Dernières décisions

This order resolves two related appeals. Under the Municipal Freedom of Information and Protection of Privacy Act, an individual requested access to records relating to his name being searched through the databases of the Niagara Police Services Board (the police), including the reasons that his name was being searched and underlying associated records. In response to one request, the appellant received access to some information; in response to the other, he was told that there were no responsive records. The requester challenged the reasonableness of the police’s searches because he believed other records should exist. In this order, the adjudicator upholds the reasonableness of the police’s search efforts and dismisses the appeals.

The Sault Ste. Marie Police Services (the police) reported to the Office of the Information and Privacy Commissioner of Ontario that their network servers were infected with ransomware and that, as a result, records of personal information stored on data drives on the servers were encrypted.

In response, the police took steps to contain, investigate, remediate and inform local residents about the ransomware attack. However, the police did not believe that the attack resulted in a privacy breach because their investigation determined that the information was encrypted in place, and neither obtained or exfiltrated by the threat actor.

In this report, I find that the threat actor’s encryption of the data drives affected the personal information stored on them by making this information inaccessible to the police. I also find that the ransomware attack resulted in an unauthorized use of personal information and, therefore, a privacy breach under the Municipal Freedom of Information and Protection of Privacy Act.

I am satisfied with the steps taken by the police to contain the breach. Although the police informed the public of the breach through a press release issued at the time of the ransomware attack, I find that there would be no useful purpose in deciding whether they should renotify affected individuals given the passage of time since the breach. I am not entirely satisfied with the police’s investigative and remedial steps because they have not reviewed their policies and practices in protecting personal information. As such, I find that the police have not responded adequately to the breach and recommend that they conduct this review.

Further, it appears that the police understand the nature of their information holdings, the threats posed by ransomware attacks and the steps required to mitigate these attacks. However, despite requests, the police did not provide this office with materials relating to their privacy training practices and, therefore, I could not evaluate the reasonableness of these practices which are important for reducing the risk of a threat actor gaining unauthorized access to an institution’s records. Because of this, I am not satisfied that the police haves reasonable measures in place to prevent unauthorized access to records as required by section 3(1) of Regulation 823 under MFIPPA (security of records) and recommend that they ensure that their training materials comply with this section.

A requester asked the hospital for video surveillance footage after his visit to the hospital. The hospital found several hours of video footage, but stated that some of the requested footage had been deleted in accordance with its retention policy. The requester complained about the hospital’s response to the IPC, stating that it had improperly deleted the footage. The fee the hospital was charging for the footage, and the hospital refusing a fee waiver, was also disputed in the complaint.
In this decision, the adjudicator finds that the hospital did not improperly delete the video footage, and he upholds the hospital’s fee and denial of a fee waiver. He dismisses the complaint.

An individual submitted a request for reconsideration of Order MO-4560, which partly upheld the city’s access decision. With respect to the issue of the city’s custody or control of responsive records, the adjudicator found in Order MO-4560 that the city had custody or control over communications between city staff but not over communications between elected officials (including the mayor). The requester claimed that there was a fundamental defect in the adjudication process because the order did not address any communications that may have occurred between city staff and elected officials (including the mayor).
The adjudicator allows the reconsideration of Order MO-4560. As the issue of reasonable search was not addressed in Order MO-4560, the adjudicator finds that there was a fundamental defect in the adjudication process.
Further in this order, the adjudicator finds that the city conducted a reasonable search for records of communications between city staff and elected officials (including the mayor). As no responsive records between city staff and elected officials (including the mayor) exist, the adjudicator makes no finding on the city’s custody or control over such records.

In a request made under the Freedom of Information and Protection of Privacy Act, an individual asked the ministry for records of the Ontario Provincial Police that relate to him. The ministry provided access to the records in part. It did not disclose some information saying that it contained the personal information of the appellant (section 49(a)), that, if disclosed could facilitate the commission of an unlawful act (section 14(1)(l)). It also said that disclosure would result in an unjustified invasion of the personal privacy of individuals other than the appellant (section 49(b)). In this order, the adjudicator finds that some of the information the ministry did not disclose should be provided to the appellant. However, he upholds the decision of the ministry not to disclose the remaining information to the appellant.

On November 5, 2023, the appellant asked the ministry for records related to vaccine passports, vaccine mandates and exemption grounds. The requester filed an appeal with the IPC because the ministry did not issue an access decision within the prescribed time limit. The decision-maker agrees that the ministry is deemed to have refused the access request under section 29(4) of the Act and orders the ministry to issue a final access decision by December 27, 2024.

