ORDER PO-4720

Appeal PA22-00415

York University

September 10, 2025

Summary: A former graduate student requested access to records about herself from York University. The university conducted a search for responsive records, however the requester believed that it should have located further records.

In Order PO-4280, the adjudicator did not uphold the university’s search for responsive records as reasonable and ordered it to conduct another search for responsive records. The university conducted another search and issued a decision advising that it did not locate additional responsive records. The appellant continues to believe that additional records responsive to her request should exist and appealed the university’s decision issued in compliance with Order PO-4280.

In this order, the adjudicator finds that the university has conducted a reasonable search for some records but has not provided sufficient evidence to establish that it conducted a reasonable search for two specific types of records responsive to the appellant’s request. She orders the university to conduct another search for those records and to issue an access decision on the results of that search.

The adjudicator also orders the university to issue an access decision for seven emails that it located in its search conducted in compliance with Order PO-4280.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31, sections 10  and 24 .

Orders Considered: Order PO-4280.

OVERVIEW:

[1] This order considers the reasonableness of a university’s search for records about a former graduate student.

[2] York University (the university) received a request under the Freedom of Information and Protection of Privacy Act  (FIPPA  or the Act ) for academic-related records pertaining to the requester.

[3] The university issued an access decision denying access to the records in part under the discretionary exemption in section 49(a) (discretion to refuse requester’s own personal information), read with section 13(1) (advice or recommendations) and section 19 (solicitor-client privilege), and the discretionary exemption in section 49(b) (personal privacy). The university also withheld some information on the basis that it was not responsive to the request.

[4] The requester, now the appellant, appealed the university’s decision to the Information and Privacy Commissioner of Ontario (the IPC). The appellant also claimed that the university had not conducted a reasonable search.

[5] In Order PO-4280,[1] I upheld the university’s decision to withhold information under the claimed exemptions, in part. As the university had not provided representations detailing its search for responsive records, I found that it had not established that it had conducted a reasonable search as required by section 24  of the Act . Accordingly, I ordered the university to conduct another search for responsive records and to issue an access decision with respect to any additional records found because of that search.

[6] In compliance with Order PO-4280, the university conducted another search for responsive records and issued a decision advising that no additional records were located.

[7] The appellant appealed the university’s decision to the IPC, claiming that the university has still not conducted a reasonable search for responsive records.

[8] As a mediated resolution was not reached, the file moved to the adjudication stage of the appeal process where an adjudicator may conduct an inquiry. I decided to conduct an inquiry and sent the parties a Notice of Inquiry seeking their representations. The parties’ representations were exchanged between them in accordance with the IPC’s Practice Direction 7.[2]

[9] In this order, I find that the university has conducted a reasonable search for some responsive records but has not provided sufficient evidence to establish that it conducted a reasonable search for two specific types of records responsive to the appellant’s request. I order the university to conduct another search for those two types of records and to issue an access decision on the results of that search. I also order the university to issue an access decision on seven emails that it located in its search following the issuance of Order PO-4280.

DISCUSSION:

[10] The sole issue in this appeal is whether the university conducted a reasonable search for responsive records in its custody or control as ordered in Order PO-4280.

[11] The appellant submits that the reasonableness of the university’s search for records continues to be at issue because in the search the university conducted in compliance with Order PO-4280 it should have located additional records responsive to parts #2, 5, 6, 8, 9, 10, 12, and 14 of her request. These parts of the request read:

2. From September 1, 2015 to the present date [August 6, 2019]:

Any and all records created by, sent from, or received by one or more of the following individuals [4 names] that refer to the requester.

5. From September 1, 2016 to present date:

Any and all records created by, sent from, or received by one or more of the following individuals: [4 names] that refer to the requester's graduate [name] program status.

6. From January 1, 2017 to present date:

Any and all records created by, sent from, or received by one or more of the following individuals: [3 names], and received from or sent to any employees, staff, agents or representatives of [two named hospitals], that refer to or are in regard to the requester.

8. From September 1, 2017 to present date:

Any and all records created by, sent from, or received by one or more of the following individuals: [4 names], relating to the requester's practicum with [two named hospitals].

9. From January 1, 2018 to present date:

Any and all records including but not limited to phone logs, audio recordings, meeting minutes, or memos, created by, sent from, or received by [name] and received from or sent to [2 names] that refer to phone conversations or in-person meetings, between [3 names], in regard to the requester.

10. From January 1, 2018 to present date:

Any and all records including but not limited to phone logs, meeting minutes, or memos, created by, sent from, or received by [name] or any employees, staff, agents or representatives of the Institution and received from or sent to [named hospital], [name], that refers to the requester, or the requester's practicum, or are in regard to the requester.

