Decisions

The appellant submitted a request for reconsideration of Order MO-4439. In this reconsideration order, the adjudicator finds that the appellant has not established any of the grounds for reconsideration in section 18.01 of the IPC’s Code of Procedure and denies the reconsideration request.

The appellant sought access to an occurrence report about an incident in which he was involved. The police granted partial access but withheld the personal information of an affected party under the personal privacy exemption in section 38(b). The adjudicator finds that disclosure of the affected party’s personal information would constitute an unjustified invasion of their personal privacy and upholds the police’s decision. She finds that the police exercised their discretion properly in withholding this information and dismisses the appeal.

The appellant made a request for records relating to the Premier’s OPP security detail and the ministry denied the appellant access to officers’ notes under the discretionary law enforcement exemption in section 14(1) of the Act. The appellant appealed the ministry’s decision to the IPC. The ministry refused to provide records to the IPC. In this interim decision, the Assistant Commissioner orders the ministry to produce the records at issue to the IPC.

The appellant submitted a request under the Act to the ministry for the criteria used under the Ontario Autism Program (the OAP) to determine the budget of core services for a child diagnosed with autism spectrum disorder. The ministry located one record, the Determination of Needs Tool (the tool), and denied the appellant access to it. The ministry withheld the record under the discretionary exemption in section 18(1)(d) (economic and other interests) of the Act. The appellant appealed the ministry’s decision and raised the possible application of the public interest override in section 23. In this order, the adjudicator finds the tool qualifies for exemption under section 18(1)(d) and the public interest override does not apply. The ministry’s decision is upheld, and the appeal is dismissed.

The appellant submitted a request to the Toronto Police Services Board (the police) under the Act for access to records relating to herself. The responsive records identified by the police all relate to her attempts to be recruited and hired as a police constable. The police denied access to most of the records because they are excluded from the Act by section 52(3) (labour relations or employment records). In this order, the adjudicator finds that section 52(3)3 applies to all of the records at issue. He decides to exercise his discretion under section 41(1)(b) not to conduct an inquiry to review the police’s access decision because the appeal has no reasonable prospect of success. The appeal is dismissed.

The issue in this appeal is whether the appellant’s request to the Alcohol and Gaming Commission of Ontario (the AGCO) is frivolous or vexatious under section 10(1)(b) of the Act. In this decision, the adjudicator finds the AGCO established the appellant’s request is frivolous or vexatious and upholds the AGCO’s decision to refuse the appellant access to the responsive records. The adjudicator also imposes conditions on future requests submitted by the appellant to the AGCO.

The Office of the Information and Privacy Commissioner of Ontario (the IPC) received a complaint about McMaster University’s (McMaster or the university) use of Respondus exam proctoring software under the Freedom of Information and Protection of Privacy Act (FIPPA or the Act). The software comprises two programs. Respondus LockDown Browser limits what users can access on their computers and Respondus Monitor analyzes audio and video of students during the exam to scan for possible cheating. The complainant did not want the IPC to provide their name and complaint to the university, so the IPC opened this Commissioner-initiated complaint to address the university’s use of this exam proctoring software.

This report concludes that conducting exams and appointing examiners is a lawfully authorized activity of the university. Proctoring exams online to ensure their integrity is an appropriate component of conducting certain types of exams and is therefore also a lawfully authorized activity. On the question of whether the collection of personal information through the use of Respondus exam proctoring software is necessary to proctor exams, I find that Respondus LockDown Browser collects little personal information, and only collects and uses what it needs to function. Respondus Monitor collects more sensitive personal information, including biometric information, and uses artificial intelligence (AI) technology, which carries heightened concerns. Because the personal information collected by Respondus Monitor on behalf of the university is necessary for that tool to fulfill its function of exam proctoring, it is authorized under section 38(2) of the Act. However, the university has not provided adequate notice for its collection of personal information as required by section 39(2) of the Act and the use of students’ personal information through Respondus Monitor is not in compliance with section 41(1). Moreover, the current contractual arrangement between the university and Respondus is contrary to section 41(1) of the Act in so far as it does not adequately protect all of the personal information collected and allows Respondus to use personal information for system improvement purposes without the consent of students.

In this report, I make a number of recommendations for the university to bring itself into compliance with the Act. Given the heightened risks associated with AI technologies, I also recommend that the university adopt additional guardrails around its use of Respondus Monitor and incorporate these stronger protections into its ongoing use of the software and any future agreement with Respondus.

Note: By November 1, 2024, McMaster had implemented the recommendations outlined in this report to the IPC’s satisfaction, and the file was closed.

The appellant made a request to the university for access to information about herself. The university located responsive records and granted partial access to them. The appellant appealed the university’s decision to deny access to some records on the basis of section 49(a) (right to refuse access to requester’s own personal information), read with sections 13(1) (advice or recommendations) and 14(1)(c) (reveal investigative techniques or procedures). In this order, the adjudicator partially upholds the university’s decision.

