|
|
 |
Manual
APPEALS AND COMPLIANCE
This chapter contains the following topics:
Introduction
The Information and
Privacy Commissioner (Commissioner)
The Appeal
Process
Judicial Review
Compliance
Investigations
Introduction
Ontario's Freedom of Information and Protection of Privacy Act (FIPPA)
/ Municipal Freedom of Information and Protection of Privacy Act (MFIPPA)
establishes a right to appeal decisions about access to records that are
made by institutions covered by the Act. Appeals are filed with the
Information and Privacy Commissioner.
This chapter outlines the powers of the Commissioner and the appeal
process. Many of the procedures have been developed by the IPC and are
subject to change. Where clarification is needed during an appeal, an
institution should contact the Appeals Officer assigned to the appeal.
The Information and Privacy Commissioner
The Appointment of the Commissioner
s.4 FIPPA
The Commissioner is appointed by the Lieutenant Governor in Council
with the approval of the Legislative Assembly. This means that the
Commissioner is an officer of the legislature and is independent of the
government of the day.
The Commissioner is appointed for a term of five years and may be
reappointed for a further term or terms. The Commissioner is removable at
any time for cause by the Lieutenant Governor in Council with the approval
of the Legislative Assembly.
The Powers of the Commissioner to Hear
Appeals
s.54 FIPPA
/ s.43 MFIPPA
Decisions institutions make in response to access requests may be
appealed to the Commissioner. The Commissioner decides matters under
appeal by issuing an order. Subject to the Act, the order may contain any
conditions the Commissioner considers appropriate. Commissioner's orders
are binding on all parties to the appeal. The Commissioner must notify the
appellant, the institution and any person given notice of the appeal as an
affected person that an order has been issued; this is done by sending a
copy of the order to the parties.
The broad order-making power includes that right to order an institution
to search its files in the presence of a Commission staff if the original
search is deemed by the Commissioner to be inadequate. However, the
Commissioner does not have the power to order an institution to create a
record, unless a request is for certain machine readable records.
The Commissioner may also issue an interim decision and may defer a
decision until further submissions are provided.
It is an offence to willfully fail to comply with an order of the
Commissioner (s.61(1)(f)
FIPPA / s.48(1)(f)
MFIPPA).
The Power of the Commissioner to Review
the Exercise of Discretion
Under FIPPA/MFIPPA most of the exemptions that allow a head of an
institution to withhold a record are discretionary, which means that a
head can choose whether or not to apply the exemption and withhold the
record. While s.54(2)
FIPPA / s.43(2) MFIPPA
states that the Commissioner cannot substitute his/her discretion for that
of a head, the Commissioner may review the way the discretion was
exercised, to ensure that it was exercised properly.
The Commissioner may examine the record to determine whether a
discretionary exemption in fact applies. In its appeal submissions, the
institution will be expected to fully explain its reasons for not
disclosing a record. If the rationale for a head's decision is not clear,
the Commissioner may order a head to reconsider his/her decision to
withhold a record and to supply further written submissions.
The IPC has prepared a list of factors which may assist institutions in
exercising their discretion. These factors are not meant to be
all-inclusive. They are:
- the general purpose of the Act, which is that institutions should
make information available to the public and that individuals should
have access to personal information about themselves,
- the actual wording of the discretionary exemption and the interests
that the exemption attempts to balance,
- the facts and circumstances of each specific case,
- whether the individual's request could be satisfied by severing the
record and by providing the requester with as much information as is
reasonably practicable,
- whether the past practice of the institution has been to release
similar types of records,
- the nature of the record, its importance to the requester and
whether the record is particularly sensitive or significant,
- whether disclosure of the information would increase public
confidence in the operations of the institution,
- the age of the record,
- the importance of the record to the requester and whether there is a
sympathetic or compelling reason to release the record,
- whether previous orders of the Commissioner have ruled that similar
types of records or information should or should not be subject to
disclosure,
- when the advice to government exemption is claimed, whether the
decision to which advice or recommendations pertains has already been
made.
