Latest IPC Decisions

A patient made an access request under PHIPA for notes taken during a meeting he had with a Director of a facility. The custodian denied access to the notes claiming that the legal privilege exemptions in section 52(1)(a) and (c) (legal privilege) apply. The adjudicator finds that the notes are dedicated primarily to the complainant’s personal health information and that the legal privilege exemptions do not apply. The adjudicator orders the custodian to grant the complainant access to the whole record.

A requester asked the Ministry of the Attorney General (the ministry) for copies of blueprints for the New Toronto Courthouse. The ministry located 16 responsive records and denied the requester access pursuant to the discretionary exemptions at sections 14(1) (law enforcement) and 20 (health and safety) of the Act. In this order, the adjudicator upholds the ministry’s decision to apply section 14(1) to 13 of the 16 records. The adjudicator finds that neither section 14(1), nor section 20 of the Act apply to the remaining three records and orders them to be disclosed to the requester.

The Office of the Information and Privacy Commissioner of Ontario (the IPC) received a complaint about McMaster University’s (McMaster or the university) use of Respondus exam proctoring software under the Freedom of Information and Protection of Privacy Act (FIPPA or the Act). The software comprises two programs. Respondus LockDown Browser limits what users can access on their computers and Respondus Monitor analyzes audio and video of students during the exam to scan for possible cheating. The complainant did not want the IPC to provide their name and complaint to the university, so the IPC opened this Commissioner-initiated complaint to address the university’s use of this exam proctoring software.

This report concludes that conducting exams and appointing examiners is a lawfully authorized activity of the university. Proctoring exams online to ensure their integrity is an appropriate component of conducting certain types of exams and is therefore also a lawfully authorized activity. On the question of whether the collection of personal information through the use of Respondus exam proctoring software is necessary to proctor exams, I find that Respondus LockDown Browser collects little personal information, and only collects and uses what it needs to function. Respondus Monitor collects more sensitive personal information, including biometric information, and uses artificial intelligence (AI) technology, which carries heightened concerns. Because the personal information collected by Respondus Monitor on behalf of the university is necessary for that tool to fulfill its function of exam proctoring, it is authorized under section 38(2) of the Act. However, the university has not provided adequate notice for its collection of personal information as required by section 39(2) of the Act and the use of students’ personal information through Respondus Monitor is not in compliance with section 41(1). Moreover, the current contractual arrangement between the university and Respondus is contrary to section 41(1) of the Act in so far as it does not adequately protect all of the personal information collected and allows Respondus to use personal information for system improvement purposes without the consent of students.

In this report, I make a number of recommendations for the university to bring itself into compliance with the Act. Given the heightened risks associated with AI technologies, I also recommend that the university adopt additional guardrails around its use of Respondus Monitor and incorporate these stronger protections into its ongoing use of the software and any future agreement with Respondus.

Note: By November 1, 2024, McMaster had implemented the recommendations outlined in this report to the IPC’s satisfaction, and the file was closed.

The appellant made a request to the university for access to information about herself. The university located responsive records and granted partial access to them. The appellant appealed the university’s decision to deny access to some records on the basis of section 49(a) (right to refuse access to requester’s own personal information), read with sections 13(1) (advice or recommendations) and 14(1)(c) (reveal investigative techniques or procedures). In this order, the adjudicator partially upholds the university’s decision.

The appellant sought access to the identity of an individual who complained about the tree on the appellant’s front lawn by making a request under the Act to the City of Toronto (the city).

The city denied access to the requested information, found in records relating to a 311 call made by the complainant. It relied on the mandatory personal privacy exemption in section 14(1) of the Act to deny access to the information. In this order, the adjudicator finds that the contact and identifying information of the complainant is exempt by reason of section 14(1) and upholds the city’s decision not to disclose it.

The Township of Oro-Medonte (the township) received a three-part request under the Municipal Freedom of Information and Protection of Privacy Act (the Act) about a certain water infrastructure issue. The township decided that it had reasonable grounds to consider the request as frivolous or vexatious under section 4(1)(b) of the Act. In this order, the adjudicator upholds the township’s decision, and dismisses the appeal.

