Latest IPC Decisions

The Ministry of the Solicitor General (the ministry) received a request for records relating to a specified incident attended by the OPP. The requester, a township, clarified that it was seeking records sufficient to answer questions into the circumstances of an affected party’s possible attendance at the incident. The ministry identified responsive records and denied access to them citing the exemption in section 21(1) (personal privacy) of the Act. For some of the records, it identified the exemption in section 14(1) (law enforcement), in the alternative. The requester appealed the ministry’s decision. In this order, the adjudicator upholds the ministry’s decision in part. She finds that, except for information about the OPP officers and other information that does not qualify as personal information, the records are exempt under the personal privacy exemption in section 21(1) and, in respect of police codes that appear in the records, under the law enforcement exemption in section 14(1). The adjudicator orders the ministry to disclose identifying information of three individuals that she finds does not qualify as personal information.

The appellant made a request to the Ministry of the Solicitor General (the ministry) under the Freedom of Information and Protection of Privacy Act (the Act) for access to records about complaints made against him regarding his care of two horses. The ministry denied access to the responsive records in part, relying on the discretionary personal privacy exemption in section 49(b).

In this order, the adjudicator upholds the ministry’s decision to deny access to the records.

This appeal relates to a multi-part request submitted under the Act for records relating to an IT system review conducted by the Town of Arnprior (the town) and an in camera discussion of that review at town council. The town granted partial access to the responsive records and relied on sections 6(1)(b) (closed meeting), 8(1)(i) (security), 10(1) (third party information) and 11 (economic and other interests) of the Act to withhold records. In this decision, the adjudicator finds that the exemptions at section 6(1)(b) and section 8(1)(i) apply to some records. She also finds neither the exemption at section 10(1) nor the exemption at section 11 apply to any of the records for which they were claimed. She orders the town to disclose the non-exempt information and dismisses the appeal.

The appellant submitted a request for reconsideration of Order MO-4439. In this reconsideration order, the adjudicator finds that the appellant has not established any of the grounds for reconsideration in section 18.01 of the IPC’s Code of Procedure and denies the reconsideration request.

The appellant sought access to an occurrence report about an incident in which he was involved. The police granted partial access but withheld the personal information of an affected party under the personal privacy exemption in section 38(b). The adjudicator finds that disclosure of the affected party’s personal information would constitute an unjustified invasion of their personal privacy and upholds the police’s decision. She finds that the police exercised their discretion properly in withholding this information and dismisses the appeal.

The appellant made a request for records relating to the Premier’s OPP security detail and the ministry denied the appellant access to officers’ notes under the discretionary law enforcement exemption in section 14(1) of the Act. The appellant appealed the ministry’s decision to the IPC. The ministry refused to provide records to the IPC. In this interim decision, the Assistant Commissioner orders the ministry to produce the records at issue to the IPC.

The appellant submitted a request under the Act to the ministry for the criteria used under the Ontario Autism Program (the OAP) to determine the budget of core services for a child diagnosed with autism spectrum disorder. The ministry located one record, the Determination of Needs Tool (the tool), and denied the appellant access to it. The ministry withheld the record under the discretionary exemption in section 18(1)(d) (economic and other interests) of the Act. The appellant appealed the ministry’s decision and raised the possible application of the public interest override in section 23. In this order, the adjudicator finds the tool qualifies for exemption under section 18(1)(d) and the public interest override does not apply. The ministry’s decision is upheld, and the appeal is dismissed.

The issue in this appeal is whether the appellant’s request to the Alcohol and Gaming Commission of Ontario (the AGCO) is frivolous or vexatious under section 10(1)(b) of the Act. In this decision, the adjudicator finds the AGCO established the appellant’s request is frivolous or vexatious and upholds the AGCO’s decision to refuse the appellant access to the responsive records. The adjudicator also imposes conditions on future requests submitted by the appellant to the AGCO.

The appellant submitted a request to the Toronto Police Services Board (the police) under the Act for access to records relating to herself. The responsive records identified by the police all relate to her attempts to be recruited and hired as a police constable. The police denied access to most of the records because they are excluded from the Act by section 52(3) (labour relations or employment records). In this order, the adjudicator finds that section 52(3)3 applies to all of the records at issue. He decides to exercise his discretion under section 41(1)(b) not to conduct an inquiry to review the police’s access decision because the appeal has no reasonable prospect of success. The appeal is dismissed.

The Office of the Information and Privacy Commissioner of Ontario (the IPC) received a complaint about McMaster University’s (McMaster or the university) use of Respondus exam proctoring software under the Freedom of Information and Protection of Privacy Act (FIPPA or the Act). The software comprises two programs. Respondus LockDown Browser limits what users can access on their computers and Respondus Monitor analyzes audio and video of students during the exam to scan for possible cheating. The complainant did not want the IPC to provide their name and complaint to the university, so the IPC opened this Commissioner-initiated complaint to address the university’s use of this exam proctoring software.

