Latest IPC Decisions

The appellant asked the ministry for records, between March 2020 and March 2022, of scientific evidence for specific COVID-19 protocols. The ministry located seven records (totalling over 150 pages) that were responsive to the appellant’s request. However, the appellant asserted that additional records should exist. In this order, the adjudicator finds that the ministry’s affidavit evidence establishes that the ministry conducted a reasonable search for records responsive to the appellant’s request. She dismisses the appeal.

A school board received a multi-part request under the Municipal Freedom of Information and Protection of Privacy Act for a variety of records, including privacy assessments. The board withheld the records at issue, taking the position that disclosure would impact its economic interests (section 11(a)). In this order, the adjudicator finds that one record is not exempt under section 11(a) and orders the board to disclose it. The adjudicator upholds the board’s decision to deny access to the two remaining records on the basis that section 11(a) applies and finds that the public interest override (section 16) does not apply.

An individual made a request under the Municipal Freedom of Information and Protection of Privacy Act to the town for access to records and information relating to third party vendors on the town’s website. The town provided a fee estimate and sought a time extension of 30 days to respond to the request.
The individual appealed the town’s fee estimate and time extension to the IPC. During mediation, the individual sought a fee waiver from the town. The town denied the fee waiver request.
In this decision, the adjudicator upholds the town’s fee estimate, time extension and denial of fee waiver.

The police received a request from the appellant for access to information about his father’s death. The police granted partial access to responsive records. Two affected parties, individuals who lived with the deceased at the time of his death, opposed disclosure of their personal information in the records, including where it is inextricably mixed with the deceased’s personal information. She finds that the information at issue is exempt under the personal privacy exemptions in sections 14(1) and 38(b) of the Act.

An individual asked the city for records related to Next Generation 911. The city initially provided the individual with a fee estimate of $1180, but after processing the access request, it provided the individual with a final fee of $990. The individual disputes that the fee is reasonable. In this order, the adjudicator orders the city to reduce the fee to $645.

This final order determines whether the City of Toronto (the city) conducted a reasonable search under the Municipal Freedom of Information and Protection of Privacy Act for records relating to repairs to sidewalks at a specific address. In Interim Order MO-4558-I, the adjudicator determined that the city had not conducted a reasonable search and ordered it to conduct a further search for responsive records. In this final order, the adjudicator finds that the city has now conducted a reasonable search for responsive records, and she dismisses the appeal.

On April 2, 2024, an individual asked the ministry for records between it, the staff of three private sector beverage companies, and the Beer Store since 2018. On May 1, 2024, the ministry provided the appellant with a fee estimate and on June 5, 2024, the appellant paid a deposit. Upon payment of the deposit, the ministry claimed a time extension of 240 days under section 27(1) of the Act until February 3, 2025. This order partly upholds the ministry’s decision to claim a time extension, but reduces it from 240 days to 223 days, and orders the ministry to issue a final access decision by January 14, 2025.

This final order determines whether the college conducted a reasonable search for responsive records in response to Interim Order PO-4512-I. In compliance with the Interim Order, the college conducted further searches and provided four affidavits in support of its searches. The adjudicator finds that the college provided sufficient evidence to establish that it has conducted a reasonable search for responsive records. The appeal is dismissed.

An individual made a request to the Ministry of the Solicitor General under the Freedom of Information and Protection of Privacy Act for records of entities that have queried or accessed a specified OPP file. The ministry initially refused to confirm or deny the existence of the requested records (section 14(3)) but subsequently provided the requester with access to part of a record.
The requester believes that additional records regarding queries of and accesses to the OPP file ought to exist and challenged the reasonableness of the ministry’s search.
In this interim order, the adjudicator finds that the ministry has not provided sufficient evidence to demonstrate that reasonable efforts have been made to conduct a search for the records the appellant is seeking. The adjudicator orders the ministry to conduct a further search for records and to provide affidavit evidence explaining its searches.

