|
|
 |
Manual
INTRODUCTION TO THE ACT
This chapter contains the following topics:
Purpose of the Act
How the Act is
Organized
Scope of the Act
Definitions
Role of
the Responsible Minister and Ministry of Government Services
Purpose of the Act
s.1 FIPPA / s.1
MFIPPA
The Freedom of Information and Protection of Privacy Act (FIPPA)
and the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA)
provide individuals with a right of access to certain records and
personal information under the custody or control of institutions covered
by the Acts.
The purposes of the FIPPA/MFIPPA are as follows:
a) to provide a right of access to information under the control of
institutions in accordance with the principles that,
- information should be available to the public,
- necessary exemptions from the right of access should be limited and
specific,
- decisions on the disclosure of information should be reviewed
independently of the institution controlling the information; and
b) to protect the privacy of individuals with respect to personal
information about themselves held by institutions and to provide
individuals with a right of access to that information.
How the Act is Organized
FIPPA came into force on January 1, 1988, MFIPPA became law 3 years
later on January 1, 1991. FIPPA/MFIPPA are divided into four similar
parts. FIPPA has an additional part at the beginning dealing with
administrative matters covering both of FIPPA/MFIPPA. The sections are as
follows:
FIPPA Part I: Administration covers administrative
matters with respect to the Responsible Minister and the Information and
Privacy Commissioner, Ontario (IPC).
FIPPA Part II / MFIPPA Part I: Freedom of Information deals with
the right of access to records, exemptions to that right, access
procedures and information to be published or made available to assist in
locating government held records.
FIPPA Part III / MFIPPA Part II: Protection of Individual Privacy
concerns the collection, retention, use, disclosure and disposal of
personal information and personal information banks. This part also deals
with an individual's right of access to his/her own personal information
and the right to request correction of that information.
FIPPA Part IV / MFIPPA Part III: Appeal addresses the right to
appeal and the procedures for appealing a decision made by an institution.
FIPPA Part V / MFIPPA Part IV: General covers general matters
including the charging of fees, offences, regulations and the powers and
duties of the IPC.
Scope of the Act
s.10, 63,
64, 65,
69, 70
FIPPA / 4, 50,
51, 52
MFIPPA
s.5 O.Reg.460
/s.5O.Reg.823,
O.Reg.372/91
FIPPA covers all ministries of the Ontario Government and any agency,
board, commission, corporation or other body designated as an
"institution" in the regulations. MFIPPA covers all municipal
corporations, including a metropolitan, district or regional municipality,
local boards and commissions. The term institution is defined in s.2 of
FIPPA/MFIPPA and is set out in the Definitions segment of this chapter
immediately below.
FIPPA/MFIPPA apply to any record in the custody or under the control of an
institution, including records created both before and after the laws came
into force.
FIPPA binds the Crown.
FIPPA/MFIPPA do not apply to:
- records such as private donations placed in the Archives of Ontario
(FIPPA) or the archives of an institution by or on behalf of a person
or organization other than the institution (for MFIPPA institutions).
This includes private donations of manuscripts and letters;
- records covered by the disclosure scheme in the Young Offenders
Act (YOA);
- for FIPPA institutions: records of a patient in a psychiatric
facility as defined by section 1 of the Mental Health Act
where the record is a clinical record as defined by subsection 35(1)
of the Mental Health Act, or contains information on the
history, assessment, diagnosis, observation, examination, care or
treatment of the patient;
- for FIPPA institutions: wiretap application records covered by the Criminal
Code;
- for FIPPA institutions: notes for the personal use of a presiding
judge (s.65(3));
- for institutions covered by FIPPA/MFIPPA: labour relations or
employment-related matters as described in s.65(6 & 7) FIPPA /
s.52(3 & 4) MFIPPA.
FIPPA/MFIPPA do not impose any limitation on the information otherwise
available by law to a party to litigation. Where an institution is
required to produce documentary evidence pursuant to rules of court, the
exemptions in FIPPA/MFIPPA do not apply.
