Decisions

The Information and Privacy Commissioner of Ontario (the IPC) received an anonymous complaint from a group of doctors relating to two research databases created from personal health information, UTOPIAN and POPLAR. The complaint alleged that the personal health information used to populate these databases was obtained from health information custodians without patient consent, and without providing sufficient information to the custodians. The complaint raised concerns about the de-identification of personal health information, and the possibility that such information was being sold or otherwise provided to third parties. The complainants contended that the underlying activity of operating a database of the nature of UTOPIAN and POPLAR was not “research” as contemplated by section 44 of the Personal Health Information Protection Act (the Act or PHIPA), and further alleged that even if this was research, the databases did not otherwise meet the requirements of section 44.
The IPC contacted the University of Toronto (the University), the operator of UTOPIAN. The University stated that POPLAR had been taken over by Queen’s University and was not yet operational, which Queen’s independently confirmed to the IPC. Accordingly, this investigation in respect of the University focuses on UTOPIAN only.
The University provided the IPC with extensive documentation regarding the operation of UTOPIAN. During the course of the investigation, the University stated that it continued to operate its database pursuant to a Protocol Completion Report approved by the University of Toronto Research Ethics Board (REB) after the REB approval for its research plan had expired. Later in this investigation, the University reported that it had paused all UTOPIAN activities and was in the process of applying for REB approval for use of the archived UTOPIAN database for research purposes.
In this decision, I find that the University collected personal health information without authorization under the Act during two periods when its REB approval had lapsed. I also find that the University failed to comply with requirements in s. 44 of the Act in that it failed to provide health information custodians copies of the research plan and its approval decision, failed to make regular site visits as required under the applicable research plan, and failed to provide custodians with notice of the 2018 collections of personal health information that occurred without an REB approval in place. Finally, I find that the University did not amend its research agreements by merely sending custodians notice of its proposed changes, and to the extent that the University collected, used, and retained personal health information beyond what was permitted by the applicable research agreement, this collection, use, and retention contravened section 44 of the Act.
The IPC did not find any evidence to substantiate the complainants’ allegations regarding the sale of personal health information, or their de-identification concerns. However, I recommend that in its new application to the REB relating to UTOPIAN data, the University should update its means of notifying patients regarding the UTOPIAN project, conduct a re-identification study to assess the robustness of its de-identification procedures, and exercise greater transparency with contributing custodians. I also recommend that the University ensure that it has research agreements in place with contributing custodians, including any significant amendments hereto, and that it complies with the applicable research agreements.

The Toronto Police Services Board (the police) received a request under the Act for access to records related to a specific incident on a Toronto Transit Commission (TTC) streetcar. The police granted partial access to the responsive records, withholding information under the discretionary personal privacy exemption at section 38(b) of the Act. The appellant appealed the police’s decision to the IPC and raised reasonable search as an issue. In this order, the adjudicator finds the police conducted a reasonable search, and partially upholds the police’s decision to withhold some of the information. However, she orders the police to disclose additional information to the appellant.

The appellant made a request to the municipality under the Act for records related to the former mayor and former Chief Administrative Officer (CAO). The municipality located and granted partial access to responsive records, but withheld a letter sent to the CAO under section 14(1) (personal privacy). The appellant sought access to the letter and raised the application of the section 16 public interest override.
In this order, the adjudicator finds that the termination letter is excluded from the scope of the Act under section 52(3). He dismisses the appeal.

The University of Toronto (the university) received two requests under the Act for records related to the appellant’s interactions with the university and its staff.

The university denied access to the records in full, claiming the exclusion at section 65(6)3 (employment or labour relations) applies to an internal investigative report about an employee and emails about the report and the exemption at section 49(a) (discretion to refuse requester’s own information), read with section 20 (threat to safety or health), applies to the remaining records, which are emails and reports.

In this order, the adjudicator upholds the university’s decision that the investigative report and emails about the report are excluded from the scope of the Act by reason of section 65(6)3. She also upholds the university’s decision that the remaining records are exempt by reason of section 49(a), read with section 20.

The complainant sought access to her records of personal health information from Dr. Eric Ireland (the custodian). This decision determines that the custodian is deemed to have refused the complainant’s request for access. The custodian is ordered to provide a response to the complainant in response to her request for access to records of her personal health information in accordance with the Personal Health Information Protection Act.

The appellant requested a reconsideration of the adjudicator’s decision in Order
MO-4199 to uphold, in part, the reasonableness of a search conducted by the Regional
Municipality of Durham (the region) for records about environmental testing at a waste
management facility.
In this decision, the adjudicator finds that the appellant has not established any of the grounds
for reconsideration in section 18.01 of the IPC’s Code of Procedure

The appellant submitted a request under the Act to the town for emails relating to a recreational facility. The town withheld the emails of councillors on the basis that it does not have custody or control of them under section 4(1). The adjudicator finds that three emails are within the town’s custody and control and orders the town to issue an access decision related to these emails. The adjudicator upholds the town’s decision that the remaining emails withheld under section 4(1) are not in its custody or control.