This report concludes that conducting exams and appointing examiners is a lawfully authorized activity of the university. Proctoring exams online to ensure their integrity is an appropriate component of conducting certain types of exams and is therefore also a lawfully authorized activity. On the question of whether the collection of personal information through the use of Respondus exam proctoring software is necessary to proctor exams, I find that Respondus LockDown Browser collects little personal information, and only collects and uses what it needs to function. Respondus Monitor collects more sensitive personal information, including biometric information, and uses artificial intelligence (AI) technology, which carries heightened concerns. Because the personal information collected by Respondus Monitor on behalf of the university is necessary for that tool to fulfill its function of exam proctoring, it is authorized under section 38(2) of the Act. However, the university has not provided adequate notice for its collection of personal information as required by section 39(2) of the Act and the use of students’ personal information through Respondus Monitor is not in compliance with section 41(1). Moreover, the current contractual arrangement between the university and Respondus is contrary to section 41(1) of the Act in so far as it does not adequately protect all of the personal information collected and allows Respondus to use personal information for system improvement purposes without the consent of students.

In this report, I make a number of recommendations for the university to bring itself into compliance with the Act. Given the heightened risks associated with AI technologies, I also recommend that the university adopt additional guardrails around its use of Respondus Monitor and incorporate these stronger protections into its ongoing use of the software and any future agreement with Respondus.

Note: By November 1, 2024, McMaster had implemented the recommendations outlined in this report to the IPC’s satisfaction, and the file was closed.

A patient made an access request under PHIPA for notes taken during a meeting he had with a Director of a facility. The custodian denied access to the notes claiming that the legal privilege exemptions in section 52(1)(a) and (c) (legal privilege) apply. The adjudicator finds that the notes are dedicated primarily to the complainant’s personal health information and that the legal privilege exemptions do not apply. The adjudicator orders the custodian to grant the complainant access to the whole record.

A requester asked the Ministry of the Attorney General (the ministry) for copies of blueprints for the New Toronto Courthouse. The ministry located 16 responsive records and denied the requester access pursuant to the discretionary exemptions at sections 14(1) (law enforcement) and 20 (health and safety) of the Act. In this order, the adjudicator upholds the ministry’s decision to apply section 14(1) to 13 of the 16 records. The adjudicator finds that neither section 14(1), nor section 20 of the Act apply to the remaining three records and orders them to be disclosed to the requester.

The Office of the Information and Privacy Commissioner of Ontario (the IPC) received a complaint about McMaster University’s (McMaster or the university) use of Respondus exam proctoring software under the Freedom of Information and Protection of Privacy Act (FIPPA or the Act). The software comprises two programs. Respondus LockDown Browser limits what users can access on their computers and Respondus Monitor analyzes audio and video of students during the exam to scan for possible cheating. The complainant did not want the IPC to provide their name and complaint to the university, so the IPC opened this Commissioner-initiated complaint to address the university’s use of this exam proctoring software.

This report concludes that conducting exams and appointing examiners is a lawfully authorized activity of the university. Proctoring exams online to ensure their integrity is an appropriate component of conducting certain types of exams and is therefore also a lawfully authorized activity. On the question of whether the collection of personal information through the use of Respondus exam proctoring software is necessary to proctor exams, I find that Respondus LockDown Browser collects little personal information, and only collects and uses what it needs to function. Respondus Monitor collects more sensitive personal information, including biometric information, and uses artificial intelligence (AI) technology, which carries heightened concerns. Because the personal information collected by Respondus Monitor on behalf of the university is necessary for that tool to fulfill its function of exam proctoring, it is authorized under section 38(2) of the Act. However, the university has not provided adequate notice for its collection of personal information as required by section 39(2) of the Act and the use of students’ personal information through Respondus Monitor is not in compliance with section 41(1). Moreover, the current contractual arrangement between the university and Respondus is contrary to section 41(1) of the Act in so far as it does not adequately protect all of the personal information collected and allows Respondus to use personal information for system improvement purposes without the consent of students.

In this report, I make a number of recommendations for the university to bring itself into compliance with the Act. Given the heightened risks associated with AI technologies, I also recommend that the university adopt additional guardrails around its use of Respondus Monitor and incorporate these stronger protections into its ongoing use of the software and any future agreement with Respondus.

Note: By November 1, 2024, McMaster had implemented the recommendations outlined in this report to the IPC’s satisfaction, and the file was closed.

The appellant made a request to the university for access to information about herself. The university located responsive records and granted partial access to them. The appellant appealed the university’s decision to deny access to some records on the basis of section 49(a) (right to refuse access to requester’s own personal information), read with sections 13(1) (advice or recommendations) and 14(1)(c) (reveal investigative techniques or procedures). In this order, the adjudicator partially upholds the university’s decision.

The appellant sought access to the identity of an individual who complained about the tree on the appellant’s front lawn by making a request under the Act to the City of Toronto (the city).

The city denied access to the requested information, found in records relating to a 311 call made by the complainant. It relied on the mandatory personal privacy exemption in section 14(1) of the Act to deny access to the information. In this order, the adjudicator finds that the contact and identifying information of the complainant is exempt by reason of section 14(1) and upholds the city’s decision not to disclose it.