12. From January 1, 2018 to present date:

Any and all records including but not limited to documents, phone logs, meeting minutes, or memos, created by, sent from, or received by one of more of the following individuals: [3 names], or any employees, staff, agents or representatives of the Institution and received from or sent to [name], or any employees, staff, agents or representatives of University of [name], that either directly or indirectly refer to, or are in regard to the requester.

14. From February 1, 2018 to the present date:

Any and all records including but not limited to documents, phone logs, audio recordings, meeting minutes, or memos, created by, sent from, or received by [name], that refer to or are in regard to a phone conversation between [name] and the requester on February 2, 2018.

[12] If a requester claims that additional records exist beyond those found by the institution, the issue is whether the institution has conducted a reasonable search for records as required by section 24  of the Act .[3] If the IPC is satisfied that the search carried out was reasonable in the circumstances, it will uphold the institution’s decision. Otherwise, it may order the institution to conduct another search for records.

[13] Although a requester will rarely be in a position to indicate precisely which records the institution has not identified, they still must provide a reasonable basis for concluding that such records exist.[4]

[14] The Act  does not require the institution to prove with certainty that further records do not exist. However, the institution must provide enough evidence to show that it has made a reasonable effort to identify and locate responsive records;[5] that is, records that are "reasonably related” to the request.[6]

[15] A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request makes a reasonable effort to locate records that are reasonably related to the request.[7] The IPC will order a further search if the institution does not provide enough evidence to show that it has made a reasonable effort to identify and locate all of the responsive records within its custody or control.[8]

Representations

[16] In compliance with Order PO-4280, the university conducted another search for records responsive to parts #2, 4, 5 6, 8, 9, 10, 12 and 14 of the appellant’s request. In support of its search, the university provided representations, together with six affidavits and supporting documents[9], detailing both the search it conducted initially and that which it conducted in response to Order PO-4280.

[17] In its representations, the university submits that in multiple phone conversations and email exchanges with the appellant, it provided her with information on the university’s records management practices and directed her to the Common Record Schedule which is publicly available online.[10] It states that further discussions were held to identify records that would, and would not, be under its custody or control.

[18] The university states that its Privacy Officer, as well as the Director of the Information, Privacy and Copyright Office (the FOIC),[11] oversaw the search for records. As the Privacy Officer is no longer with the university, the FOIC provided an affidavit outlining the search process and those consulted in the search, along with affidavits from others involved in searching for responsive records. As well, the university states that additional interviews were conducted with knowledgeable, highly skilled, experienced staff confirming the results of both searches. The university submits:

The searches included all media formats and all records, including but not limited to cell phone records, emails and notes. It is the custom and practice for York University faculty and staff to utilize only York University supported tools. In cases where an instructor utilized externally supported tools, those records were provided to the appellant…[.]

[19] The FOIC’s affidavit refers to the searches conducted in response to the appellant’s request, as follows:

… The record search was conducted by experienced and knowledgeable staff in the areas of the Office of the Vice-President Academic and Provost. Records in all media were searched.

The record search in the Department of [name] Graduate Program was coordinated by [name] Department Chair; [name] Graduate Program Director; Program personnel; and all named individuals in the request. Records were located and were included in the index of records provided to the requester.

The record search in the Faculty of Graduate Studies was coordinated by [name] Executive Officer with consultations with [name] Associate Dean, Students Affairs; Student Affairs Coordinator; [name] Student Services Coordinator; and [name] former Manager, Student Affairs. Records were located and were included in the index of records provided to the requester.

On October 2, 2019, [the Privacy Officer] sent by email a memo to [the] Vice-Provost, Students requesting her Office to coordinate the search for records responsive to the request from the Registrar’s Office. The coordinated search included records in the Registrar’s Office. Staff members consulted in the search included [name] Records & Scheduling Analyst; [name] Assistant Registrar, Student Records; [name] Assistant Registrar, Degree Audit; [name] Director, Admission Client Services and Registrar Services; [name] Manager Student Systems, [Office of the University Registrar] Systems; [name] Assistant Director, Transfer and Transitions, Admissions; [name] Assistant Director, Admissions Assessment; [name] Manager, Client Support Service and Document Processing, Admissions; [name] Manager, Financial Aid Processing, Student Financial Services; and [name] Manager, Student Accounts, Student Financial Services. Records were located and were included in the index of records provided to the requester…[.]

[20] The FOIC’s affidavit also refers to the searches it conducted in compliance with Order PO-4280, as follows

In response to Order PO-4280, the university conducted a subsequent search of records, but did not find additional responsive records related to points #2, 4, 5, 6, 8, 9, 10, 12, and 14 of the appellant’s request.