The Appeal Process
What Can Be Appealed?
s.50 FIPPA
/ s.39 MFIPPA
Generally, any decision that a head makes under the Act may be appealed
to the Commissioner, including:
- a decision to extend the time limit for responding to a request,
- refusal to grant access to a record on the ground that the record
does not exist,
- refusal to grant access to a record on the ground that the record is
excluded from the Act,
- refusal to grant access to a record on the ground that the record is
exempt,
- granting access to only part of the record,
- granting a request for access to a record or part that may contain
third party commercial information or that contains personal
information where the disclosure may be an unjustified invasion of
personal privacy,
- refusal to confirm or deny the existence of a record that deals with
law enforcement or would, if disclosed, be an unjustified invasion of
personal privacy,
- a deemed refusal to grant access to records,
- a refusal to make a correction to personal information requested,
- the amount of a fee charged,
- a refusal to waive a fee charged,
- a refusal to allow a requester to examine the original record.
Who Can Appeal?
s.50 FIPPA
/ s.39 MFIPPA
The following persons can appeal to the Commissioner:
- a person who has made a request for access to a record under s.24(1)
FIPPA / s.17(1) MFIPPA,
- a person who has made a request for access to his/her own personal
information under s. 48(1) FIPPA / s.37(1) MFIPPA,
- a person who has requested correction of his/her own personal
information under s.47(2) FIPPA / s.36(2) MFIPPA,
- an affected third party who has received a notice under s.28(1)
FIPPA / s.21(1) MFIPPA that the head intends to disclose a record that
may affect the interests of the third party.
Notice of Appeal by a Requester
s.50(2) FIPPA
/ s.39(2) MFIPPA
A person who has been notified of a decision by an institution has 30
calendar days to appeal the decision to the Commissioner. The Commissioner
may nonetheless hear an appeal that is filed after the 30-day time limit,
unless the institution can show that it would be prejudiced by the delay.
For example, prejudice may be established where records that are relevant
to the appeal have been destroyed.
The appellant (the person who is appealing) begins an appeal by submitting
a request for an appeal (notice of appeal) in writing to the Commissioner.
Appellants do not have to use a prescribed form and generally do not
understand the appeal process. As a result, appeal requests often do not
contain enough information for the Commissioner to understand what is
being appealed. Institutions should therefore include a paragraph in their
decision letters informing a requester or third party that he/she can
appeal the decision to the IPC within 30 days, and that their notice of
appeal should be accompanied by:
- the file number assigned to the request by the institution;
- a copy of the decision letter; and
- a copy of the original request for information.
If an appellant is appealing a decision by an institution that the
requested records do not exist, the Commissioner may dismiss the appeal if
the notice of appeal submitted by the appellant does not present a
reasonable basis for concluding that the record ought to exist (s.50(2.1)
FIPPA / s.39(2.1) MFIPPA).
Upon receiving a notice of appeal, the Commissioner notifies the
institution's Freedom of Information and Privacy Coordinator that an
appeal has been filed. The Commissioner must also notify any other person
who, in the Commissioner's opinion, is "affected" by the appeal.
If an institution has any information about affected persons who should be
notified of an appeal, it should convey this information to the Appeals
Officer assigned to the case. Because the Commissioner cannot disclose the
contents of the records to an affected party, these individuals should
contact the institution's Coordinator if they require further information.
The Commissioner does not disclose the identity of the appellant to
affected parties if the appellant is an individual.
Confirmation of Appeal by the
Information and Privacy Commissioner
The IPC notifies an institution that an appeal has been filed by
sending out a "Confirmation of Appeal" letter. It advises the
institution of the name of the requester, the IPC's appeal number and the
name of the Appeals Officer assigned to the case. It also advises the
Coordinator to notify the Appeals Officer if the responsive records are
voluminous (500 pages or more and 3 exemptions or more).