FIPPA/MFIPPA is a comprehensive access scheme which must be implemented by
all institutions, including administrative tribunals who are listed as
"institutions" under the Act. It does not deny access to
information through rules of natural justice or legal procedures. For
example, it does not affect the power of a court or tribunal to compel a
witness to testify or to compel the production of a document.
Not all requests for information need to be made under FIPPA/MFIPPA.
Information can be provided in response to an oral request or in the
absence of a request, where an institution may give access to that
information under FIPPA/MFIPPA. The Acts should not be applied to preclude
access to information (except personal information) that was available by
custom or practice before they came into force.
Definitions
s.2 FIPPA / s.2
MFIPPA
The terms that appear in green are taken
from the Acts. The remaining terms have been defined in such sources as
the IPC orders. The terms defined in the Act appear with the relevant
section from the Act.
Control (of a record)
Means the power or authority to make a decision about the use or
disclosure of the record.
Custody (of a record)
Means the keeping, care, watch, preservation or security of the record
for a legitimate business purpose. While physical possession of a record
may not always constitute custody, it is the best evidence of custody.
In Order # P-120 the IPC
first outlined 10 factors that could be considered to determine the
custody or control of a record. These factors are listed in s.10/4 of the Annotation
under (Custody or Control).
Directory of Institutions
s.31 FIPPA
/ s.24 MFIPPA
Is a compilation listing all institutions covered by the Acts,
including information on where requests can be made and whether
institutions have a library or reading room available to the public and if
so, its address.
Directory of Records
s.32, 33,
35, 45
FIPPA / s.25, 34
MFIPPA
Is a publication which lists, for institutions covered by FIPPA,
a) information on the general classes or types of records and manuals
maintained by institutions and
b) the personal information banks maintained by each institution.
Each MFIPPA institution is required to to make available similar
information for public inspection.
Exemptions: Mandatory and Discretionary
There are two types of exemptions in FIPPA/MFIPPA.
Mandatory exemptions impose a duty on the head of an institution to refuse
to disclose a record. Mandatory exemptions begin with the words: "a
head shall refuse to disclose...". There are three mandatory
exemptions in FIPPA. They are: s.12 (Cabinet records), s.17 ( third party
information) and s.21 (personal privacy). The three mandatory exemptions
for MFIPPA are: s.9 (relations with other governments), s.10 (third party
information) and s.14 (personal privacy). In the case of mandatory
exemptions the head must determine whether the facts exist or may exist
which bring the record requested within the exemption.
If grounds for a mandatory exemption exist, the head must refuse access
unless a compelling public interest outweighs the purpose of the exemption
(e.g. s.21 FIPPA / s.14 MFIPPA). The public interest override does not
apply to s.12, 14, 16, 19 and 22 FIPPA / s.6, 8, 12, and 15 MFIPPA.
All other exemptions are discretionary exemptions. They permit the head to
disclose a record despite the existence of the exemption. Discretionary
exemptions are introduced by the words: "(A) head may refuse to
disclose...". FIPPA/MFIPPA require a two-stage process in determining
whether a discretionary exemption is to be applied. First, the head must
determine whether the facts exist or may exist which bring the record
requested within the exemption. Second, the head must decide whether
he/she is willing to release the record, despite the existence of grounds
for the exemption. A decision by a head to disclose information falling
within an exemption is an exercise of discretion.
Frivolous and Vexatious (requests)
s.27.1
FIPPA / s.20.1 MFIPPA
s.5.1
O.Reg.460 /s.5.1
O.Reg.823
An institution is not required to proceed with a request it views as
frivolous or vexatious. If a requester appeals this decision, the
institution is required to present evidence that the request is frivolous
and/or vexatious and the IPC will determine if the institution's decision
is reasonable.
Under the regulations, a frivolous or vexatious request occurs where the
request is part of a pattern of conduct that amounts to an abuse of the
right of access or where responding to the request would interfere with
the operations of the institution. Examples of the meaning of
"abuse" in the legal context include:
- proceedings instituted without any reasonable ground;
- proceedings whose purpose is not legitimate, but is rather designed
to harass, or to accomplish some other objective unrelated to the
process being used;
- situations where a process is used more than once, for the purpose
of revisiting an issue previously addressed.
