ORDER PO-4674

Appeal PA24-00253

University of Windsor

July 9, 2025

Summary: A media appellant asked the University of Windsor for records about a cybersecurity incident that it experienced. The university issued an interim decision with a fee estimate to the appellant. The appellant appealed the university’s fee estimate. In this order, the decision-maker does not uphold the university’s fee estimate and orders the fee estimate be reduced to $543.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, sections 57(1) and 57(3); Regulation 460, section 6.

BACKGROUND:

[1] The appellant asked the University of Windsor (the university) for access under the Freedom of Information and Protection of Privacy Act  (the Act ) to:

…all internal and external University of Windsor reports pertaining to the cyber incident that reportedly affected University of Windsor systems starting June 20, 2022. In particular, I am seeking reports with the following information:

(a) What/who caused the breach

(b) How the breach was initiated

(c) Were police called to investigate

(d) What steps were taken to stop the cyberbreach and restore systems

(e) How long were university systems not working following the cyberbreach

(f) Was the breach a ransomware attack/cyberattack

(g) Was there a ransom demand

(h) How much was the ransom demand

(i) Was the ransom paid

(j) Copies of communications with and reports to provincial government bodies regarding the incident.

I also request all correspondence after June 19, 2022 regarding the cyber incident that went to or from:

(a) The University of Windsor president … and his office

(b) … vice-president of finance and operations, and her office

(c) …executive director of Public Affairs and Communications, and her office

[2] In response, on April 3, 2024, the university issued an interim decision with a fee estimate of $8,907, as follows:

Fee Estimate by the University issued on April 3, 2024

Search Time	24.2 hrs @ $30/hr	$726
Preparation Time	200 hrs @ $30/hr	$6681
Computer Costs		$1500
	Total:	$8907

[3] The appellant appealed the university’s fee estimate to the Information and Privacy Commissioner of Ontario (IPC).

[4] During mediation, the university issued two revised fee estimates. On August 28, 2024, it issued a fee estimate of $3,698 for 1818 pages of responsive records, as follows:

Revised Fee Estimate by the University issued on August 28, 2024

Search Time	6 hrs @ $30/hr	$180
Preparation Time	60.6 hrs @ $30/hr	$1818
Computer Costs		$1700
	Total:	$3698

[5] On September 25, 2024, it issued a final fee estimate of $2,786 for 1086 pages of responsive records, as follows:

Final Fee Estimate issued on September 25, 2024

Search Time		$0[1]
Preparation Time	36.2 hrs @ $30/hr	$1086
Computer Costs		$1700
	Total:	$2786

[6] In response to the above estimates, the appellant narrowed the scope of the request to:

…I am not looking for any and all emails containing the word “ransom”. I am seeking the minimum number of documents that would answer these basic questions regarding the 2022 cyberattack against [the university]: Was there a ransom demand? How much was the ransom demand? What amount of ransom did the university pay?

[7] The university advised that the fee estimate would not be impacted by this narrowed scope because it would still have to conduct a search relating to the word “ransom” and review the responsive records to consider whether any exemptions/exclusions in the Act  apply. It further stated that the vast majority (if not all) of records would be subject to an exemption or exclusion, and it could not identify or even estimate “a minimum number of documents” that may be responsive to the narrowed request until the search and review process were completed.

[8] As further mediation was not possible, the file was moved to the IPC’s expedited process, where a case lead may conduct an expedited inquiry under the Act .

[9] As the assigned case lead, I decided to conduct an expedited inquiry and issued a Notice of Expedited Inquiry to the university seeking representations on the issue of fee estimate. I received representations from the university and determined that I did not require representations from the appellant.

[10] For the reasons outlined below, I do not uphold the university’s fee estimate.

DISCUSSION:

[11] The sole issue is whether the university’s fee estimate of $2,786 should be upheld.

