ORDER PO-4736

Appeal PA23-00599

Financial Services Regulatory Authority of Ontario

September 29, 2025

Summary: A company made a request to the Financial Services Regulatory Authority of Ontario under the Freedom of Information and Protection of Privacy Act  for access to records relating to a complaint against it. The FSRA located a responsive record, a five-page email chain, and issued a decision denying access under the mandatory personal privacy exemption in section 21(1)  of the Act .

In this order, the adjudicator upholds the FSRA’s decision, finding that disclosure of the email chain would be an unjustified invasion of the personal privacy of an identifiable individual. She dismisses the appeal.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, sections 2(1) (definition of “personal information”), 21(1), 21(3)(b), and 23.

OVERVIEW:

[1] A company (the appellant) made a request to the Financial Services Regulatory Authority of Ontario (FSRA) under the Freedom of Information and Protection of Privacy Act  (the Act ) for access to information about a specified file. Specifically, the appellant sought access to records relating to a “Request for Information” received from the FSRA, including the initiator’s identity and whether the request arose from a specific complaint.

[2] The FSRA located a responsive record, a five-page email chain (email chain), and issued a decision denying access to it under the mandatory personal privacy exemption in section 21(1)  of the Act .

[3] The appellant appealed the FSRA’s decision to the Information and Privacy Commissioner of Ontario (IPC), and a mediator was appointed to explore resolution.

[4] As a mediated resolution was not reached, the appeal proceeded to the adjudication stage, where an adjudicator may conduct an inquiry under the Act . The adjudicator previously assigned to this appeal commenced an inquiry and sought and received representations from the parties about the issues in the appeal.[1]

[5] During the inquiry, the appellant took the position that there is a compelling public interest in the disclosure of the identity of the complainant from the email chain as described at section 23  of the Act .

[6] The appeal was then transferred to me. After reviewing the file, I decided that I did not need to seek additional representations before making my decision.

[7] In this order, I uphold the FSRA’s decision to deny access to the email chain under section 21(1) and dismiss the appeal.

RECORD:

[8] The record at issue in this appeal is a five-page email chain between a complainant and the FSRA.

ISSUES:

1. Does the email chain contain “personal information” as defined in section 2(1)?
2. Does the mandatory personal privacy exemption at section 21(1) apply to the email chain at issue?
3. Is there a compelling public interest in disclosure of the complainant’s identity from the email chain that clearly outweighs the purpose of the section 21 exemption?

DISCUSSION:

Issue A: Does the email chain contain “personal information” as defined in section 2(1) and, if so, whose personal information is it?

[9] In order to decide which sections of the Act  may apply to a specific case, the IPC must first decide whether the record contains “personal information,” and if so, to whom the personal information relates.

[10] The FSRA claims that the mandatory personal privacy exemption at section 21(1) applies to the email chain at issue. For this section to apply, the IPC must first determine that the record contains “personal information,” and if so, to whom the personal information relates. It is important to know whose personal information is in the record. If the record contains the requester’s own personal information, their access rights are greater than if it does not.[2] Also, if the record contains the personal information of other individuals, one of the personal privacy exemptions might apply.[3]

[11] Section 2(1)  of the Act  gives a list of examples of personal information.[4] Section 2(2) states: “Personal information does not include information about an individual who has been dead for more than thirty years.”

[12] To qualify as personal information, it must be reasonable to expect that an individual may be identified if the information is disclosed.[5]

[13] Information is “about” the individual when it refers to them in their personal capacity, which means that it reveals something of a personal nature about the individual. Generally, information about an individual in their professional, official or business capacity is not considered to be “about” the individual.[6] See also section 2(3), which states:

(3) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

[14] In some situations, even if information relates to an individual in a professional, official or business capacity, it may still be “personal information” if it reveals something of a personal nature about the individual.[7]

Representations, analysis and findings

[15] The FSRA submits that the email chain at issue contains the personal information of a complainant who communicated with the FSRA. The FSRA submits that after these communications, it opened a compliance file and conducted a review and investigation about the matters set out by the complainant. The FSRA explains that its investigation included asking the appellant about its business activities and services advertised on its website.

[16] The appellant does not directly address the issue of personal information in its representations.

