Appeals and compliance

Introduction

Ontario’s Freedom of Information and Protection of Privacy Act (FIPPA) / Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) establishes a right to appeal decisions about access to records that are made by institutions covered by the Act. Appeals are filed with the Information and Privacy Commissioner.

This chapter outlines the powers of the Commissioner and the appeal process. Many of the procedures have been developed by the IPC; and are subject to change. Where clarification is needed during an appeal, an institution should contact the Appeals Officer assigned to the appeal.

The Information and Privacy Commissioner

The Appointment of the Commissioner

s.4 FIPPA

The Commissioner is appointed by the Lieutenant Governor in Council with the approval of the Legislative Assembly. This means that the Commissioner is an officer of the legislature and is independent of the government of the day.

The Commissioner is appointed for a term of five years and may be reappointed for a further term or terms. The Commissioner is removable at any time for cause by the Lieutenant Governor in Council with the approval of the Legislative Assembly.

The Powers of the Commissioner to Hear Appeals

s.54 FIPPA / s.43 MFIPPA

Decisions institutions make in response to access requests may be appealed to the Commissioner. The Commissioner decides matters under appeal by issuing an order. Subject to the Act, the order may contain any conditions the Commissioner considers appropriate. Commissioner’s orders are binding on all parties to the appeal. The Commissioner must notify the appellant, the institution and any person given notice of the appeal as an affected person that an order has been issued; this is done by sending a copy of the order to the parties.

The broad order-making power includes that right to order an institution to search its files in the presence of a Commission staff if the original search is deemed by the Commissioner to be inadequate. However, the Commissioner does not have the power to order an institution to create a record, unless a request is for certain machine readable records.

The Commissioner may also issue an interim decision and may defer a decision until further submissions are provided.

It is an offence to willfully fail to comply with an order of the Commissioner (s.61(1)(f) FIPPA / s.48(1)(f) MFIPPA).

The Power of the Commissioner to Review the Exercise of Discretion

Under FIPPA/MFIPPA most of the exemptions that allow a head of an institution to withhold a record are discretionary, which means that a head can choose whether or not to apply the exemption and withhold the record. While s.54(2) FIPPA / s.43(2) MFIPPA states that the Commissioner cannot substitute his/her discretion for that of a head, the Commissioner may review the way the discretion was exercised, to ensure that it was exercised properly.

The Commissioner may examine the record to determine whether a discretionary exemption in fact applies. In its appeal submissions, the institution will be expected to fully explain its reasons for not disclosing a record. If the rationale for a head’s decision is not clear, the Commissioner may order a head to reconsider his/her decision to withhold a record and to supply further written submissions.

The IPC has prepared a list of factors which may assist institutions in exercising their discretion. These factors are not meant to be all-inclusive. They are:

• the general purpose of the Act, which is that institutions should make information available to the public and that individuals should have access to personal information about themselves,
• the actual wording of the discretionary exemption and the interests that the exemption attempts to balance,
• the facts and circumstances of each specific case,
• whether the individual’s request could be satisfied by severing the record and by providing the requester with as much information as is reasonably practicable,
• whether the past practice of the institution has been to release similar types of records,
• the nature of the record, its importance to the requester and whether the record is particularly sensitive or significant,
• whether disclosure of the information would increase public confidence in the operations of the institution,
• the age of the record,
• the importance of the record to the requester and whether there is a sympathetic or compelling reason to release the record,
• whether previous orders of the Commissioner have ruled that similar types of records or information should or should not be subject to disclosure,
• when the advice to government exemption is claimed, whether the decision to which advice or recommendations pertains has already been made.

The Appeal Process

What Can Be Appealed?

s.50 FIPPA / s.39 MFIPPA

Generally, any decision that a head makes under the Act may be appealed to the Commissioner, including:

• a decision to extend the time limit for responding to a request,
• refusal to grant access to a record on the ground that the record does not exist,
• refusal to grant access to a record on the ground that the record is excluded from the Act,
• refusal to grant access to a record on the ground that the record is exempt,
• granting access to only part of the record,
• granting a request for access to a record or part that may contain third party commercial information or that contains personal information where the disclosure may be an unjustified invasion of personal privacy,
• refusal to confirm or deny the existence of a record that deals with law enforcement or would, if disclosed, be an unjustified invasion of personal privacy,
• a deemed refusal to grant access to records,
• a refusal to make a correction to personal information requested,
• the amount of a fee charged,
• a refusal to waive a fee charged,
• a refusal to allow a requester to examine the original record.