[21] The FOIC submits that the university areas that could hold records pertaining to the request were searched and all extant responsive records were disclosed to the appellant subject to relevant exemptions.

[22] The FOIC further submits:

I and my colleagues in the Information, Privacy Office and Copyright Office believed that these offices were the areas at the University that would hold records pertaining to the requester’s request. These offices were searched, and all extant responsive records were disclosed to the requester subject to relevant exemptions.

[23] The other five affidavits provided by the university in support of the search it conducted in compliance with Order PO-4280 contain similar information as that which was provided by the FOIC in her affidavit. Three of the other affidavits are from individuals named in the appellant’s request, namely the Director of Clinical Training (the DCT), the appellant’s supervisor and a professor. Two professors who are named in the records disclosed to the appellant also provided affidavits.

[24] In response to the university’s representations and affidavit evidence submitted in support of its searches, the appellant states that the university still has not conducted a reasonable search for records responsive to parts # 2, 5, 6, 8, 9, 10, 12, and 14 of her request.

[25] The appellant submits that, although the university takes the position that it provided evidence demonstrating that it made reasonable efforts to identify and locate responsive records regarding the searches conducted first in response to her request and then in compliance with Order PO-4280, the evidence it provided is not sufficient to demonstrate that it carried out a reasonable search as required by section 24  of the Act . She submits that the university has not provided sufficient details of the subsequent searches carried out in response to the order, including:

• who conducted the search;
• what locations were searched;
• who was contacted in the course of the search;
• what types of files were searched (e.g., digital records, paper records that were never emailed);
• what the results of the searches were; and
• whether responsive records exist that are not in the university’s possession (e.g., faculty members’ journals, notebook, logs to cell phone text messaging used in their official duties and instant messaging logs).

[26] The appellant refers to a number of email records provided to her by the university that she submits provide evidence of the existence of additional responsive records. She submits that the records provided to her are part of an extensive continuum of email conversations that the university has not searched. Relying on these emails already located by the university, the appellant provided detailed representations describing further emails and other records, such as meeting minutes, meeting participant lists, agendas, and phone logs, that she submits should have been located by the university in its search efforts.

[27] In reply, the university reiterates that its search for responsive records was reasonable as it was conducted by experienced employees knowledgeable in the subject matter, and that all extant responsive records have been disclosed to the appellant in accordance with the Act .

Analysis and findings

[28] For the reasons set out below, I find that, other than for two types of records, the university conducted a reasonable search for records responsive to parts # 2, 5, 6, 8, 9, 10, 12, and 14 of the appellant’s request and that its search was conducted in accordance with its obligations under section 24  of the Act .

[29] Following Order PO-4280, the university issued a decision letter to the appellant advising that it had conducted a search in compliance with that order and had not located any additional responsive records.

[30] The university representations submitted in the current appeal and all six of the affidavits the university provided in support of its search are directly about the searches it conducted prior to the issuance of Order PO-4280, except for this statement in all the affidavits:

In response to Order PO-4280 a subsequent search of records has not found additional responsive records related to points #2, 4, 5, 6, 8, 9, 10, 12, and 14 of the appellant’s Request. University areas that could hold records pertaining to the Request were searched and all extant responsive records were disclosed to the Requester subject to relevant exemptions.

[31] Although the appellant submits that the university’s representations do not provide the details as to who conducted the subsequent searches, the places searched, who was contacted in the course of the searches, the types of files searched, and the results of these searches, from my review, the affidavit evidence provides sufficient evidence to demonstrate that experienced employees knowledgeable in the subject matter conducted searches for records responsive to the appellant’s request. In their affidavit, each affiant provides significant details of the searches they conducted for responsive records and the results of their search. The FOIC’s affidavit sets out the departments where searches were conducted and identifies the individuals who conducted searches. More generally, the university’s representations include a description of the types of records that were searched.

[32] Based on my review of the parties’ representations, including the university’s six affidavits, and my review of the hundreds of pages of records that have already been located and were the subject of the appeal that gave rise to Order PO-4280, I find that the university has provided sufficient detail for me to conclude that it has conducted a reasonable search for records responsive to the appellant’s request, with the exception of to two specific types of records:

• records of the former Department Chair, and
• phone logs and meeting records of the Director of Clinical Training.

The records of the former Department Chair

[33] In her request, the appellant seeks in particular access to the records of four specific university staff who interacted with her: the Director of Clinical Training, the Graduate Program Director, a named professor, and the former Department Chair. The university provided evidence of searches conducted by three of these individuals but did not provide evidence of a search conducted by the former Department Chair.

[34] The university did not provide an affidavit from the former Department Chair nor details about any searches conducted of his records. With her representations, the appellant provided several examples of records she has already received from the university which contain information that suggests that further responsive records should exist amongst the records of the former Department Chair.

