic interests.

[56] In the absence of the requisite detailed evidence of risk of harm, I cannot conclude that the disclosure of Exhibit F could reasonable be expected to lead to the harms described under sections 10(1)(a) or (c). Therefore, I find that Exhibit F is not exempt under Section 10(1). I consider whether it is exempt under Section 11 below.

Issue B: Do the discretionary exemptions at sections 11(a), (c) and/or (d) apply to the records?

[57] The board claims section 11(a) to withhold Exhibit H. The board claims sections 11(c) and (d) to withhold the remaining records, namely Exhibits A through G, Schedule 1 and Annex A and B. The purpose of section 11 is to protect certain economic and other interests of institutions. It also recognizes that an institution’s own commercially valuable information should be protected to the same extent as that of non-governmental organizations.[24]

Section 11(a): information with monetary value that belongs to government

[58] I will next consider the board’s claim that Exhibit H is exempt under section 11(a).[25]

[59] Section 11(a) of the Act states:

A head may refuse to disclose a record that contains,

(a) trade secrets or financial, commercial, scientific or technical information that belongs to an institution and has monetary value or potential monetary value;

[60] The purpose of this section is to permit an institution to refuse to disclose information where its disclosure would deprive the institution of its monetary value.[26]

[61] For section 11(a) to apply, the institution must show that the information:

1. is a trade secret, or financial, commercial, scientific or technical information,
2. belongs to an institution, and
3. has monetary value or potential monetary value.

Part 1: type of information

[62] The board submits that Exhibit H, entitled “TDSB Cyber Risk and Privacy Checklist,” contains technical information belonging to the board and has monetary and potential monetary value. The board relies on its representations under section 10(1).

[63] I agree with the board that Exhibit H contains technical information. As I found above under Part 1 of the section 10(1) test, Exhibit H contains both commercial and technical information.

[64] Again, as I found above, the signature page is part of the main agreement, which is a contract containing commercial information. Accordingly, I find that it also contains commercial information.

Part 2: belongs to

[65] The term “belongs to” refers to ownership by an institution. It is more than the right simply to possess, use or dispose of information, or control access to the physical record in which the information is contained.

[66] For information to belong to an institution, the institution must have some proprietary interest in it either in a traditional intellectual property sense – such as copyright, trade mark, patent or industrial design – or in the sense that the law would recognize a substantial interest in protecting the information from misappropriation by another party.[27] Examples of the latter type of information may include trade secrets, business-to-business mailing lists, [28]customer or supplier lists, price lists, or other types of confidential business information. In each of these examples, there is an inherent monetary value in the information to the organization resulting from the expenditure of money or the application of skill and effort to develop the information.

[67] If, in addition, the information is consistently treated in a confidential manner, and it derives its value to the organization from not being generally known, the courts will recognize a valid interest in protecting the confidential business information from misappropriation by others.[29]

[68] For the reasons that follow, I do not accept that Exhibit H belongs to the board for the purposes of Section 11(a).

[69] The board submits that it has a substantial interest in protecting the information from misappropriation or misuse by another party.

[70] The board submits that its staff created Exhibit H, which is a checklist, and a blank copy was provided to the affected party to complete. The affected party filled out the checklist based on its capabilities and the technical and security requirements it would accept. The board argues that it spent money and that its staff applied skill and effort to prepare the checklist and to ensure adequate safeguards for its technical infrastructure and sensitive information, including personal information.

[71] I accept that board staff applied effort and skill in generating parts of Exhibit H, in particular terms of a technical nature relating to the field of information technology. However, that in and of itself, is not enough to satisfy the requirements of part 2 of the test.[30] As I explain below, I am not satisfied that the board has demonstrated part 2 has been met.

[72] The board also argues that Exhibit H belongs to it further to section 6.2 of Exhibit B, which states that the board retains rights to “any and all data, plans, specifications, reports, documentation and any other materials provided by [the board] to the affected party.” According to the board, this includes Exhibit H. With no other evidence, I am not persuaded that section 6.2 of Exhibit B is meant to protect the board’s rights to Exhibit H, or is evidence of the board’s proprietary interest in Exhibit H. As noted above, Exhibit H is a part of the main agreement; as is Exhibit B, which contains the clause the board relies on. Having read section 6.2 in its entirety and in the context of Exhibit B, in my view it is meant to capture materials exchanged between the parties throughout the duration of the contractual relationship, as opposed to a document that is part of the contract initiating the relationship.

