Decisions

The Waterloo Regional Police Services Board (the police) received a request under the Act for all records relating to the death of the requester’s son. The police granted partial access to records, but withheld portions under the personal privacy exemptions in sections 14(1) and 38(b) of the Act. The police disclosed some information in the records for compassionate reasons pursuant to section 14(4)(c) of the Act.
In this order, the adjudicator upholds the police’s decision to withhold information under sections 14(1) and 38(b).

The complainant submitted a request to a hospital to correct his personal health information contained in an intake form for an addiction treatment program. The hospital denied the correction request based on sections 55(9)(a) and (b) of the Act. The adjudicator decides not to conduct a review because the complainant has not established, under section 55(8), that the hospital has a duty to correct the record.

The requester sought access under the Act to records about a correctional centre. The Ministry of the Solicitor General (the ministry) granted full access to responsive records that were located. The ministry also advised that some of the requested records could not be located and suggested the requester make a request to another institution for those records. The requester believes that the ministry should have additional responsive records in its custody or under its control.
In this order, the adjudicator finds that the ministry has not established that additional records are not in its custody or under its control. She orders it to conduct another search.

The City of Toronto (the city) received a request for the property addresses and amounts owing of everyone who owed municipal tax arrears to the city. The city denied access to the records in full, stating that the records were publicly available through a process established under section 317(1) of the City of Toronto Act, 2006, and therefore exempt under section 15(a) (information published or available to the public) of MFIPPA. The city also claimed that the records were exempt from disclosure under section 14(1) (personal privacy) of MFIPPA.
In this order, the adjudicator finds that although a system for accessing the records exists under the City of Toronto Act, 2006, the cost of the appellant accessing the specific records he requested is so high as to be prohibitive, and section 15(a) does not apply. He finds that records relating to properties owned by individuals are exempt from disclosure under section 14(1), but records relating to properties not owned by individuals are not. He orders the city to issue an access decision for records relating to properties that are not owned by individuals.

The appellant made a request under the Act for records relating to the internal police investigation of a named police officer. The police denied access to the responsive records on the basis that the records are excluded from the Act pursuant to the labour relations and employment exclusion at section 52(3)1. In this order, the adjudicator finds that the responsive records are excluded from the application of the Act by section 52(3)1. She dismisses the appeal.

The Township of Hornepayne received a request under the Act for an agreement between it and a certain company. The township identified a confidential by-law with an attached settlement agreement as the responsive record. In this order, the adjudicator finds that the records are not exempt under the discretionary exemption at section 12 (solicitor-client privilege) of the Act. However, she finds that the record is subject to common law settlement privilege and need not be disclosed under the Act.

This decision deals with two issues arising out of an access request made under the Personal Health Information Protection Act to the City of Toronto’s Seniors Services and Long-Term Care (the custodian) for records relating to a former resident of a long-term care home. The issues are the custodian’s search for records, and the legibility of records that were originally paper-based, subsequently scanned and released to the complainant by the custodian. In this decision, the adjudicator finds that the complainant has established a reasonable basis to conclude that further records exist regarding complaints that were made to the custodian about the health care provided to the resident. As a result, the custodian is ordered to conduct a further search for records relating to these complaints. Concerning the legibility of the records, the adjudicator finds that it is not necessary to order the custodian to re-scan the records because the custodian did so after the conclusion of the review of this complaint.

The complainant’s request for access to his son’s records of personal health information was denied by the hospital under section 23(3) of the Personal Health Information Protection Act, 2004, because the son did not consent. In this decision, the adjudicator concludes that the hospital responded adequately, and no review of the complaint is warranted.

The appellant requested correction of his personal information – the removal of his name from an occurrence details report about an incident involving him. The police denied the correction request because it did not meet the requirements for the police to grant it; the appellant’s name had to remain in the report because he was the individual who had contacted the police. The police advised the appellant that he could require that a statement of disagreement be attached to the report in accordance with section 36(2)(b) of the Act.

The adjudicator exercises her discretion under section 41(1) of the Act not to conduct an inquiry to review the police’s decision because an inquiry is not warranted. The police have responded adequately to the correction request, and they are not required to grant it. The appeal is dismissed.

The appellant sought access to information about individuals who had made complaints against a specified address by making a request under the Act to the city. Ultimately, the city disclosed some information to the appellant and withheld some information claiming the discretionary personal privacy exemption at section 38(b). In this order, the adjudicator upholds the city’s decision and dismisses the appeal.