A journalist made a request under the Freedom of Information and Protection of Privacy Act for access to the call logs from the Premier of Ontario’s (the Premier’s) personal cell phone. Cabinet Office denied the journalist access to the call logs, claiming it does not have custody or control of them. In this order, the adjudicator finds some of the entries in the call logs are under Cabinet Office’s control. She orders Cabinet Office to obtain these entries from the Premier and issue an access decision to the appellant.

A requester asked the society for records about her and her family’s interactions with the society during the 1970s. The society gave her access to some records, with portions redacted because they were not dedicated primarily to the provision of a service to the requester (section 312(3) of the Act). The requester asked the IPC to review the society’s response.

In this decision, the adjudicator agrees that the redacted portions of the records are about the society’s investigation of a group of people and are therefore not dedicated primarily to the provision of a service to the requester. He upholds the society’s decision to redact the information.

An individual made a request under the Municipal Freedom of Information and Protection of Privacy Act (the Act) to the London Police Services Board (the police) for his deceased father’s police record. The police denied access to the records based on the personal privacy exemption at 14(1). In this order, the adjudicator finds that the individual is not entitled to the same right of access to his father’s personal information as his father would have had (section 54(a)). She finds that the titles of police force members that the appellant had specifically requested are not personal information and therefore not exempt from disclosure under the Act’s mandatory personal privacy provisions. She also finds that disclosure of the remaining information in the records at issue would be an unjustified invasion of personal privacy of individuals other than the appellant (section 14(1)) and the public interest override at section 16 does not apply to permit its disclosure. The adjudicator partially upholds the police’s decision and orders it to disclose the titles of police force members to the appellant.

The Ministry of the Solicitor General (the ministry) received a request under the Freedom of Information and Protection of Privacy Act (the Act) for a police report relating to the suicide of an individual. The request was made by the sister of the deceased. The ministry decided to disclose parts of the police report to the requester for compassionate reasons, under section 21(4)(d) of the Act, but not the rest of the report. The requester did not appeal the ministry’s decision to withhold the rest of the report, but the widower of the deceased appealed the ministry’s decision to disclose any information about his late wife. In this order, the adjudicator upholds the ministry’s decision and dismisses the appeal.

An individual made two requests under the Freedom of Information and Protection of Privacy Act for access to the call logs from the Premier of Ontario’s (the Premier’s) personal cell phone. Cabinet Office denied the individual access to the call logs, claiming it does not have custody or control of them. In this order, the adjudicator finds some of the entries in the call logs are under Cabinet Office’s control. She orders Cabinet Office to obtain these entries from the Premier and issue an access decision to the appellant.

The appellant sought access under the Municipal Freedom of Information and Protection of Privacy Act for records related to the construction of a residential pool and related structures. The City of Mississauga (the city) denied access to records and portions of the records on the basis that they contain third party information (section 10(1)), information that is subject to solicitor-client privilege (section 12), and information that, if disclosed, would be an unjustified invasion of personal privacy (section 14(1)).

An individual made a request to the ministry under the Freedom of Information and Protection of Privacy Act for access to a pre-sentence report. The ministry claimed the report is not in its custody or under its control. The adjudicator finds the report is in the custody or under the control of the ministry and orders the ministry to submit representations on the application of the exemptions originally claimed.

The records in this appeal relate to the police’s procurement and use of facial recognition technology. The police denied access to approximately 4,000 pages of records, claiming several exemptions under the Act. During the inquiry, the individual who asked for the records raised the application of the public interest override. In this order, the adjudicator finds that a number of records are exempt from disclosure and the public interest override does not apply to these records. She also finds that several records are not exempt from disclosure and she orders these to be disclosed to the individual who requested them.

The appellant wanted information about an investigation of a childcare centre overseen by the Algoma District Services Administration Board. The investigation followed allegations of financial misconduct at the Centre. Algoma granted the appellant access to two records and denied access to the rest because they contained personal information of other individuals. The appellant challenged Algoma’s access decision and asserted that additional responsive records exist.

In this order, the adjudicator largely upholds Algoma’s decision that most of the records should not be disclosed to the appellant because disclosure would be an unjustified invasion of the personal privacy of other individuals. However, she orders Algoma to disclose three records that do not contain personal information of other individuals and do not qualify for exemption from disclosure. She also finds that there is no reasonable basis to believe that additional responsive records exist, and she dismisses that claim.