[12] Section 57(1)  of the Act  requires an institution to charge fees for requests under the Act . It states:

A head shall require the person who makes a request for access to a record to pay fees in the amounts prescribed by the regulations for,

(a) the costs of every hour of manual search required to locate a record;

(b) the costs of preparing the record for disclosure;

(c) computer and other costs incurred in locating, retrieving, processing and copying a record;

(d) shipping costs; and

(e) any other costs incurred in responding to a request for access to a record.

[13] More specific fee provisions are found in section 6 of Regulation 460, which, of relevance to this appeal, applies to general access requests, namely:

6. The following are the fees that shall be charged for the purposes of subsection 57(1)  of the Act  for access to a record:

1. For photocopies and computer printouts, 20 cents per page.

2. For records provided on CD-ROMs, $10 for each CD-ROM.

3. For manually searching a record, $7.50 for each 15 minutes spent by any person.

4. For preparing a record for disclosure, including severing a part of the record, $7.50 for each 15 minutes spent by any person.

5. For developing a computer program or other method of producing a record from machine readable record, $15 for each 15 minutes spent by any person.

6. The costs, including computer costs, that the institution incurs in locating, retrieving, processing and copying the record if those costs are specified in an invoice that the institution has received.

[14] Under section 57(3), an institution must provide a fee estimate where the fee is more than $25. The purpose of the fee estimate is to give the requester enough information to make an informed decision on whether to pay the fee and pursue access.[2] The fee estimate also helps requesters decide whether to narrow the scope of a request to reduce the fee.[3]

[15] The institution can require the requester to pay the fee before giving them access to the record.[4] If the estimate is $100 or more, the institution may require the person to pay a deposit of 50 per cent of the estimate before it takes steps to process the request.[5]

[16] Where the fee is $100 or more, the fee estimate can be based on either:

• the actual work done by the institution to respond to the request; or

• a review of a representative sample of the records and/or the advice of an individual who is familiar with the type and content of the records.[6]

[17] In all cases, the institution must include:

• a detailed breakdown of the fee; and

• a detailed statement as to how the fee was calculated.[7]

[18] In reviewing the university’s fee estimate, my responsibility is to ensure that the estimated amounts are reasonable in the circumstances of this appeal and that they have been calculated in accordance with the fee provisions in the Act and Regulation 460. I may uphold the fee estimate or vary it.

[19] The burden of establishing the reasonableness of the estimate rests with the university.[8] To meet this burden, the university is required to provide an adequate explanation of how the fee estimate was calculated and provide sufficiently detailed evidence to support the estimate.

Representations of the university[9]

[20] The university submits that it based its fee estimate on the actual work done to respond to the request.[10] It submits that it used the 1086-page count to calculate the final fee estimate.

[21] The university submits that:

• responsive records are kept in email and electronic computer file format (word documents and spreadsheets), on personal computers, servers, and/or in cloud storage (the “Storage Devices”), which are maintained by individuals who have access to them;
• its IT Services and/or individuals with access to the Storage Devices must manually search the Storage Devices for responsive records; and
• the time spent searching for records varies depending on the specific Storage Device.

[22] For the preparation of the records, the university submits that 1,086 pages of records will require approximately 2172 minutes (36.2 hours) to sever at a rate of $30 per hour resulting in a fee of $1086 for preparation time.

[23] Additionally, the university submits that it received an invoice from a third-party in the amount of $1738.50 for other costs, including computer costs for locating, retrieving, processing, and copying the records. The university points out that its fee estimate only includes a computer fee of $1700 in the final fee estimate to the appellant, which is less than the actual cost.

[24] The university provided me with a copy of this invoice in the amount of $1738.50 for the following services:

• software monthly hosting database fee (two months of hosting);
• software processing data fee;
• software promotion data fee (re-ordering and grouping data, relevant for email-based data);
• software user fees; and
• technician fees related to creating databases, inputting data, analyzing dataset, reviewing set and excluding documents.

[25] The university submits that from June 2024 to March 2025, it has been paying the monthly software hosting database fee, stating it has incurred, paid and absorbed this fee since the beginning of the request process until recently; it did not include any ongoing costs in the fee estimate to the appellant.