Who Can Appeal?

s.50 FIPPA / s.39 MFIPPA

The following persons can appeal to the Commissioner:

• a person who has made a request for access to a record under s.24(1) FIPPA / s.17(1) MFIPPA,
• a person who has made a request for access to his/her own personal information under s. 48(1) FIPPA / s.37(1) MFIPPA,
• a person who has requested correction of his/her own personal information under s.47(2) FIPPA / s.36(2) MFIPPA,
• an affected third party who has received a notice under s.28(1) FIPPA / s.21(1) MFIPPA that the head intends to disclose a record that may affect the interests of the third party.

Notice of Appeal by a Requester

s.50(2) FIPPA / s.39(2) MFIPPA

A person who has been notified of a decision by an institution has 30 calendar days to appeal the decision to the Commissioner. The Commissioner may nonetheless hear an appeal that is filed after the 30-day time limit, unless the institution can show that it would be prejudiced by the delay. For example, prejudice may be established where records that are relevant to the appeal have been destroyed.

The appellant (the person who is appealing) begins an appeal by submitting a request for an appeal (notice of appeal) in writing to the Commissioner. Appellants do not have to use a prescribed form and generally do not understand the appeal process. As a result, appeal requests often do not contain enough information for the Commissioner to understand what is being appealed. Institutions should therefore include a paragraph in their decision letters informing a requester or third party that he/she can appeal the decision to the IPC within 30 days, and that their notice of appeal should be accompanied by:

• the file number assigned to the request by the institution;
• a copy of the decision letter; and
• a copy of the original request for information.

If an appellant is appealing a decision by an institution that the requested records do not exist, the Commissioner may dismiss the appeal if the notice of appeal submitted by the appellant does not present a reasonable basis for concluding that the record ought to exist (s.50(2.1) FIPPA / s.39(2.1) MFIPPA).

Upon receiving a notice of appeal, the Commissioner notifies the institution’s Freedom of Information and Privacy Coordinator that an appeal has been filed. The Commissioner must also notify any other person who, in the Commissioner’s opinion, is "affected" by the appeal.

If an institution has any information about affected persons who should be notified of an appeal, it should convey this information to the Appeals Officer assigned to the case. Because the Commissioner cannot disclose the contents of the records to an affected party, these individuals should contact the institution’s Coordinator if they require further information. The Commissioner does not disclose the identity of the appellant to affected parties if the appellant is an individual.

Confirmation of Appeal by the Information and Privacy Commissioner

The IPC notifies an institution that an appeal has been filed by sending out a "Confirmation of Appeal" letter. It advises the institution of the name of the requester, the IPC's appeal number and the name of the Appeals Officer assigned to the case. It also advises the Coordinator to notify the Appeals Officer if the responsive records are voluminous (500 pages or more and 3 exemptions or more).

The Confirmation of Appeal also asks the institution to provide the following information within 8 working days where applicable:

• a copy of the original request and its file number,
• a copy of the head’s decision letter,
• any correspondence related to the request or the decision making process,
• an index of the records under appeal and the exemptions applied to the records (the index may be shared with the appellant so care should be taken that no exempt information appears in the index),
• a severed copy of the records under appeal where severances have been made
• unsevered copy of the records.

The institution is further notified that if it wants to claim any discretionary exemptions additional to those appearing in its decision letter, it must do so within 35 days. Where the appeal relates to either a time extension or the payment of a fee, the request for the last two items on the above list will be omitted. Reasons for launching an appeal are not always provided by an appellant. Institutions may find it helpful to contact the Appeals Officer to see whether grounds for appeal have been identified. The IPC may also be able to provide additional information that will help the institution to deal with the appeal promptly and efficiently.

An institution should provide the IPC with the records relevant to an appeal within 8 days of the date of the confirmation notice. The Commissioner may grant a time extension if an institution can demonstrate that it is not feasible to provide the records within two weeks.

How to Provide Records to the Commissioner During an Appeal

The IPC has issued guidelines on appeal procedures. While subject to change, the office requests institutions to do the following:

1. Upon receipt of the Confirmation of Appeal, the institution should provide the IPC with a copy of the original request, any relevant correspondence with the requester, and the records at issue in the appeal.
2. If the records have been severed, the institution should identify the severances on the record itself either by highlighting the severed portions on a copy of the record, or by providing copies of both the severed and unsevered records to the IPC.