The town also located other emails exchanged between staff and residents. The town granted the appellant partial disclosure to these emails claiming that disclosure would constitute an unjustified invasion of personal privacy under section 14(1). The adjudicator also finds that the personal privacy provision applies to the majority of the emails and upholds the town’s decision to not to disclose them to the appellant under section 14(1). The adjudicator reserves her finding on the application of section 14(1) to three emails, pending notification of the individuals who might be affected by their disclosure.

On May 25, 2023, the requester submitted a request under the Freedom of Information and Protection of Privacy Act (the Act) to the Ministry of the Solicitor General (the ministry) for access to general records. The requester appealed to this office on the basis that the ministry failed to provide an access decision within the prescribed time limit under the Act. This order finds the ministry to be in a deemed refusal situation pursuant to section 29(4) of the Act. The ministry is ordered to issue a final decision regarding access by May 9, 2024, without any recourse to a time extension.

The appellant sought access to all university records during a specific period regarding his appointment to a position with an external organization while he was a professor at the university. The university located responsive records and granted the appellant access to most of them. To withhold some records and information, the university relied on the discretionary exemption in section 49(a) (discretion to refuse requester’s own information), read with section 13(1) (advice or recommendations). It also withheld information that was not responsive to the request.
The appellant challenged the university’s decision and asserted that the withheld information should be ordered disclosed under section 23 because disclosure is in the public interest.
In this order, the adjudicator upholds the university’s decision that the information it withheld under section 49(a) read with section 13(1) is exempt from disclosure. She also concludes that the public interest override does not apply because the withheld information does not relate to the geopolitical issue the appellant cites; rather, the withheld information relates to a university resources allocation matter.

The appellant requested a reconsideration of Order PO-4494. In that order, the adjudicator upheld the ministry’s decision to withhold a determination of needs tool (the tool) from disclosure under section 18(1)(d) (economic and other interests) of the Act. In this decision, the adjudicator finds the appellant has not established any of the grounds for reconsideration in section 18.01 of the IPC’s Code of Procedure. The appellant’s reconsideration request is denied.

The Municipality of Middlesex Centre (the municipality) received a request under the Act for information related to the maintenance of a specified municipal property. The municipality denied the request on the basis that it was frivolous or vexatious, stating that the appellant had already been informed through previous letters from the municipality, disclosures under the Act, and court disclosures that the requested information does not exist. In this order, the adjudicator finds that the request was made for a purpose other than to obtain access and that it is frivolous or vexatious within the meaning of the Act. He dismisses the appeal.

The Toronto Police Services Board received a request under the Act for records, including photographs or videos, relating to the marine unit’s assistance to another police service’s investigation into the disappearance of six teenagers in 1995. The police responded to the request claiming that no records exist. In this appeal, the adjudicator finds that the police conducted a reasonable search and dismisses the appeal.

The appellant made a request under the Act for the email records of seven Liquor Control Board of Ontario (LCBO) employees. The LCBO issued a fee estimate of $15,557.50. The appellant requested a waiver of this fee based on financial hardship. The LCBO denied the appellant’s fee waiver request.

In this order, the adjudicator upholds the LCBO’s denial of a fee waiver, as she finds that a fee waiver is not fair and equitable in the circumstances of this appeal.

The complainant requested seven corrections be made to certain records in his Children’s Services Record under Part X of the Child, Youth and Family Services Act, 2017. The Durham Children’s Aid Society refused the correction request, and the complainant filed a complaint with the IPC for a review of the refusal. The complainant also challenged the reasonableness of DCAS’s search for records responsive to his request and alleged that certain DCAS staff who were addressing his correction request were in a conflict of interest.
DCAS subsequently granted the complainant’s request for two corrections. However, DCAS maintained that for the remaining five requested corrections the complainant had not demonstrated to its satisfaction that the records were inaccurate or incomplete, as required for the application of the duty to correct in section 315(9) of the Act.
In this decision, the adjudicator considers the correction provisions in the Act and upholds DCAS’s decision that the duty to grant a correction in section 315(9) of the Act applies in respect of two of the seven requested corrections. She also concludes that DCAS has granted the two required corrections in compliance with sections 315(1) and 315(11) of the Act. Finally, the adjudicator upholds DCAS’s refusal of the remaining requested corrections and the reasonableness of its search for responsive records, and she determines that the complainant’s conflict of interest concern is unfounded. In the circumstances, no order is issued.

The appellant sought access under the Act to a police report about an incident he was involved in. The police granted partial access to the report, citing section 38(b) (personal privacy) of the Act to deny access to the remaining information. In this order, the adjudicator finds that disclosure of the withheld information would constitute an unjustified invasion of personal privacy and therefore, this information is exempt under section 38(b). She dismisses the appeal.