[35] From my review of the appellant’s representations including the records she provided, I agree with the appellant that there is a reasonable basis to conclude that responsive records should exist within the records of the former Department Chair. Additionally, I find that the university has not provided sufficient evidence that it conducted a reasonable search for records of this type.

[36] Accordingly, I will order the university to conduct a search of the former Department Chair’s record holdings.

Phone logs and meeting records of the Director of Clinical Training

[37] In her representations, the appellant submits that information contained in records 70, 72, 75 to 77, 83, and 94, which have already been disclosed to her, suggest that additional records should exist, including the Director of Clinical Training’s phone logs and meeting records, such as meeting minutes, invites and agendas.

[38] The university neither responded to the appellant’s representations on the existence of such records, nor provided any evidence that it conducted a search for records of this specific type.

[39] Based on my review of the records the appellant refers to and attached to her representations, I agree that there is a reasonable basis to conclude that responsive records should exist of the Director of Clinical Training’s phone logs and meeting records. Additionally, I find that the university has not provided sufficient evidence that it conducted a reasonable search for these records.

[40] Accordingly, I will order the university to conduct a search for responsive Director of Clinical Training’s phone logs and meeting records.

Seven additional emails located

[41] I note that in the affidavit sworn by one of the professors named in the records, the professor affirms:

In response to Order PO-4280 I completed a subsequent search of my records and found an additional seven emails addressed to me by the appellant within the date ranges relating to the Request. These additional responsive records and an Index of Record details are attached.

[42] The university did not attach any records or index to this affidavit. It also did not provide any evidence to demonstrate that it issued an access decision with respect to these seven newly located emails.

[43] As the professor has attested to the fact that the search he conducted in compliance with Order PO-4280 located seven emails and there is no evidence before me to suggest that the university issued an access decision with respect to these seven additional emails, I will order the university to issue an access decision on these records.

Personal records of university staff

[44] Section 10(1) provides for a general right of access to records that are in the custody or under the control of an institution governed by the Act . It reads, in part:

Every person has a right of access to a record or a part of a record in the custody or under the control of an institution unless ….

[45] Under section 10(1), the right of access applies to a record that is in the custody or under the control of an institution; the record need not be both.[12]

[46] Recent IPC decisions have found that government records that have been sent and saved to personal email accounts or devices may be in the custody or under the control of an institution if it can be established that they relate to government business.[13]

[47] The appellant submits that the university should search the personal records held by certain university staff named in her request, such as cell phone records, emails, and notes which she believes is in the university’s custody or under its control. She submits that certain named individuals in the records also have control over records not in the custody of the university, such as personal phone logs when personal phones were used for official duties.

[48] However, the appellant has not provided any evidence in her representations or from the records that she has received that these university staff would have used their personal cell phones, email accounts and notes for their official duties. Nor is the same apparent to me.

[49] The IPC has generally found that personal records of government officials are outside of an institution’s custody or control. As such, it is not usual for the IPC to require government staff to search their personal accounts or records, unless there is reason to believe there may be records relating to government business, in which case such records would be brought within government control and become subject of the search.[14] Given the evidence before me, I find that there is no reason to believe that responsive information may be found in the relevant university staff’s personal records and that such information, if it exists, would be brought within the scope of the appellant’s request.

[50] Therefore, as I do not have sufficient evidence that the university staff named in the appellant’s request used their personal accounts or devices to conduct their university duties, I find that the university is not required to conduct a search of the personal record holdings of university staff for responsive records.

Conclusion

[51] Based on all of the evidence before me, I find that the university has not conducted a reasonable search for the following responsive records:

• the former Department Chair’s records, and
• phone logs and meeting records of the Director of Clinical Training.

[52] Therefore, I will order the university to conduct a search for these responsive records in the university record holdings and issue an access decision with respect to the results of its search.

[53] I will also order the university to issue an access decision with respect to the seven emails located by one of the professors during a subsequent search as detailed in his affidavit.

[54] In all other respects, I find that the university conducted a reasonable search for records responsive to the appellant’s request.

ORDER:

1. I order the university to issue an access decision with respect to the seven newly located emails referenced in the professor’s affidavit. For procedural purposes the university should treat the date of this order as the date of the request.
2. I order the university to conduct a search of:

• the former Department Chair’s record holdings; and

• the Director of Clinical Training’s phone logs and meeting records, including meeting minutes, meeting invites and agendas.

3. Following the university’s search as ordered in order provision 2, the university is to issue an access decision with respect to the results of its search. For procedural purposes the university should treat the date of the order as the date of the request.
4. I uphold the university’s search for the remaining responsive records.

Original Signed by:		September 10, 2025
Diane Smith
Adjudicator