The Confirmation of Appeal also asks the institution to provide the
following information within 8 working days where applicable:
- a copy of the original request and its file number,
- a copy of the head's decision letter,
- any correspondence related to the request or the decision making
process,
- an index of the records under appeal and the exemptions applied to
the records (the index may be shared with the appellant so care should
be taken that no exempt information appears in the index),
- a severed copy of the records under appeal where severances have
been made
- unsevered copy of the records.
The institution is further notified that if it wants to claim any
discretionary exemptions additional to those appearing in its decision
letter, it must do so within 35 days. Where the appeal relates to either a
time extension or the payment of a fee, the request for the last two items
on the above list will be omitted. Reasons for launching an appeal are not
always provided by an appellant. Institutions may find it helpful to
contact the Appeals Officer to see whether grounds for appeal have been
identified. The IPC may also be able to provide additional information
that will help the institution to deal with the appeal promptly and
efficiently.
An institution should provide the IPC with the records relevant to an
appeal within 8 days of the date of the confirmation notice. The
Commissioner may grant a time extension if an institution can demonstrate
that it is not feasible to provide the records within two weeks.
How to Provide Records to the Commissioner
During an Appeal
The IPC has issued guidelines on appeal procedures. While subject to
change, the office requests institutions to do the following:
1. Upon receipt of the Confirmation of Appeal, the institution should
provide the IPC with a copy of the original request, any relevant
correspondence with the requester, and the records at issue in the appeal.
2. If the records have been severed, the institution should identify the
severances on the record itself either by highlighting the severed
portions on a copy of the record, or by providing copies of both the
severed and unsevered records to the IPC.
3. Where more than one section of the Act is claimed to justify the
severance, or where more than one exemption applies to the record, the
institution should:
a) number all documents,
b) number all pages within a document,
c) prepare an index of records containing the following information:
- whether or not an exemption has been claimed,
- the section/subsection of the Act justifying the severance,
- the reason for applying the exemption.
When dealing with more complex requests, compiling an index with the
following headings should also be considered:
- record released (yes/no),
- section of the Act applied,
The Duty to Provide Records to the Information
and Privacy Commission
s.52 FIPPA
/ s.41 MFIPPA
If an institution can demonstrate that it is not feasible to provide
the records to the IPC within 8 working days, the Commissioner may grant a
time extension.
If an institution fails to provide the records within the required period,
the Commissioner may issue an order requiring the records to be produced.
Failure to provide the records to the Commissioner may result in a
prosecution for willful obstruction of the Commissioner (s.61(1)(d)
FIPPA / s.48(1)(d)
MFIPPA).
The Commissioner may also require that an institution prepare an affidavit
describing the measures taken to search for a record if the institution
claims that requested records do not exist.
The Commissioner is entitled to examine any record under appeal even if it
is highly sensitive or confidential. The Commissioner's power to require
records to be produced may be delegated to an Appeals Officer unless the
record is a Cabinet record or a law enforcement record, in which case the
delegation may be made only to an Assistant Commissioner. The only
exception to this are records which are subject to federal legislation
such as the Young Offenders Act. No one is liable to prosecution
for an offence under any other act because he/she has provided records to
the IPC.
When making arrangements for the transfer of sensitive records to the
Commission, the head should consider the nature of the record and options
for the secure delivery of the records to the IPC. For example, courier
companies that have bonded employees and secure transport and storage may
be used. Alternatively, an employee of the institution may deliver the
records to the Commission.
Records that are kept at IPC premises are subject to significant security
requirements. The records cannot be removed from the IPC premises, and
must be locked away when not being used. All entry to the premises is
controlled by a card access system and visitors are accompanied at all
times. The Act prohibits IPC staff from disclosing any information
acquired during the performance of their duties. They also cannot be
compelled to testify as witnesses in any proceeding with respect to the
information.