Where more than one section of the Act is claimed to justify the severance, or where more than one exemption applies to the record, the institution should:

1. number all documents,
2. number all pages within a document,
3. prepare an index of records containing the following information:
   • the document number,
   • the page number,
   • whether or not an exemption has been claimed,
   • the section/subsection of the Act justifying the severance,
   • the reason for applying the exemption.

When dealing with more complex requests, compiling an index with the following headings should also be considered:

• document number,
• page number/paragraph,
• severance (yes/no),
• record released (yes/no),
• section of the Act applied,
• reasons for severance.

When dealing with more complex requests, compiling an index with the following headings should also be considered:

The Duty to Provide Records to the Information and Privacy Commission

s.52 FIPPA / s.41 MFIPPA

If an institution can demonstrate that it is not feasible to provide the records to the IPC within 8 working days, the Commissioner may grant a time extension.

If an institution fails to provide the records within the required period, the Commissioner may issue an order requiring the records to be produced. Failure to provide the records to the Commissioner may result in a prosecution for willful obstruction of the Commissioner (s.61(1)(d) FIPPA / s.48(1)(d) MFIPPA).

The Commissioner may also require that an institution prepare an affidavit describing the measures taken to search for a record if the institution claims that requested records do not exist.

The Commissioner is entitled to examine any record under appeal even if it is highly sensitive or confidential. The Commissioner’s power to require records to be produced may be delegated to an Appeals Officer unless the record is a Cabinet record or a law enforcement record, in which case the delegation may be made only to an Assistant Commissioner. The only exception to this are records which are subject to federal legislation such as the Young Offenders Act. No one is liable to prosecution for an offence under any other act because he/she has provided records to the IPC.

When making arrangements for the transfer of sensitive records to the Commission, the head should consider the nature of the record and options for the secure delivery of the records to the IPC. For example, courier companies that have bonded employees and secure transport and storage may be used. Alternatively, an employee of the institution may deliver the records to the Commission.

Records that are kept at IPC premises are subject to significant security requirements. The records cannot be removed from the IPC premises, and must be locked away when not being used. All entry to the premises is controlled by a card access system and visitors are accompanied at all times. The Act prohibits IPC staff from disclosing any information acquired during the performance of their duties. They also cannot be compelled to testify as witnesses in any proceeding with respect to the information.

The IPC does not indefinitely retain records it received during an appeal. Where an appeal is disposed of by order, the records and any copies are either returned to the institution or destroyed one year after the day the order is issued. If an appeal is settled by mediation, the records are retained for nine months. Original records provided to the IPC are returned earlier if they are needed by the institution. Institutions receive notice of these matters from the Commission.

The Commissioner may require records to be produced and may enter and inspect any premises occupied by an institution for the purposes of an investigation. However, a head may require, in exceptional circumstances, that IPC staff examine an original record on site. This power of the head may be invoked, for example, if the record is fragile, unique or there is a large volume of records. Before entering any premises, the Commissioner must first notify the head of the institution. Institutions are discouraged from relying on the provision for on-site examination of records because it would place an undue administrative burden on the Commission.

Mediation

The Commissioner may authorize a mediator (i.e an Appeals Officer) to investigate the circumstances of any appeal and to try to effect a settlement of the matter under appeal (s.51 FIPPA / s.40 MFIPPA). The Appeals Officer will review the relevant records or circumstances under appeal and verify the institution’s position. Acting as a go-between, he/she will also try to settle the appeal or simplify the issues, based on discussions with the appellant and the institution. In a mediated settlement all parties reach an agreement about the matter under appeal.

The Commissioner will attempt to settle the issues at appeal before resorting to an order. The general time period allotted for mediation is two months. This time period may be shortened if it is apparent that no agreement can be reached. The appeal will then proceed to an inquiry.

The Inquiry

s.52 FIPPA / s.41 MFIPPA

Notice of Inquiry and the Appeals Officer’s Report

Where mediation is unsuccessful, the Commissioner may conduct an inquiry to review the head’s decision (s.52(1)(b) FIPPA / s.41(1)(b) MFIPPA). At this stage, the appellant and the institution receive a "Notice of Inquiry" (NOI) letter from the Commission. The notice informs the parties to an appeal that they are entitled to make representations. The NOI states the facts of the appeal and poses questions to the parties relating to the provisions of FIPPA/MFIPPA that are relevant to the issues under appeal. However, the parties do not have to limit their representations to only those questions raised in the NOI. An institution is expected to respond to the NOI by submitting representations within three weeks of the date of the Notice of Inquiry letter unless an extension is granted.