In addition, the regulations provide that a request meets the
definition of frivolous or vexatious if it is made in bad faith. Bad faith
is not simply bad judgment or negligence, but rather it implies the
conscious doing of a wrong because of dishonest purpose. It contemplates a
state of mind which views the access process with contempt and for the
nuisance it creates, rather than a valid means of obtaining information.
Head
s.2 FIPPA / s.2
MFIPPA
Under FIPPA, means,
(a) in the case of a ministry, the minister of the Crown who presides over the ministry, and
(b) in the case of any other institution, the person designated as head of that institution in the regulations.
For FIPPA institutions other than ministries (such as agencies listed in
the regulations), the minister responsible for that institution shall be
deemed to be the head of that institution, unless the regulation
designates someone else.
Under MFIPPA, means,
(c) in respect of an institution, means the individual or body determined to be head under section 3;
The selection of a head for MFIPPA institutions is discussed in greater
detail in the Administration chapter (Chapter
2) of this manual.
Individual
Means a human being; it does not include a corporation (see also the
definition of "Person").
Under s.66 FIPPA / s.54
MFIPPA, Any right or power conferred on an
individual by this Act may be exercised,
(a) where (FIPPA)/if (MFIPPA) the individual
is deceased, by the individual's personal representative if exercise of
the right or power relates to the administration of the individual's
estate;
(b) by the individual's attorney under a continuing power of attorney, the individual's attorney under a power of
attorney for personal care, the individual's guardian of the person, or
the individual's guardian of property; and
(c) where (FIPPA)/if (MFIPPA) the individual
is less than sixteen years of age, by a person who has lawful custody of
the individual.
The personal representative referred to in clause (a) is the executor
named in a will or, where there is no will, the administrator appointed by
a court to administer the estate of the deceased person. In order for the
personal representative of a deceased to exercise a right or power of the
deceased, the exercise of the right or power must relate to the
administration of the estate. As a result, the rights of the
representative are narrower than the rights the deceased could have
exercised while alive.
In clause (b), a guardian may be appointed by a court order for a person
who is incapable of managing his/her own affairs or who is capable of
making decisions about personal care. In addition, the Public Guardian and
Trustee may become an individual's statutory guardian as provided by the Mental
Health Act and the Substitute Decisions Act.
In clause (c) the IPC has held that the rights under FIPPA/MFIPPA of an
individual with lawful custody of a child are not absolute; for instance
the rights cannot be used to access records for personal objectives that
are not those of the child.
The rights or powers which may be exercised on behalf of an individual
include the right to make a request for access to a record, the right to
consent to the use and disclosure of personal information under
s.21(1)(a), 41(a) and 42(b) FIPPA/ s.14(1)(a), 31(a) and 32(b) MFIPPA, and
the right to authorize personal information to be collected other than
directly from the individual under s.39(1)(a) FIPPA / s.29(1)(a) MFIPPA.
Information and Privacy Commissioner(Commissioner)
s.4, 5, 6, 7, 8, 9, 50, 51, 52, 54, 55, 56, 58, 59, 61 FIPPA /
s.39, 40, 41, 43, 44, 46, 48 MFIPPA
The Commissioner is appointed by the Lieutenant Governor in Council.
The Commissioner is an officer of the Legislature and is independent of
the government.
The IPC hears appeals of decisions made by heads of institutions, issues
binding orders, conducts privacy investigations, and has certain powers
relating to the protection of personal privacy. In the Appeals
chapter (Chapter 7) of this manual the role of the Commissioner is
discussed in more detail.
Institution
Under FIPPA"institution" means,
(a) a ministry of the Government of Ontario,
(b) any agency, board, commission, corporation
or other body designated as an institution in the regulations.
Under MFIPPA there are three parts to the definition of institution:
(a) a municipal corporation, including a
metropolitan, district or regional municipality or the County of Oxford,
Each municipal corporation (village, town, township, city, county, and
district and regional municipality) is a separate institution for the
purposes of the Act.