[73] As noted above, Exhibit H is a checklist created by the board and an exhibit to the main agreement. It contains a list of terms proposed by the board relating to cyber security and privacy. As the board notes in its representations, these terms were accepted or modified by the affected party. In my view, the result is a list of negotiated terms between the parties.

[74] Previous orders have been clear that records consisting of mutually-generated agreements, the product of negotiations, do not constitute the intellectual property of and, therefore, do not “belong to” an institution in the sense contemplated by this exemption.[31] These orders have stated that information produced in the course of negotiations and included in mutually generated agreements belongs as much to the parties on the other side of those agreements as it does the institution and is not the type of information “in the nature of a trade secret” that the courts would protect from misappropriation.[32] I adopt this approach and find that Exhibit H likewise consists of mutually generated terms and does not belong to the board in the sense contemplated by section 11(a).

[75] As noted above, if Exhibit H has been consistently treated in a confidential manner, and it derives its value to the board from not being generally known, it will be protected from misappropriation by others. The board does not address this in its representations on section 11(a). It submits under section 10(1) that the records at issue are not publicly available, and points to a general confidentiality clause in the main agreement. However, even if I were to accept that Exhibit H has been consistently treated in a confidential manner, the board does not explain how Exhibit H derives its value from not being generally known. The board also does not identify what proprietary interest the law would say could be damaged if another party were to misappropriate the information in Exhibit H. Neither are evident from the record itself.

[76] As all the parts of the test must be met, I find that Exhibit H is not exempt under section 11(a).

[77] I reach the same conclusion with respect to the signature page. Based on my review of its content, I find that the board does not have a proprietary interest in the signature page, and that it does not belong to the board in the sense contemplated under section 11(a).

Sections 11(c): prejudice to economic interests or competitive position

[78] The board submits that Exhibits A through G, Schedule 1, and Annex A and B are exempt under section 11(c). I will consider the board’s claim as well as whether the signature page is exempt under section 11(c).

[79] Section 11(c) of the Act states:

A head may refuse to disclose a record that contains,

(c) information whose disclosure could reasonably be expected to prejudice the economic interests of an institution or the competitive position of an institution[.]

[80] The purpose of section 11(c) is to protect the ability of institutions to earn money in the marketplace. It recognizes that institutions may have economic interests and compete for business with other public or private sector entities, and it provides discretion to refuse to disclose information on the basis of a reasonable expectation of prejudice to these economic interests or competitive positions.[33]

[81] Section 11(c) is broader than section 11(a) and requires only that disclosure of the information could reasonably be expected to prejudice the institution’s economic interests or competitive position.[34]

Reasonable expectation of harm

[82] An institution resisting disclosure of a record on the basis of sections 11 (c) or (d) cannot simply assert that the harms mentioned in those sections are obvious based on the record. It must provide detailed evidence about the risk of harm if the record is disclosed. While harm can sometimes be inferred from the records themselves and/or the surrounding circumstances, the institution should not assume that the harms are self-evident and can be proven simply by repeating the description of harms in the Act.[35]

[83] The institution must show that the risk of harm is real and not just a possibility.[36] However, it does not have to prove that disclosure will in fact result in harm. How much and what kind of evidence is needed to establish the harm depends on the context of the request and the seriousness of the consequences of disclosing the information.[37]

[84] The fact that disclosure of contractual arrangements may subject individuals or corporations doing business with an institution to a more competitive bidding process does not prejudice the institution’s economic interests, competitive position or financial interests.[38]

Representations

[85] The board submits that the disclosure of the exhibits at issue would prejudice its negotiating position.

[86] The board states that the IPC has found section 11(c) applies where disclosure may prejudice current or ongoing negotiations.[39] The board cites the following excerpt from Order MO-3129, which considered the application of section 11(c) to a Water Services Operating Agreement:

Past orders have confirmed that it is in the public interest for the government, agencies and institutions to be able to negotiate favourable contractual arrangements.[40] However, the recognition of such a public interest does not negate the requirement that persuasive evidence must be tendered by the institution to establish an exemption from the public right of access to government-held information that is provided for by the Act.[41]

[87] The board states, at the time of filing its initial representations, that the main agreement was going to expire within several months and negotiations would take place prior to its expiration. The board notes that its options included negotiating with the affected party and continuing the existing SIS subscription, or consulting with other vendors offering similar products. Consequently, the board submits that disclosure of the exhibits at issue to a media appellant, prior to a negotiating process, may prejudice its discussion and information gathering with other vendors.