Considering Additional Exemptions and Facts During the Inquiry Process

The Commissioner may allow an institution to claim additional exemptions or to raise additional reasons for an exemption at the inquiry stage than were claimed originally at the request stage. An institution may only claim additional discretionary exemptions within 35 days after the appeal has been opened. If an institution raises discretionary exemptions after the 35 days, the IPC is not obliged to consider the exemptions, although it may do so in unique circumstances. The institution must send a new decision letter setting out the additional exemption within the 35 day period so that the appellant is given an opportunity to comment on the applicability of the new exemption claim. The initial notice sent out by the Commissioner will specify the deadline for claiming any new discretionary exemptions.

Once an appeal has been filed, it is recommended that the Freedom of Information and Privacy Coordinator meet with the institution’s legal advisor to review the exemptions originally claimed to determine whether they should continue to be relied upon.
The may also be occasions where further representations ought to be submitted by the parties. This may occur where the IPC has, in the interim, issued an order relevant to the appeal. In these situations the Appeals Officer may advise the parties that such an order has been issued, and allow for supplementary representations.

The Burden of Proof

s.53 FIPPA / s.42 MFIPPA

The party claiming that a record is exempt from access has the burden of proving that the exemption applies.

For example, if the head denies access to a record or part of a record, he/she must prove on appeal that all or part of a record falls within an exemption under the Act. Or, if a third party who may be affected by the disclosure of a record does not want the record to be released, the third party has to show why the record should not be disclosed. If an appellant argues that there is a "compelling public interest" in the disclosure of an otherwise exempt record ( s.23 FIPPA / s.16 MFIPPA), the burden of proof lies on the appellant. The burden is not absolute, however. Where the appellant is not familiar with the content of the records, the Commissioner will review them to determine whether the provision applies.

Written or Oral Submissions

An inquiry must be conducted in a manner that protects the confidentiality of the records pending the Commissioner’s decision. Therefore, the normal rules governing the rights of parties who appear before tribunals do not apply (s.52(2) FIPPA / s.41(2) MFIPPA). These include, for example, the right to a public hearing and the right to cross-examine witnesses.

The Commission’s general practice is to conduct inquiries through written submissions. It may require an institution to make certain submissions by affidavit. Any party to the appeal may request an opportunity to make oral submissions, and an oral hearing may be held if the Commissioner believes that it would aid in an exploration of the issues.

If an oral hearing is held, the Commissioner has the power to summon and examine witnesses under oath. Anything said or any document or thing produced during an inquiry, whether oral or written, is privileged to the same extent as it would be before a court. For example, testimony provided during a hearing may not be used in other proceedings, except in cases of a prosecution for perjury.

Access to an Institution’s or Third Party’s Submissions by an Appellant

The institution, the appellant and any affected party may be represented by counsel or an agent during an inquiry. All of these parties must be given an opportunity to make submissions to the Commissioner, but "no person is entitled to be present during, to have access to or to comment on representations made to the Commissioner by an other person" (s.52(13) FIPPA / s.41(13) MFIPPA).

Except if the appeal concerns a request for correction, the appellant makes his/her submissions without the opportunity to review the records. As a result, the appellant may request access to the institution’s or a third party’s submissions. The fact that a party is not entitled to access an opposite party’s submissions does not mean that they are prohibited from seeing them. In restricted circumstances, the Commissioner may permit a party to hear or review the submissions or the other side, if doing so would not reveal the contents of the records in question.

An institution may also rely on s.52(13) FIPPA / s.41(13) MFIPPA to refuse to provide a copy of its submissions to a party who requests them directly from the institution. Other exemptions may also apply to an institution’s submissions. If a request under FIPPA/MFIPPA is made for an institution’s submissions, it is the Commission’s practice to amalgamate any appeals which may arise from such requests with the substantive appeal to which the request for representations relates.

Affidavit Evidence

On occasion, institutions are asked to provide information to the Commissioner in affidavit form to establish that records do not exist or that an adequate search was undertaken. An affidavit is a witness statement that declares under oath that a certain set of facts are true. The person swearing or affirming the statement reviews and signs it before a Commissioner for Oaths or a lawyer. In appeal inquiries before the IPC, an affidavit is acceptable as evidence in the same way as oral testimony given under oath. It is a criminal offence under the Criminal Code to swear a false affidavit.