The IPC does not indefinitely retain records it received during an appeal.
Where an appeal is disposed of by order, the records and any copies are
either returned to the institution or destroyed one year after the day the
order is issued. If an appeal is settled by mediation, the records are
retained for nine months. Original records provided to the IPC are
returned earlier if they are needed by the institution. Institutions
receive notice of these matters from the Commission.
The Commissioner may require records to be produced and may enter and
inspect any premises occupied by an institution for the purposes of an
investigation. However, a head may require, in exceptional circumstances,
that IPC staff examine an original record on site. This power of the head
may be invoked, for example, if the record is fragile, unique or there is
a large volume of records. Before entering any premises, the Commissioner
must first notify the head of the institution. Institutions are
discouraged from relying on the provision for on-site examination of
records because it would place an undue administrative burden on the
Commission.
Mediation
The Commissioner may authorize a mediator (i.e an Appeals Officer) to
investigate the circumstances of any appeal and to try to effect a
settlement of the matter under appeal (s.51
FIPPA / s.40 MFIPPA).
The Appeals Officer will review the relevant records or circumstances
under appeal and verify the institution's position. Acting as a
go-between, he/she will also try to settle the appeal or simplify the
issues, based on discussions with the appellant and the institution. In a
mediated settlement all parties reach an agreement about the matter under
appeal.
The Commissioner will attempt to settle the issues at appeal before
resorting to an order. The general time period allotted for mediation is
two months. This time period may be shortened if it is apparent that no
agreement can be reached. The appeal will then proceed to an inquiry.
The Inquiry
s.52 FIPPA
/ s.41 MFIPPA
Notice of Inquiry and the Appeals Officer's
Report
Where mediation is unsuccessful, the Commissioner may conduct an
inquiry to review the head's decision (s.52(1)(b) FIPPA / s.41(1)(b)
MFIPPA). At this stage, the appellant and the institution receive a
"Notice of Inquiry" (NOI) letter from the Commission. The notice
informs the parties to an appeal that they are entitled to make
representations. The NOI states the facts of the appeal and poses
questions to the parties relating to the provisions of FIPPA/MFIPPA that
are relevant to the issues under appeal. However, the parties do not have
to limit their representations to only those questions raised in the NOI.
An institution is expected to respond to the NOI by submitting
representations within three weeks of the date of the Notice of Inquiry
letter unless an extension is granted.
Considering Additional Exemptions and
Facts During the Inquiry Process
The Commissioner may allow an institution to claim additional
exemptions or to raise additional reasons for an exemption at the inquiry
stage than were claimed originally at the request stage.
An institution may only claim additional discretionary
exemptions within 35 days after the appeal has been opened. If an
institution raises discretionary exemptions after the 35 days, the IPC is
not obliged to consider the exemptions, although it may do so in unique
circumstances. The institution must send a new decision letter setting out
the additional exemption within the 35 day period so that the appellant is
given an opportunity to comment on the applicability of the new exemption
claim. The initial notice sent out by the Commissioner will specify the
deadline for claiming any new discretionary exemptions.
Once an appeal has been filed, it is recommended that the Freedom of
Information and Privacy Coordinator meet with the institution's legal
advisor to review the exemptions originally claimed to determine whether
they should continue to be relied upon.
The may also be occasions where further representations ought to be
submitted by the parties. This may occur where the IPC has, in the
interim, issued an order relevant to the appeal. In these situations the
Appeals Officer may advise the parties that such an order has been issued,
and allow for supplementary representations.
The Burden of Proof
s.53 FIPPA
/ s.42 MFIPPA
The party claiming that a record is exempt from access has the burden
of proving that the exemption applies.
For example, if the head denies access to a record or part of a record,
he/she must prove on appeal that all or part of a record falls within an
exemption under the Act. Or, if a third party who may be affected by the
disclosure of a record does not want the record to be released, the third
party has to show why the record should not be disclosed.