The following bodies are considered to part of a municipal corporation:
boards of control, sinking fund committees, fence viewing boards, courts
of revision, planning advisory committees, property standards committees,
cemetery boards, committees of adjustment, land division committees,
parking authorities, parks boards, arena boards and recreation boards, and
other bodies where all the members or officers are appointed by council.
For example:
A board of management for a Business Improvement Area would be covered as
part of the municipal corporation because all of the members of the board
are appointed by a municipal council.
Where only some of the members of an agency or board are appointed by the
municipal institution, that agency or body is not considered part of the
municipality for the purposes of the Act.
For example:
A non-profit housing corporation may not be an institution under the Act
when some members are appointed by community groups rather than the
municipality.
(b) a school board, public utilities
commission, hydro-electric commission, transit commission, suburban roads
commission, public library board, board of health, police commission,
conservation authority, district welfare administration board, local
services board, planning board, local roads board, police village or joint
committee of management or joint board of management established under the Municipal Act.
These institutions, some of which are closely connected to municipal
corporations, are designated separate institutions for the purposes of the
Act.
(c) any agency, board, commission, corporation or other body designated as an institution in the
regulations.
Other bodies may be prescribed as separate institutions for the purposes
of the Act.
For example:
A municipality might have a corporation established under a private
statute that operates a convention centre. Except for the fact that the
centre is owned by the municipality, it operates as an autonomous entity.
In this case it may be appropriate that the centre be designated in
regulation as a separate institution for the purposes of the Act (e.g.,
The Hamilton Entertainment and Convention Facilities Inc.)
Labour Relations
Means the collective relationship between an employer and its
employees. (see Chapter 5
on Privacy Protection for a further discussion of labour relations and
employment-related records).
Law Enforcement
Law enforcement means,
(a) policing,
(b) investigations or inspections that lead or
could lead to proceedings in a court or tribunal if a penalty or sanction
could be imposed in those proceedings, and
(c) the conduct of proceedings referred to in
clause (b).
There are three parts to the definition. Part (a) encompasses the
activities of police forces. These activities include the investigation
and prosecution of offences, the collection and analysis of intelligence
information, the prevention of crime, the maintenance of law and order and
the provision of security and protective services. This part does not
apply to internal employment-related investigations for breach of
contract.
Part (b) of the definition includes activities by an institution to
enforce compliance with standards, duties and responsibilities set out in
a statute or regulation. Many institutions have a branch which is
responsible for the enforcement of statutes administered by the
institution.
In part (b) the words "lead or could lead" indicate that
inspections and investigations may be part of "law enforcement"
even if they do not actually result in proceedings in a court or tribunal.
For example:
The result of an investigation to determine whether an offence has been
committed under the Environmental Protection Act or a Municipal
By-law may be that there is insufficient evidence of an offence and
therefore no charge should be laid. The investigation would still come
within the definition of law enforcement.
Part (b) refers to proceedings where a "penalty or sanction"
could be imposed in those proceedings. This includes the imposition of
imprisonment or a fine, the revocation of a licence and the issuance of an
order requiring a person to cease an activity. A civil action for monetary
damages or recovery of debt, as well as internal employment-related
investigations where a tribunal could hear the matter only
at the insistence of the employee would not be included.
Part (c) of the definition refers to the actual conduct of proceedings
before a court or tribunal.
For example:
Prosecution of an offence under the Criminal Code, and
investigations under the Ontario Human Rights Code and the conduct
of a hearing before a regulatory tribunal such as the Ontario Securities
Commission or the Superintendent of Insurance are included.
Person
The term refers to an individual and to organizations such as business
entities and associations.