The Effect of a Commissioner’s Order

After receiving submissions from the interested parties, the Commissioner will issue a binding order that is not subject to appeal. An order may conclude with a statement requiring the institution to disclose the records referred to in the order within 35 days following the date of the order and not earlier than the 30^th day following the date of the order. Day one is the first day after the date of the Order. Therefore, if the Order was dated May 1, the counting starts on May 2 and the first release date would be May 31. The institution may release the document on any of the 5 days following May 31^st.

Where there are no affected third parties, the Order will usually conclude with a statement requiring the institution to disclose the records within 15 days of the date of the order.

Reconsideration of Commissioner’s Orders

There is no express statutory provision in the Act that permits the Commissioner to reconsider an order. A reconsideration of an order is not an appeal of the order on its merits. A decision maker may reconsider a decision in exceptional circumstances where it is established that:

1. there is a fundamental defect in the adjudication process;
2. there is some other jurisdictional defect in the decision; or
3. there is a clerical error, accidental error or omission or other similar error in the decision.

An order will not be reconsidered simply on the basis that new evidence is provided, whether or not that evidence was obtainable at the time of the inquiry.

A request for reconsideration should be made in writing to the original Decision Maker and should include reasons why the application conforms to the criteria for reconsideration described above.

A request for reconsideration does not stay (suspend) the date of compliance for an order. An institution must still comply with the terms of an order unless otherwise directed by the IPC. It is imperative therefore, that a request for reconsideration be filed with the IPC Registrar of Appeals within 21 days of the order date. This will allow the IPC's Decision Maker to be in a position to make a determination on the request prior to the date for compliance of the order.

A request for reconsideration does not preclude a party from seeking other legal remedies that may be available (e.g. see Judicial Review below).

Judicial Review

The Commissioner has the power to issue a binding order that is not subject to an appeal. Appeals are distinct from judicial review proceedings. Judicial review proceedings are governed by the Judicial Review Procedure Act. Applications for judicial review may be brought before Divisional Court by a party to an appeal where it is alleged that the Commissioner’s decision was patently unreasonable or otherwise outside the Commissioner’s jurisdiction.

In the order issued by the Commissioner, the party against whom the order is made is advised of the right to apply for judicial review and is given 30 days to make the application. Where no application for judicial review is made within that period, the party must comply with the order.

Compliance Investigations

FIPPA/MFIPPA recognize that an institution should have basic standards for protecting personal information in its possession. The privacy provisions of the legislation require institutions to use appropriate practices and procedures for collecting, storing, using, disclosing and ultimately disposing of personal information.

Section 59 FIPPA / s.46 MFIPPA gives the Commissions the authority to:

1.  offer comment on the privacy protection implications of proposed legislative schemes or government programs, and
2.  after hearing an institution’s head, order the institution to:
   • cease a collection of personal information practice, and
   • destroy a collection of personal information that contravene FIPPA/MFIPPA.

Individuals complain to the IPC when they believe that an institution has improperly collected, used, disclosed, retained or disposed of their personal information. The IPC is responsible for reviewing possible breaches of the privacy provisions of the legislation.

Sometimes the complaint is resolved informally through a resolution that is mutually satisfactory to the complainant and the institution. An example of the mediation available at every step of the process may be a simple explanation of the procedure or why the information was used in the way that it was. In these cases, the IPC may confirm the resolution by writing a letter to the institution rather than publishing a formal investigation report. If the complaint is not resolved in this way, a formal investigation proceeds.

The Privacy Investigation Process

There are five steps in the Privacy Investigation Process:

Notice and Request for Information

A letter from the Commission’s staff notifies the institution that a complaint has been received and requests information relating to the institution’s position on the matter. It also can include specific questions about issues, such as the authority to collect, use or disclose the complainant’s personal information.

The Investigation

The institution is informed that every effort will be made to mediate and settle the complaint.

Copies of relevant documents may be required. Sometimes the investigation requires a personal visit to the institution by the investigator and/or meetings with key program staff.

Draft Report

If mediation is unsuccessful and the issues are straightforward or routine, the IPC may conclude the matter with a letter. In other cases the matter will go to a draft and final report.

Where an institution has breached the Act, recommendations to prevent future breaches are included. Both the institution and complainant are asked to comment on errors or omissions in the draft report.

Final Report

The IPC provides the institution and complainant with a final investigation report. Where recommendations have been made, the IPC requests evidence of implementation within six months. Evidence can be in the form of a letter and supporting documentation, such as a copy of a new policy or notice form.

Follow Up

If evidence is not received that the recommendations have been implemented within the six month period, the IPC contacts the institution to find out if they have been implemented, and if not, the reason why.