The Office of the Information and Privacy Commissioner of Ontario (the IPC) received a complaint about McMaster University’s (McMaster or the university) use of Respondus exam proctoring software under the Freedom of Information and Protection of Privacy Act (FIPPA or the Act). The software comprises two programs. Respondus LockDown Browser limits what users can access on their computers and Respondus Monitor analyzes audio and video of students during the exam to scan for possible cheating. The complainant did not want the IPC to provide their name and complaint to the university, so the IPC opened this Commissioner-initiated complaint to address the university’s use of this exam proctoring software.

This report concludes that conducting exams and appointing examiners is a lawfully authorized activity of the university. Proctoring exams online to ensure their integrity is an appropriate component of conducting certain types of exams and is therefore also a lawfully authorized activity. On the question of whether the collection of personal information through the use of Respondus exam proctoring software is necessary to proctor exams, I find that Respondus LockDown Browser collects little personal information, and only collects and uses what it needs to function. Respondus Monitor collects more sensitive personal information, including biometric information, and uses artificial intelligence (AI) technology, which carries heightened concerns. Because the personal information collected by Respondus Monitor on behalf of the university is necessary for that tool to fulfill its function of exam proctoring, it is authorized under section 38(2) of the Act. However, the university has not provided adequate notice for its collection of personal information as required by section 39(2) of the Act and the use of students’ personal information through Respondus Monitor is not in compliance with section 41(1). Moreover, the current contractual arrangement between the university and Respondus is contrary to section 41(1) of the Act in so far as it does not adequately protect all of the personal information collected and allows Respondus to use personal information for system improvement purposes without the consent of students.

In this report, I make a number of recommendations for the university to bring itself into compliance with the Act. Given the heightened risks associated with AI technologies, I also recommend that the university adopt additional guardrails around its use of Respondus Monitor and incorporate these stronger protections into its ongoing use of the software and any future agreement with Respondus.

Note: By November 1, 2024, McMaster had implemented the recommendations outlined in this report to the IPC’s satisfaction, and the file was closed.

A patient made an access request under PHIPA for notes taken during a meeting he had with a Director of a facility. The custodian denied access to the notes claiming that the legal privilege exemptions in section 52(1)(a) and (c) (legal privilege) apply. The adjudicator finds that the notes are dedicated primarily to the complainant’s personal health information and that the legal privilege exemptions do not apply. The adjudicator orders the custodian to grant the complainant access to the whole record.

A requester asked the Ministry of the Attorney General (the ministry) for copies of blueprints for the New Toronto Courthouse. The ministry located 16 responsive records and denied the requester access pursuant to the discretionary exemptions at sections 14(1) (law enforcement) and 20 (health and safety) of the Act. In this order, the adjudicator upholds the ministry’s decision to apply section 14(1) to 13 of the 16 records. The adjudicator finds that neither section 14(1), nor section 20 of the Act apply to the remaining three records and orders them to be disclosed to the requester.

The appellant sought access to the identity of an individual who complained about the tree on the appellant’s front lawn by making a request under the Act to the City of Toronto (the city).

The city denied access to the requested information, found in records relating to a 311 call made by the complainant. It relied on the mandatory personal privacy exemption in section 14(1) of the Act to deny access to the information. In this order, the adjudicator finds that the contact and identifying information of the complainant is exempt by reason of section 14(1) and upholds the city’s decision not to disclose it.

The Township of Oro-Medonte (the township) received a three-part request under the Municipal Freedom of Information and Protection of Privacy Act (the Act) about a certain water infrastructure issue. The township decided that it had reasonable grounds to consider the request as frivolous or vexatious under section 4(1)(b) of the Act. In this order, the adjudicator upholds the township’s decision, and dismisses the appeal.

Metrolinx received a six-part request under the Act for records relating to the Hurontario Light Rail Transit system. It issued a decision denying access, in full, to the records responsive to part 1 of the request, relying on section 14(1)(i) (security) of the Act . Metrolinx stated that there are no records responsive to the other parts of the request. At mediation, the issue of whether Metrolinx conducted a reasonable search for responsive records was added to the scope of the appeal. In this decision, the adjudicator upholds Metrolinx’s decision to withhold the records under section 14(1)(i). She finds, however, that Metrolinx’s search was not reasonable and orders it to conduct a further search for responsive records.

The requester made an access request to the Ministry of the Solicitor General (the ministry) under the Act for records about herself. The ministry located responsive records and disclosed them in part to the requester. The requester appealed the ministry’s decision on the basis that she believes that the ministry has not conducted a reasonable search for these records.

In this interim order, the adjudicator orders the ministry to conduct.