Personal Information
Personal information means recorded
information about an identifiable individual, including:
(a) information relating to the race, national
or ethnic origin, colour, religion, age, sex, sexual orientation or
marital or family status of the individual;
(b) information relating to the education or
the medical, psychiatric, psychological, criminal or employment history of
the individual or information relating to financial transactions in which
the individual has been involved;
(c) any identifying number, symbol or other
particular assigned to the individual;
(d) the address, telephone number, fingerprints or blood type of the individual;
(e) the personal opinions or views of the
individual except if they relate to another individual;
(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or
confidential nature, and replies to that correspondence that would reveal
the contents of the original correspondence;
(g) the views or opinions of another
individual about the individual; and
(h) the individual's name if it appears with
other personal information relating to the individual or where disclosure
of the name would reveal other personal information about the individual.
Personal information must be about an identifiable individual, however an
individual's name need not be attached to the information to qualify as
personal information. A physical description or a photograph of a person
attached to other personal information about that person is personal
information although no name is ever indicated. This individual is
"identifiable" and all of the kinds of information described
above are his/her personal information.
Generally, information about a property or a specific municipal address,
such as market value assessment, hydro-electric consumption or building
permit information, is not personal information. However, records
containing such property-related information may also contain an
individual's name and personal information such as a home telephone
number. Care should be taken to ensure that any disclosure of that
personal information complies with the privacy protection provisions of
the Act (see the Privacy chapter (Chapter
5) for a discussion regarding the disclosure of personal information).
An individual's name on its own is not personal information. To be
personal information within the meaning of the Act, the name must be
associated with other personal information as defined in s.2.
For example:
An individual's name kept by a social services department would be
personal information because the fact that the name was on a record at the
department might indicate that the person was, or is, in receipt of public
assistance.
The term "person" when used in legislation may refer to both
individuals and to organizations such as business entities and
associations. However, an "individual", which is the term
related to privacy rights in the context of FIPPA and MFIPPA, does not
include sole proprietorships, partnerships, unincorporated associations,
corporations, trade unions or law firms or the names of officers of a
corporation writing in their official capacity. Nevertheless records of
sole proprietorships and other small businesses such as partnerships may
contain information about business entities that is also personal
information about individuals.
For example:
In a sole proprietorship or family business the finances of the individual
may be virtually identical to the finances of the business. Where this is
the case, the information in the custody or control of an institution
would be subject to the Act's privacy provisions.
Correspondence submitted to an institution by a representative of a group
or association is not the personal information of the author of the
correspondence if: 1) the correspondence submitted to an institution is on
the letterhead of the organization and 2) it is signed by an individual in
his/her capacity as a spokesperson of the organization.
However, the information about individuals acting in their business or
official capacities becomes personal information when they are affected as
private individuals.
For example:
The witness statements of by-law enforcement officers who were physically
assaulted while acting in their official capacity would contain their
personal information.
Personal information also includes opinions and views.
For example:
If A expresses an opinion about B, that opinion is part B's personal
information. Other views or opinions, which are not about an individual
are the personal information of the individual who has expressed the
opinion.
Personal information does not include information about an individual who
has been dead for more than thirty years (s.2(2)).
The definition of personal information under the Act refers to recorded
information about an identifiable individual. For the purpose of
regulating the collection of personal information under the privacy
protection provisions of the Act, personal information includes personal
information collected orally on behalf of an institution. This is
discussed in detail in the chapter dealing with Privacy (Chapter
5).
Personal Information Bank
s.44, 45
FIPPA / s.34 MFIPPA
A Personal Information Bank (PIB) is a
collection of personal information that is organized and capable of being
retrieved by an individual's name or other individual identifier.
A collection of personal information in the custody or control of an
institution would be a personal information bank if it has the following
characteristics:
- it must contain personal information;
- information contained in the bank must be a collection of like or
similar information about individuals;
- information must be linked to an identifiable individual; and
- the information must be capable of being retrieved by the
individual's name or identifying symbol (such as a client
identification number).
For example:
A public library's circulation records that contain the names, addresses
and borrowing records of patrons is a personal information bank.
Usually a personal information bank serves an important administrative or
operational function and is used in reaching decisions that affect the
individuals in the bank. A number of personal information banks can
support one function.