A company submitted a request for reconsideration of Order MO-4507, where the adjudicator upheld the city’s decision to withhold a report under the closed meeting exemption. The company claimed that there was a fundamental defect in the adjudication process.
In this reconsideration order, the adjudicator finds that neither a fundamental defect in the adjudication process nor any of the other grounds for reconsideration under section 18.01 of the IPC’s Code of Procedure has been established and denies the request for reconsideration.

A person asked the Barrie Police Services Board for a report related to the death of the person’s parent. The police gave the person partial access to two records. The police denied access to some information in the records because they contain another person’s personal information [section 38(b)]. The person seeks full access to one of the records.
The adjudicator agrees with the police’s decision not to share some information in the record at issue and dismisses the appeal.

An individual requested access from a social services administration board (the board) to all records relating to an apartment unit, including complaints, emails or other correspondence. The board denied access to the records, claiming the personal privacy exemptions. In this order, the adjudicator finds the records are exempt under the personal privacy exemptions because disclosure of the personal information in those records would be an unjustified invasion of personal privacy. She upholds the institution’s decision not to disclose them and dismisses the appeal.

This order resolves two related appeals. Under the Municipal Freedom of Information and Protection of Privacy Act, an individual requested access to records relating to his name being searched through the databases of the Niagara Police Services Board (the police), including the reasons that his name was being searched and underlying associated records. In response to one request, the appellant received access to some information; in response to the other, he was told that there were no responsive records. The requester challenged the reasonableness of the police’s searches because he believed other records should exist. In this order, the adjudicator upholds the reasonableness of the police’s search efforts and dismisses the appeals.

The Sault Ste. Marie Police Services (the police) reported to the Office of the Information and Privacy Commissioner of Ontario that their network servers were infected with ransomware and that, as a result, records of personal information stored on data drives on the servers were encrypted.

In response, the police took steps to contain, investigate, remediate and inform local residents about the ransomware attack. However, the police did not believe that the attack resulted in a privacy breach because their investigation determined that the information was encrypted in place, and neither obtained or exfiltrated by the threat actor.

In this report, I find that the threat actor’s encryption of the data drives affected the personal information stored on them by making this information inaccessible to the police. I also find that the ransomware attack resulted in an unauthorized use of personal information and, therefore, a privacy breach under the Municipal Freedom of Information and Protection of Privacy Act.

I am satisfied with the steps taken by the police to contain the breach. Although the police informed the public of the breach through a press release issued at the time of the ransomware attack, I find that there would be no useful purpose in deciding whether they should renotify affected individuals given the passage of time since the breach. I am not entirely satisfied with the police’s investigative and remedial steps because they have not reviewed their policies and practices in protecting personal information. As such, I find that the police have not responded adequately to the breach and recommend that they conduct this review.

Further, it appears that the police understand the nature of their information holdings, the threats posed by ransomware attacks and the steps required to mitigate these attacks. However, despite requests, the police did not provide this office with materials relating to their privacy training practices and, therefore, I could not evaluate the reasonableness of these practices which are important for reducing the risk of a threat actor gaining unauthorized access to an institution’s records. Because of this, I am not satisfied that the police haves reasonable measures in place to prevent unauthorized access to records as required by section 3(1) of Regulation 823 under MFIPPA (security of records) and recommend that they ensure that their training materials comply with this section.

A requester asked the hospital for video surveillance footage after his visit to the hospital. The hospital found several hours of video footage, but stated that some of the requested footage had been deleted in accordance with its retention policy. The requester complained about the hospital’s response to the IPC, stating that it had improperly deleted the footage. The fee the hospital was charging for the footage, and the hospital refusing a fee waiver, was also disputed in the complaint.
In this decision, the adjudicator finds that the hospital did not improperly delete the video footage, and he upholds the hospital’s fee and denial of a fee waiver. He dismisses the complaint.