Metrolinx received a six-part request under the Act for records relating to the Hurontario Light Rail Transit system. It issued a decision denying access, in full, to the records responsive to part 1 of the request, relying on section 14(1)(i) (security) of the Act . Metrolinx stated that there are no records responsive to the other parts of the request. At mediation, the issue of whether Metrolinx conducted a reasonable search for responsive records was added to the scope of the appeal. In this decision, the adjudicator upholds Metrolinx’s decision to withhold the records under section 14(1)(i). She finds, however, that Metrolinx’s search was not reasonable and orders it to conduct a further search for responsive records.

The requester made an access request to the Ministry of the Solicitor General (the ministry) under the Act for records about herself. The ministry located responsive records and disclosed them in part to the requester. The requester appealed the ministry’s decision on the basis that she believes that the ministry has not conducted a reasonable search for these records.

In this interim order, the adjudicator orders the ministry to conduct.

The appellant made a request to the university for access to information about herself. The university issued a decision granting partial access to responsive records. The university denied access to some responsive records based on section 49(a) (discretion to refuse requester’s own information), read with section 19 (solicitor-client privilege). In this order, the adjudicator finds that the records contain the appellant’s personal information but contain communications that are solicitor-client privileged and are therefore exempt under section 49(a), read with section 19(a). She upholds the university’s decision and dismisses the appeal.

The appellant alleges that the Toronto Police Services Board (the police) failed to conduct a reasonable search for records responsive to his request made under the Act for records relating to him, including all videos pertaining to a specified occurrence report. The adjudicator finds that the police conducted a reasonable search for responsive records within their custody or control. The appeal is dismissed.

The Ministry of Tourism, Culture and Sport (the ministry) received a request for records related to a specified grant application. The ministry located responsive records and granted partial access to them, with portions withheld under sections 13(1) (advice or recommendations) and 19 (solicitor-client privilege).

In this order, the adjudicator finds that the withheld records are exempt from disclosure under sections 13(1) and 19 and dismisses the appeal.

The appellant made a request to the university for access to information about herself for a four-month period in 2017. The university located eight responsive records and granted partial access. The university denied access to record 1 under section 49(b) (personal privacy), and to records 7 and 8 under section 49(a) (discretion to refuse requester’s own information) read with section 19 (solicitor-client privilege). In this order, the adjudicator upholds the university’s decision to deny access to records 7 and 8. The adjudicator partially upholds the university's decision to deny access to record 1 and orders the university to disclose a severed version of record 1 to the appellant by removing the personal information of another individual.

Interim Order MO-4446-I resolved two of three access requests the appellant filed under the Act to the City of Belleville (the city). The requested records related to the attendance of city staff at the appellant’s property on a specified date. In Interim Order MO-4446-I, the adjudicator ordered the city to conduct a further search for records responsive to the appellant’s request. In accordance with Interim Order MO-4446-I, the city conducted a further search and located an updated record. The appellant continued to take the position that additional records should exist. In this final order, the adjudicator finds that the city’s further search was reasonable and dismisses the appeal.

This order deals with a third party appeal of an access decision under the Act made by the Ministry of Health (the ministry). The request was for records relating to the third party’s community laboratory business, namely records relating to the development, review and implementation of external reviews and to the implementation of a specific funding cut. The ministry decided to disclose the responsive information in part. The appellant claims the application of the mandatory third-party information exemption in section 17(1) of the Act to specific commercial and/or financial information that the ministry had decided to disclose. In this order, the adjudicator finds that the appellant has not established that disclosure of the withheld information would result in any of the harms set out in section 17(1). The ministry is ordered to disclose the records to the requester in accordance with its decision.

The appellant made a request to the university for access to information about herself in relation to a specific event and meeting held on campus. The university denied access to 15 of 28 responsive records based on section 49(a) (right to refuse access to requester’s own personal information), read with section 19 (solicitor-client privilege). In this order, the adjudicator finds all the withheld records are communications that are solicitor-client privileged and are therefore exempt under section 49(a) read with section 19(a). She upholds the university’s decision and dismisses the appeal.