[17] The FSRA submits, and I accept, that the email chain contains the personal information of the complainant including the complainant’s name, email address, telephone number, and opinions or views, which fit within the definitions of “personal information” in the following paragraphs of section 2(1):

“personal information” means recorded information about an identifiable individual, including,

(c) any identifying number, symbol or other particular assigned to the individual,

(d) the address, telephone number, fingerprints or blood type of the individual,

(e) the personal opinions or views of the individual except if they relate to another individual,

(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

(h) the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.

[18] The complainant’s contact information appears in the email chain in their professional capacity. However, I find that it still constitutes “personal information” under the Act . I find that the complainant could be identified from this information in the email chain and disclosure of that information, including their contact information, would reveal that the complainant made a complaint about the appellant to the FSRA. In my view, this reveals something of a personal nature about the complainant. Therefore, I find that the complainant’s contact information in the email chain is their personal information under the Act .

[19] The FSRA submits, and I agree, that the email chain does not contain the appellant’s or its representative’s personal information. The information in the email chain does not relate to the appellant or its representative in a personal capacity as the information relates to it as a company and the allegations against it as a company.

[20] Accordingly, I find that the email chain contains personal information within the meaning of the definition in section 2(1) of the Act and that personal information belongs to the complainant.

Issue B: Does the mandatory personal privacy exemption at section 21(1) apply to the email chain at issue?

[21] Section 21(1)  of the Act  creates a general rule that an institution cannot disclose personal information about another individual to a requester. This general rule is subject to a number of exceptions.

[22] The section 21(1)(a) to (e) exceptions are relatively straightforward. If any of the five exceptions covered in sections 21(1)(a) to (e) exist, the institution must disclose the information.

[23] The section 21(1)(f) exception is more complicated. It requires the institution to disclose another individual’s personal information to a requester only if this would not be an “unjustified invasion of personal privacy.” Other parts of section 21 must be looked at to decide whether disclosure of the other individual’s personal information would be an unjustified invasion of personal privacy.

[24] Under section 21(1)(f), if disclosure of the personal information would not be an unjustified invasion of personal privacy, the personal information is not exempt from disclosure.

[25] Sections 21(2), (3) and (4) help in deciding whether disclosure would or would not be an unjustified invasion of personal privacy. Sections 21(3)(a) to (h) should generally be considered first.[8] These sections outline several situations in which disclosing personal information is presumed to be an unjustified invasion of personal privacy.

[26] If one of these presumptions applies, the personal information cannot be disclosed unless:

• there is a reason under section 21(4) that disclosure of the information would not be an “unjustified invasion of personal privacy,” or
• there is a “compelling public interest” under section 23 that means the information should nonetheless be disclosed (the “public interest override”).[9]

[27] If the personal information being requested does not fit within any presumptions under section 21(3), one must next consider the factors set out in section 21(2) to determine whether disclosure would be an unjustified invasion of personal privacy. However, if any of the situations in section 21(4) is present, then section 21(2) need not be considered.

Representations, analysis and findings

[28] The FSRA argues that disclosure of the email chain would be an unjustified invasion of the complainant’s personal privacy, while the appellant argues that it would not.

[29] The parties did not argue that any of the exceptions in sections 21(1) or 21(4) apply in the circumstances of this appeal. From my review, I am satisfied that they do not apply, and I will not discuss them further in this order.

Section 21(3)(b) presumption: investigation into a possible violation of law

[30] The FSRA submits that the section 21(3)(b) presumption applies to the withheld email chain because it initiated the FSRA’s review and investigation of the appellant’s compliance with licensing requirements under the Insurance Act. The FSRA further submits that this resulted in a warning letter from the FSRA to the appellant directing that it ceases and desist unlicensed insurance activities.

[31] The appellant’s representations do not address the section 21(3)(b) presumption.

[32] Section 21(3)(b) states:

A disclosure of personal information is presumed to constitute an unjustified invasion of personal privacy where the personal information,

was compiled and is identifiable as part of an investigation into a possible violation of law, except to the extent that disclosure is necessary to prosecute the violation or to continue the investigation[.]

[33] Based on my review of the withheld email chain, I am satisfied that it was created and is identifiable as part of an investigation into a possible violation of law, specifically the FSRA’s investigation into the appellant’s compliance with licensing requirements. Even if no criminal proceedings were commenced against an individual, section 21(3)(b) may still apply. The presumption only requires that there be an investigation into a possible violation of law,[10] and in the circumstances of this appeal I am satisfied that an investigation occurred, resulting in a warning being sent to the appellant. Therefore, I find that section 21(3)(b) applies to the email chain at issue and that its disclosure is presumed to be an unjustified invasion of the complainant’s personal privacy.