[26] The university submits that the invoiced costs are a “sunk cost” specific to this request, reflecting the actual costs incurred by the university for this request and are not general costs incurred by the university.

Analysis and findings

[27] As explained below, I do not uphold the university’s final fee estimate. I find that the university has not provided sufficient evidence to establish the reasonableness of its final fee estimate.

[28] First, I am satisfied that the records sought are for general information and the university can charge fees for manually searching and preparing responsive records under section 6 of Regulation 460.

[29] Second, I make no finding on search time and fees associated with search time as the university’s final fee estimate does not include any time or fees for search. Based on this, it is my understanding that the university has chosen not to charge the appellant any search time for the responsive records.

[30] Third, I am not satisfied that the university has established the reasonableness of its final fee estimate of $1086 for 36.2 hours of preparation time. This appears to be calculated by allotting two minutes to prepare each of the 1086 pages at a rate of $30 per hour.

[31] Previous IPC orders have found that, under section 57(1)(b) of the Act and the regulation, time spent preparing a record for disclosure includes time spent redacting a record.[11] The IPC has generally accepted that it takes two minutes to sever a page that requires multiple severances.[12] The university submits that the vast majority (if not all) of records would be subject to an exemption or exclusion but did not provide any additional details. Presumably, a record that is withheld in full would likely not require preparation of two minutes for each page of the record, nor would a page that does not require multiple severances. The university’s representations do not provide me with sufficient details to understand the basis for estimating that each page of responsive records would require two minutes of preparation time. As such, I find that the university’s fee estimate for preparation time is not reasonable in the circumstances of this appeal. I reduce the university’s fee for preparation by half to 18.1 hours, resulting in a preparation fee estimate of $543.00.

[32] Finally, I am also not satisfied that the university has established the reasonableness of its final fee estimate of $1700 for computer costs. The university submits that it has incurred computer costs in responding to this access request and received a third-party invoice for $1738.50. It explains that these costs were incurred for locating, retrieving, processing and copying responsive records, and provides a copy of the invoice with a breakdown of the services performed. However, the university’s representations do not detail why the third-party’s actions in “locating, retrieving, processing and copying” responsive records were necessary to respond to this access request.

[33] In Order MO-4569, the adjudicator reduced a fee estimate that was based entirely on a brief quote from an external organization to an institution because the institution did not describe the need or nature of the work that was to be performed by the external organization.

[34] In the present appeal, the third-party’s invoice includes a breakdown of fees and provides some details of the services performed. However, the university’s representations do not adequately describe the need for these additional services to be performed by an external third-party, why the university itself could not perform these activities itself, or how these additional services differ from the activities performed by the university itself as part of search and preparation.

[35] For example, the university has not explained:

• the need for multiple users to process an access request of just over 1000 pages;
• why such costs would be permitted under the Act and its regulation, when they would not necessarily be permitted if the university performed these tasks itself internally; and
• how these costs were specific to the access request, as opposed to being costs incurred by the university generally.

[36] I note that the computer costs incurred by the university account for approximately two thirds of the final fee estimate. I also note that there was no ability to reduce fees by narrowing the scope of the request because, according to the university, they are sunk costs, already incurred by the university.

[37] Accordingly, I find that the university’s fee estimate for computer costs is not reasonable in the circumstances of this appeal. I reject the university’s final fee estimate of $1700 for computer costs.

[38] Overall, I do not uphold the university’s final fee estimate. I find that the university has not provided sufficient evidence to establish the reasonableness of its final fee estimate. As such, I reduce the university’s final fee estimate from $2786 to $543, rejecting the computer costs of $1700 and reducing the fee estimate for preparation time from $1086 to $543. The appellant must provide the university with a 50% deposit for the university to continue processing the request and then issue its final decision, in accordance with the Act .

ORDER:

1. I do not uphold the university’s fee estimate.
2. I reduce the university’s fee estimate to $543.

Original Signed by:		July 9, 2025
Asma Mayat
Case Lead, Expedited Team