Analysis and findings

[88] I do not agree with the board. In Order MO-3129, cited by the board, the adjudicator canvassed previous IPC orders[42] in which section 11(c) applied because institutions had pointed to “current or ongoing negotiations that could be prejudiced by disclosure.” She noted that in those orders, the institution had “tendered sufficient evidence related to current or ongoing processes to satisfy the decision maker that [its] competitive position…[was] susceptible to interference upon disclosure of the…information at issue.” The adjudicator concluded that section 11(c) did not apply in that case because she had not been provided with evidence of current or ongoing negotiations related to the agreement in question that might lead to the same result.

[89] Firstly, in this case, the board does not provide evidence of current or ongoing negotiations related to the main agreement. According to the board’s representations, the time frame for the negotiation of a new SIS contract has passed. The negotiations in question are therefore neither current, nor ongoing.

[90] Secondly, the timing of negotiations aside, the board does not explain how the disclosure of the exhibits in question would prejudice its economic interests or competitive position. The board cites the possibility that it may consult other vendors. However, the board does not explain the connection between the disclosure of the records and the risk of harm. For example, the board does not explain how prospective vendors could make use of the information in these exhibits to prejudice its economic interests or competitive position. I have reviewed the confidential portions of the board’s representations and find that they likewise do not provide the requisite level of detail to establish a risk of harm under section 11(c). I am also unable to infer harms based on my review of the exhibits in question or the surrounding circumstances. Accordingly, I find that Exhibits A through G, Schedule 1, and Annex A and B are not exempt under section 11(c).

[91] I reach the same conclusion with respect to the signature page. Neither its content nor the surrounding circumstances support its exemption under section 11(c).

Section 11(1)(d): injury to financial interests

[92] The board submits that Exhibits A through G, Schedule 1, and Annex A and B are also exempt under section 11(d). I will consider the board’s claim as well as whether the signature page is exempt under section 11(d).

[93] Section 11(d) of the Act states:

A head may refuse to disclose a record that contains,

(d) information whose disclosure could reasonably be expected to be injurious to the financial interests of an institution

Representations

[94] The board claims that the exhibits at issue contain information relating to the operation, maintenance, and security of the SIS, and that their disclosure “poses a significant security and cyber risk.” The board specifies that such a risk could have a potentially significant financial impact, and should be exempt under section 11(d). The board cites sources that evaluate the cost of data breaches, both in terms of monetary loss and the “loss of learning” for schools due to the time and resources needed to recover from cybersecurity incidents.

[95] The board draws a comparison with IPC orders that found that section 11(d) applied to records relating to infrastructure where disclosure could compromise security of that infrastructure.[43] The board argues that though the exhibits at issue relate to virtual infrastructure, as opposed to physical infrastructure, their disclosure still poses a significant security and cyber risk.

Analysis and findings

[96] In its representations, the board does not provide the requisite level of detail to establish a risk of harm in the event that the exhibits at issue are disclosed. It presents the risk of a cybersecurity incident as self-evident, and cites potential consequences to the board, without explaining how one might use the information at issue in a manner that could reasonably be expected to be injurious to its financial interests. I am also unable to infer a risk of harm from a review of the records, or the surrounding circumstances. Accordingly, I find that Exhibits A through G, Schedule 1, and Annex and B are also not exempt under section 11(d).

[97] I reach the same conclusion with respect to the signature page. Neither its content nor the surrounding circumstances support its exemption under section 11(d).

[98] As neither sections 10(1) or 11 of the Act apply to the records at issue, they are not exempt from disclosure and I will order the board to disclose them to the appellant.

ORDER:

1. I order the board to disclose the records to the appellant by July 30, 2025 but not before July 15, 2025.
2. In order to verify compliance with this order, I reserve the right to require the board to provide me with a copy of the records disclosed to the appellant.

Original Signed by:		June 25, 2025
Hannah Wizman-Cartier
Adjudicator