[34] In reviewing the mandatory personal privacy exemption in section 21(1), once a section 21(3) presumption has been established, a presumed unjustified invasion of personal privacy under section 21(3) can only be overcome if section 21(4) or the “public interest override” at section 23 applies.[11]

[35] I have found that the section 21(3)(b) presumption applies to the email chain and the exceptions in section 21(4) do not apply in the circumstances of this appeal. Therefore, I find that the mandatory personal privacy exemption at section 21(1) applies to exempt the withheld email chain from disclosure.

[36] As noted above, the appellant has argued that the “public interest override” at section 23 applies in this appeal. I will now consider whether there is a compelling public interest in disclosure of the complainant’s identity from the email chain that clearly outweighs the purpose of the section 21 exemption.

Issue C: Is there a compelling public interest in disclosure of the complainant’s identity from the email chain that clearly outweighs the purpose of the section 21 exemption?

[37] Section 23  of the Act , the “public interest override,” provides for the disclosure of records that would otherwise be exempt under another section of the Act . It states:

An exemption from disclosure of a record under sections 13, 15, 15.1, 17, 18, 20, 21 and 21.1 does not apply where a compelling public interest in the disclosure of the record clearly outweighs the purpose of the exemption.

[38] For section 23 to apply, two requirements must be met:

• there must be a compelling public interest in disclosure of the records; and
• this interest must clearly outweigh the purpose of the exemption.

[39] The Act  does not state who bears the onus to show that section 23 applies. The IPC will review the records with a view to determining whether there could be a compelling public interest in disclosure that clearly outweighs the purpose of the exemption.[12]

Representations, analysis and findings

[40] Based on my review of the appellant’s representations, I find that there is not a compelling public interest in disclosure of the complainant’s identity from the email chain withheld under section 21(1) that clearly outweighs the purpose of that exemption.

[41] The appellant submits that there is a compelling interest in the disclosure of the complainant’s identity to prevent misuse of the FSRA’s regulatory process. It submits that if the complainant is its direct competitor, disclosure of their identity would promote fair competition, deter regulatory abuse, and maintain transparency and accountability so that the FSRA and its regulatory process is not leveraged for commercial gain.

[42] In considering whether there is a “public interest” in disclosure of the record, the first question to ask is whether there is a relationship between the record and the Act ’s central purpose of shedding light on the operations of government.[13] Previous IPC orders have stated that in order to find a compelling public interest in disclosure, the information in the record must serve the purpose of informing or enlightening the citizenry about the activities of their government or its agencies, adding in some way to the information the public has to make effective use of the means of expressing public opinion or to make political choices.[14]

[43] I find that disclosure of the complainant’s identity from the email chain in question does not meet this threshold. The complainant’s identity provides no substantive information about the FSRA’s operations, decision-making, or accountability. It does not advance the public’s understanding of how the FSRA performed its investigations, nor does it assist the citizens in expressing public opinion or to make political choices. As the FSRA submits, the information provided by the complainant in the email chain only initiated the opening of a compliance file. The FSRA then conducted its own independent investigation and issued a final warning directing the appellant to cease its unlicensed insurance activities. This demonstrates that the FSRA exercised its regulatory responsibilities independent of the complainant’s identity.

[44] Contrary to the appellant’s argument, I find that disclosure of the complainant’s identity from the email chain could promote, rather than deter regulatory abuse. If the identity of complainants were subject to disclosure, individuals and businesses would be less likely to come forward with information about potential misconduct, limiting the FSRA’s ability to carry out its mandate effectively. In this respect, I find that there is a compelling public interest in maintaining the confidentiality of the identity of complainants, rather than their disclosure. Therefore, I find that the appellant has not established that disclosure of the complainant’s identity could meaningfully inform the public about the activities of their governments or its agencies.

[45] For the reasons above, I find that there is not a compelling public interest in disclosure of the complainant’s identity from the email chain withheld under section 21(1) that clearly outweighs the purpose of that exemption.

[46] Accordingly, I uphold the FSRA’s decision to withhold the email chain under section 21(1) and dismiss the appeal.

ORDER:

I uphold the FRSA’s decision and dismiss the appeal.

Original Signed by:		September 29, 2025
Anna Truong
Adjudicator