Latest IPC Decisions

The appellant made a request to the ministry for access to records about himself. The ministry determined that portions of four responsive records were not responsive to the request because they are not about the appellant. The appellant seeks access to the withheld information, challenges the reasonableness of the ministry’s search for responsive records, and claims the ministry acted in a conflict of interest. The adjudicator finds that the information at issue is not responsive to the request and upholds the ministry’s search as reasonable. She finds that the appellant’s conflict of interest claim is not substantiated and dismisses the appeal.

A public hospital reported a privacy breach under PHIPA to the Office of the Information and Privacy Commissioner of Ontario (IPC). The breach involved a radiologist with privileges at the hospital who accessed patients’ health records without authorization. The affected patients included the radiologist’s sister-in-law, who brought the privacy breach to the attention of the hospital, as well as members of her family.
As an agent of the hospital, the radiologist’s actions were an inappropriate use of personal health information by the hospital contrary to section 29 of PHIPA which sets out limits on and requirements for the use of this information.
In response, the hospital took steps to investigate, contain and remediate the breach. The hospital also provided the appropriate notification in the circumstances, disciplined the radiologist and reported him to the College of Physicians and Surgeons of Ontario.
Despite this, the IPC had concerns about the hospital’s ability to detect and deter unauthorized access to patients’ health records in relation to its EHR systems. These systems were not built from a privacy audit perspective and the hospital only became aware of the breach because of a privacy complaint made by the radiologist’s sister-in-law to another regional hospital about him.
At the time of the breach, the hospital’s EHR systems had inherent limitations and, generally, did not display a privacy notice or warning flag. For these reasons, the investigator finds that the hospital did not take steps that are reasonable in the circumstances for the security of personal health information against unauthorized use as required by section 12 of PHIPA. However, given the hospital’s response to the breach and implementation of privacy warning flags in its EHR systems, the investigator finds that a formal review of this matter under Part VI of PHIPA is not warranted.

This second interim order follows Interim Order MO-4488-I, in which the IPC ordered the respondent board to issue a new access decision in response to a request for a line-by-line breakdown of the 2020 Toronto Police Service budget for six specified police units and services, organized by individual program area, function, and service delivered. In the first interim order, the adjudicator found that the board’s disclosures to that point did not fully respond to the appellant’s request for a detailed budget breakdown, including specified components. She also found that the board had failed to clearly articulate or substantiate a claim that responsive budget information does not exist, or otherwise cannot be produced for the purposes of access under the Municipal Freedom of Information and Protection of Privacy Act (the Act).
In this second interim order, the adjudicator considers the board’s evidence in support of its revised decision that responsive budget information “never existed and it is not possible to produce this information.” She finds that the board has again failed to substantiate a claim that responsive budget information either does not exist, or exists but cannot be produced for the purposes of the Act. She orders the board to conduct another search for responsive information in its custody or control. If, following this search, the board concludes that responsive information does not exist anywhere in its record holdings, or cannot be produced in the form of a “record” for the purposes of the Act, the board must provide a detailed explanation of how it reached this conclusion. The adjudicator remains seized of the appeal to address issues arising from this second interim order.

An individual sought access under the Municipal Freedom of Information and Protection of Privacy Act to records relating to his residence. The city granted partial access to some records and denied access in full to emails and attachments on the basis that disclosure would be an unjustified invasion of another individual’s personal privacy (section 38(b)). In this order, the adjudicator finds that the information in the emails and attachments is exempt under section 38(b). She upholds the city’s decision and dismisses the appeal.

In response to further searches ordered by the IPC, the university located responsive records but claimed that most of them could not be disclosed under the Freedom of Information and Protection of Privacy Act because of the employment and labour relations exclusion at section 65(6). In this order, the adjudicator upholds the university’s claim and dismisses the appeal.

A journalist requested copies of serious occurrence reports provided to the ministry by a particular Indigenous children’s aid service provider for a specified 10-month period. The ministry refused to provide the journalist with copies of these reports, stating that providing the records would infringe the privacy rights of the individuals in the reports [the reason (exemption) at section 21(1) of the Freedom of Information and Protection of Privacy Act (FIPPA)]. The journalist did not seek the names of the children in care but information about each occurrence and how it was handled. The ministry maintained that disclosure of the information sought was not permitted for the personal privacy reason stated in FIPPA.

In this order, the adjudicator finds that some of the records are not able to be accessed under FIPPA due to the Youth Criminal Justice Act. Regarding the remaining information, the adjudicator agrees with the ministry and dismisses the appeal. The adjudicator also addresses the ministry’s claim made during the inquiry that some of the records could not be disclosed due to a confidentiality provision in the Child, Youth, and Family Services Act, 2017.

The city of Hamilton (the city) received a request under the Municipal Freedom of Information and Protection of Privacy Act for records related to the receipt of social assistance by tenants at a particular address (where the requester is the landlord). The city decided that it could not confirm or deny whether there were responsive records [section 14(5) of the Act]. The adjudicator upholds the city’s decision to do so and finds that there is no public interest in disclosure of the records, if they exist, under the “public interest override” (section 16 of the Act).