The Ministry of Public and Business Service Delivery (the ministry) received a request under the Act for access to records relating to a named company’s application to become a licensed consumer reporting agency. The ministry decided to disclose the records, in part. The named company appealed the ministry’s decision In this order, the adjudicator finds that some information that the ministry decided to disclose qualifies as personal information. As the requester does not seek access to personal information, she orders the ministry not to disclose it to the requester. She also finds that section 17(1) (third party information) does not apply. As a result, the adjudicator partially upholds the ministry’s decision.

The ministry of the Attorney General (the ministry) requested reconsideration of Order PO-4491 on the basis that there was an accidental error in relation to one record ordered to be disclosed. In this reconsideration order, the adjudicator finds that an accidental error occurred and that there are sufficient grounds to reconsider Order PO-4491 in accordance with the IPC’s Code of Procedure. After reconsidering the order, the adjudicator finds that the discretionary exemption at section 14(1)(j) (law enforcement) applies to the record, and she upholds the ministry’s exercise of discretion to withhold it.

The appellant requested a reconsideration of Order MO-4478-F. In that order, the adjudicator found that the police’s search, following Interim Order 4266-I, was reasonable and dismissed the appeal.
In his reconsideration request, the appellant claimed fundamental defects in the adjudication process, a lack of procedural fairness, jurisdictional defects, serious errors and omissions, and reasonable grounds to presume bias. In this reconsideration order, the adjudicator finds that the appellant has not established any of the grounds for reconsideration in section 18.01 of the IPC’s Code of Procedure and denies the reconsideration request. He also finds that the appellant has not established bias or a reasonable apprehension of bias.

The appellant made a request under the Act for records relating to a complaint he filed regarding a surveillance camera in his neighbourhood. The city withheld some records, claiming the discretionary exemptions in section 38(a) (records containing the requester’s own personal information), read with sections 7(1) (advice or recommendations) and 12 (solicitor-client privilege), and section 38(b) (unjustified invasion of personal privacy). In this order, the adjudicator upholds the city’s decision and finds there is no public interest in the disclosure of the records. The adjudicator dismisses the appeal.

The Information and Privacy Commissioner of Ontario (the IPC) received an anonymous complaint from a group of doctors relating to two research databases created from personal health information, UTOPIAN and POPLAR. The complaint alleged that the personal health information used to populate these databases was obtained from health information custodians without patient consent, and without providing sufficient information to the custodians. The complaint raised concerns about the de-identification of personal health information, and the possibility that such information was being sold or otherwise provided to third parties. The complainants contended that the underlying activity of operating a database of the nature of UTOPIAN and POPLAR was not “research” as contemplated by section 44 of the Personal Health Information Protection Act (the Act or PHIPA), and further alleged that even if this was research, the databases did not otherwise meet the requirements of section 44.
The IPC contacted the University of Toronto (the University), the operator of UTOPIAN. The University stated that POPLAR had been taken over by Queen’s University and was not yet operational, which Queen’s independently confirmed to the IPC. Accordingly, this investigation in respect of the University focuses on UTOPIAN only.
The University provided the IPC with extensive documentation regarding the operation of UTOPIAN. During the course of the investigation, the University stated that it continued to operate its database pursuant to a Protocol Completion Report approved by the University of Toronto Research Ethics Board (REB) after the REB approval for its research plan had expired. Later in this investigation, the University reported that it had paused all UTOPIAN activities and was in the process of applying for REB approval for use of the archived UTOPIAN database for research purposes.
In this decision, I find that the University collected personal health information without authorization under the Act during two periods when its REB approval had lapsed. I also find that the University failed to comply with requirements in s. 44 of the Act in that it failed to provide health information custodians copies of the research plan and its approval decision, failed to make regular site visits as required under the applicable research plan, and failed to provide custodians with notice of the 2018 collections of personal health information that occurred without an REB approval in place. Finally, I find that the University did not amend its research agreements by merely sending custodians notice of its proposed changes, and to the extent that the University collected, used, and retained personal health information beyond what was permitted by the applicable research agreement, this collection, use, and retention contravened section 44 of the Act.
The IPC did not find any evidence to substantiate the complainants’ allegations regarding the sale of personal health information, or their de-identification concerns. However, I recommend that in its new application to the REB relating to UTOPIAN data, the University should update its means of notifying patients regarding the UTOPIAN project, conduct a re-identification study to assess the robustness of its de-identification procedures, and exercise greater transparency with contributing custodians. I also recommend that the University ensure that it has research agreements in place with contributing custodians, including any significant amendments hereto, and that it complies with the applicable research agreements.