If an appellant argues that there is a "compelling public
interest" in the disclosure of an otherwise exempt record ( s.23
FIPPA / s.16 MFIPPA),
the burden of proof lies on the appellant. The burden is not absolute,
however. Where the appellant is not familiar with the content of the
records, the Commissioner will review them to determine whether the
provision applies.
Written or Oral Submissions
An inquiry must be conducted in a manner that protects the
confidentiality of the records pending the Commissioner's decision.
Therefore, the normal rules governing the rights of parties who appear
before tribunals do not apply (s.52(2) FIPPA / s.41(2) MFIPPA). These
include, for example, the right to a public hearing and the right to
cross-examine witnesses.
The Commission's general practice is to conduct inquiries through written
submissions. It may require an institution to make certain submissions by
affidavit. Any party to the appeal may request an opportunity to make oral
submissions, and an oral hearing may be held if the Commissioner believes
that it would aid in an exploration of the issues.
If an oral hearing is held, the Commissioner has the power to summon and
examine witnesses under oath. Anything said or any document or thing
produced during an inquiry, whether oral or written, is privileged to the
same extent as it would be before a court. For example, testimony provided
during a hearing may not be used in other proceedings, except in cases of
a prosecution for perjury.
Access to an Institution's or Third
Party's Submissions by an Appellant
The institution, the appellant and any affected party may be
represented by counsel or an agent during an inquiry. All of these parties
must be given an opportunity to make submissions to the Commissioner, but
"no person is entitled to be present during, to have access to or to
comment on representations made to the Commissioner by an other
person" (s.52(13)
FIPPA / s.41(13) MFIPPA).
Except if the appeal concerns a request for correction, the appellant
makes his/her submissions without the opportunity to review the records.
As a result, the appellant may request access to the institution's or a
third party's submissions. The fact that a party is not entitled
to access an opposite party's submissions does not mean that they are
prohibited from seeing them. In restricted circumstances, the Commissioner
may permit a party to hear or review the submissions or the other side, if
doing so would not reveal the contents of the records in question.
An institution may also rely on s.52(13) FIPPA / s.41(13) MFIPPA to refuse
to provide a copy of its submissions to a party who requests them directly
from the institution. Other exemptions may also apply to an institution's
submissions. If a request under FIPPA/MFIPPA is made for an institution's
submissions, it is the Commission's practice to amalgamate any appeals
which may arise from such requests with the substantive appeal to which
the request for representations relates.
Affidavit Evidence
On occasion, institutions are asked to provide information to the
Commissioner in affidavit form to establish that records do not exist or
that an adequate search was undertaken. An affidavit is a witness
statement that declares under oath that a certain set of facts are true.
The person swearing or affirming the statement reviews and signs it before
a Commissioner for Oaths or a lawyer. In appeal inquiries before the IPC,
an affidavit is acceptable as evidence in the same way as oral testimony
given under oath. It is a criminal offence under the Criminal Code to
swear a false affidavit.
The Effect of a Commissioner's Order
After receiving submissions from the interested parties, the
Commissioner will issue a binding order that is not subject to appeal. An
order may conclude with a statement requiring the institution to disclose
the records referred to in the order within 35 days following the date of
the order and not earlier than the 30th day following the date of the
order. Day one is the first day after the date of the Order. Therefore, if
the Order was dated May 1, the counting starts on May 2 and the first
release date would be May 31. The institution may release the document on
any of the 5 days following May 31st.
Where there are no affected third parties, the Order will usually conclude
with a statement requiring the institution to disclose the records within
15 days of the date of the order.
Reconsideration of Commissioner's
Orders
There is no express statutory provision in the Act that permits the
Commissioner to reconsider an order. A reconsideration of an order is not
an appeal of the order on its merits. A decision maker may reconsider a
decision in exceptional circumstances where it is established that:
(a) there is a fundamental defect in the adjudication process;
(b) there is some other jurisdictional defect in the decision; or
(c) there is a clerical error, accidental error or omission or other
similar error in the decision.