An individual made a request under the Freedom of Information and Protection of Privacy Act to the Ministry of Public and Business Service Delivery for access to an agreement with a named company for record storage services. The ministry issued a decision granting full access to the agreement. The named company appealed the decision on the basis that the exemption for third party information at section 17(1) applies to the information the ministry is prepared to disclose. In this order, the adjudicator finds that the information remaining at issue is not exempt under section 17(1). She upholds the ministry’s decision to disclose the information and dismisses the appeal.

This matter arises from a community health centre’s report to the IPC about the publication of a magazine article describing the experiences of an unnamed child involved in the child welfare system. The centre identified the child as a recipient of its services, and the article’s author as the partner of a centre employee who provided health care services to the child. The centre asserts that through her involvement in the article, the employee breached the child’s privacy, in violation of the Personal Health Information Protection Act, 2004 (PHIPA).
In this decision, the adjudicator finds that the employee breached PHIPA through the improper use of the child’s personal health information in the custody or control of the centre, for purposes unrelated to her duties as an agent of the centre. The resulting magazine article does not contain identifying information of the child that qualifies as “personal health information” within the meaning of PHIPA; as a result, its publication was not a disclosure of personal health information to the broader public. In the circumstances, which include the employee’s departure from the centre, the adjudicator declines to make any orders. However, she recommends some changes to the centre’s information practices to address some gaps, including around its agents’ publication of client information.

The appellant asked Agricorp for records containing data about grape production in Ontario. Agricorp denied the appellant access to some of the responsive records, claiming that the exemption for third-party information at section 17(1) of the Freedom of Information and Protection of Privacy Act applied to them. In this decision, the adjudicator finds the third-party exemption applies to the information Agricorp withheld and she dismisses the appeal.

A school board received a request for information under the Municipal Freedom of Information and Protection of Privacy Act (the Act) for pricing information contained in a contract with student transportation operators. The board denied access to this pricing information, stating that it is third party information subject to the mandatory exemption in section 10(1) of the Act.
In this order, the adjudicator finds the pricing information at issue is not third party information exempt under section 10(1) and orders the board to disclose it.

An individual asked the ministry for information about eligibility criteria and appointments to Professional Engineers Ontario committees under the Freedom of Information and Protection of Privacy Act (the Act). The ministry located records and provided some of them to the individual. The ministry said that it was withholding other information because the Act either permitted or required it to do so. The individual appealed and in this decision, the adjudicator upholds some parts of the ministry’s decision. She orders the ministry to withhold other people’s personal information and agrees with the ministry that some of the information is not responsive to the Act. However, she finds that other information is responsive to the request and orders the ministry to issue an access decision. She does not uphold the ministry’s decision to apply sections 13(1) or 17(1) of the Act and orders the ministry to disclose that information.

The Ottawa Community Housing Corporation (OCH) received a request under the Municipal Freedom of Information and Protection of Privacy Act (the Act) for records related to three types of contracts. OCH took steps to clarify the request. OCH identified 26 responsive records and decided to disclose 24 of them in full. It decided it needed to withhold parts of the remaining two contracts for certain reasons (exemptions): to protect the personal privacy of individuals whose personal information in one contract [section 14(1)] and to protect third party information in both contracts [section 10(1)]. The requester appealed this decision and raised three more issues: the scope of the request (section 17), the reasonableness of OCH’s search (section 17), and OCH’s compliance with section 23 (which relates to giving a copy of a record or a chance to examine it).
The adjudicator allows the appeal on the issue of section 10(1) because she finds that the information withheld under that exemption does not qualify for that exemption. However, the adjudicator agrees with OCH that the information withheld under section 14(1) is personal information that cannot be disclosed. She also agrees with OCH’s interpretation of the scope of the request and the reasonableness of its search. In addition, the adjudicator finds that OCH complied with section 23 and that the reasons that the appellant raised this issue do not apply in these circumstances.

A deceased woman’s mother asked the ministry for records relating to her daughter’s death. The ministry decided to grant partial access to the deceased’s personal information contained in Ontario Provincial Police records. The deceased woman’s surviving husband opposes disclosure to her mother of any information about her death. The adjudicator upholds the ministry’s decision that there are compassionate reasons to disclose some of the deceased’s personal information to her mother under section 21(4)(d) (compassionate reasons). She discusses how to consider competing positions of spouses and close relatives where compassionate reasons are established under section 21(4)(d).

An individual submitted a request to the South Simcoe Police Services Board (the police) under the Municipal Freedom of Information and Protection of Privacy Act (the Act) for records related to three specific police occurrences. The police granted partial access to the responsive records withholding information under the discretionary personal privacy exemption (section 38(b)), and because some of the information could facilitate commission of an unlawful act (section 38(a) read with section 8(1)(l)) of the Act. In this order, the adjudicator upholds the police’s decision and dismisses the appeal.