Institutions will often have collections of records containing some
personal information, but these do not meet the criteria for the
definition of a personal information bank (e.g., records of purchase
orders or general correspondence). The Act does not require an institution
to rearrange its personal information into personal information banks.
Collections of personal information that meet the characteristics of a
personal information bank (as set out above) must be identified and
described by the institution. Generally, individuals have a right to
information about themselves contained in an institution's personal
information banks. These descriptions must be made available to assist the
public in exercising privacy rights.
Public Interest
Means the interest of the public in general, not of any individual or
group of individuals.
The interest may be a pecuniary one or one by which legal rights or
liabilities are affected. It may be an interest in public health or safety
or an interest in the maintenance of confidence in the conduct of
government or in the administration of an institution.
For example:
A breach of security occurring within a sensitive government function,
might raise serious questions about how and why the breach happened. If
information contained in a record could inform the public in some way
about the incident by adding to the information they have to express
opinion or to make political choices, it could be considered in the public
interest to release it.
Record
s.2 FIPPA / s.2
MFIPPA
A record is any record of information
however recorded, whether in printed form, on film, by electronic means or
otherwise, and includes:
(a) correspondence, a memorandum, a book, a
plan, a map, a drawing, a diagram, a pictorial or graphic work, a
photograph, a film, a microfilm, a sound recording, a videotape, a
machine-readable record, any other documentary material regardless of
physical form or characteristics, and any copy thereof; and
(b) subject to the regulations, any record
that is capable of being produced from a machine-readable record under the
control of an institution by means of computer hardware and software or
any other information storage equipment and technical expertise normally
used by the institution.
The definition of record is very broad and includes virtually every form
of information held in some recorded form by an institution. The
definition is not restricted to actual physical documents, but includes
records that can be created from existing data in a computer bank. Even
documents such as electronic mail are considered to be records. For
further information on computer records, see the definition of
"machine readable records" immediately below.
Handwritten notes or other notations on records form a part of the
records. Working copies and drafts of reports and letters are also
records.
Machine Readable Record
s.2, 60
FIPPA / s.2, 47
MFIPPA
s.2 O.Reg.460
/s.1 O.Reg.823
In cases where a request is for information that can not currently be
extracted in a way that is useful to a requester, but is capable of being
produced from a machine readable record, the Act gives the requester the
right (subject to the regulations) to the information which would answer
all or part of a request.
If the process of producing a record from a machine readable format would
unreasonably interfere with the operations of an institution, the machine
readable record would not be included in the definition of a record as
outlined above. Unreasonable interference with operations could include
instances where normal business activities would have to stop or change in
order to produce the record. It may also include instances where the cost
of producing the record would result in the inability of an institution to
meet its other obligations.
See the regulations for further information.
Third Party
Any person whose interests might be affected by disclosure other than
the person making a request for access or the institution. Where the third
party is an individual, his/her rights may in some cases be exercised by
another person. See the definition of "individual" above.
Use
Use (of personal information): to take action, to employ, to put to
use.
Waiver of Notice
s.39(2)
FIPPA / s.29(3)(b)
MFIPPA
This is a letter signed by the Minister responsible for FIPPA/MFIPPA
that allows an institution to forego giving a notice of collection in
specified circumstances.
Role of the Responsible Minister and Management
Board Secretariat
The Responsible Minister: the minister of the
Crown who is designated by order of the Lieutenant Governor in Council
under section 3
(subsection 2(1) of FIPPA).
The Responsible Minister is the Chair of Management Board of Cabinet.
The Corporate Freedom of Access and Privacy Office of Management
Board Secretariat supports the Chair of Management Board of Cabinet as the
minister responsible for FIPPA/MFIPPA. The Office assists institutions
that are covered by FIPPA/MFIPPA by providing training, policy and
operational advice.
The Annotation
The Annotation is published by the Access and Privacy Office
and assists in interpreting the provincial and municipal access and privacy
legislation. The highlights in the Annotation
represent the Office's interpretations of the Orders and Investigation
Reports issued by the IPC, and Judicial Reviews conducted by the Courts.
|
OCIPO 