An order will not be reconsidered simply on the basis that new evidence
is provided, whether or not that evidence was obtainable at the time of
the inquiry.
A request for reconsideration should be made in writing to the original
Decision Maker and should include reasons why the application conforms to
the criteria for reconsideration described above.
A request for reconsideration does not stay (suspend) the date of
compliance for an order. An institution must still comply with the terms
of an order unless otherwise directed by the IPC. It is imperative
therefore, that a request for reconsideration be filed with the IPC
Registrar of Appeals within 21 days of the order date. This will allow the
IPC's Decision Maker to be in a position to make a determination on the
request prior to the date for compliance of the order.
A request for reconsideration does not preclude a party from seeking other
legal remedies that may be available (e.g. see Judicial Review below).
Judicial Review
The Commissioner has the power to issue a binding order that is not
subject to an appeal. Appeals are distinct from judicial review
proceedings. Judicial review proceedings are governed by the Judicial
Review Procedure Act. Applications for judicial review may be brought
before Divisional Court by a party to an appeal where it is alleged that
the Commissioner's decision was patently unreasonable or otherwise outside
the Commissioner's jurisdiction.
In the order issued by the Commissioner, the party against whom the order
is made is advised of the right to apply for judicial review and is given
30 days to make the application. Where no application for judicial review
is made within that period, the party must comply with the order.
Compliance Investigations
FIPPA/MFIPPA recognize that an institution should have basic standards
for protecting personal information in its possession. The privacy
provisions of the legislation require institutions to use appropriate
practices and procedures for collecting, storing, using, disclosing and
ultimately disposing of personal information.
Section 59 FIPPA / s.46
MFIPPA gives the Commissions the authority to:
a) offer comment on the privacy protection implications of proposed
legislative schemes or government programs, and
b) after hearing an institution's head, order the institution to:
- cease a collection of personal information practice, and
- destroy a collection of personal information that contravene FIPPA/MFIPPA.
Individuals complain to the IPC when they believe that an institution
has improperly collected, used, disclosed, retained or disposed of their
personal information. The IPC is responsible for reviewing possible
breaches of the privacy provisions of the legislation.
Sometimes the complaint is resolved informally through a resolution
that is mutually satisfactory to the complainant and the institution. An
example of the mediation available at every step of the process may be a
simple explanation of the procedure or why the information was used in the
way that it was. In these cases, the IPC may confirm the resolution by
writing a letter to the institution rather than publishing a formal
investigation report. If the complaint is not resolved in this way, a
formal investigation proceeds.
The Privacy Investigation Process
There are five steps in the Privacy Investigation Process:
Notice and Request for Information
A letter from the Commission's staff notifies the institution that a
complaint has been received and requests information relating to the
institution's position on the matter. It also can include specific
questions about issues, such as the authority to collect, use or disclose
the complainant's personal information.
The Investigation
The institution is informed that every effort will be made to mediate
and settle the complaint.
Copies of relevant documents may be required. Sometimes the
investigation requires a personal visit to the institution by the
investigator and/or meetings with key program staff.
Draft Report
If mediation is unsuccessful and the issues are straightforward or
routine, the IPC may conclude the matter with a letter. In other cases the
matter will go to a draft and final report.
Where an institution has breached the Act, recommendations to prevent
future breaches are included. Both the institution and complainant are
asked to comment on errors or omissions in the draft report.
Final Report
The IPC provides the institution and complainant with a final
investigation report. Where recommendations have been made, the IPC
requests evidence of implementation within six months. Evidence can be in
the form of a letter and supporting documentation, such as a copy of a new
policy or notice form.
Follow Up
If evidence is not received that the recommendations have been
implemented within the six month period, the IPC contacts the institution
to find out if they have been implemented, and if not, the reason why.
|
OCIPO 