Correctional Service Canada (Re), 2022 OIC 56

Date: 2022-02-07
OIC file number: 5819-05665
Institution file number: A-2017-00460

Summary

The complainant alleged that Correctional Service Canada (CSC) had improperly withheld information under subsection 19(1) (personal information) as well as paragraphs 20(1)(b) (confidential third-party financial, commercial, scientific or technical information), 20(1)(c) (financial impact on a third party) and 21(1)(a) (advice or recommendations) of the Access to Information Act in response to an access request for a contract between CSC and a third party, Presidia Security Consulting Inc. (Presidia). The complaint falls within paragraph 30(1)(a) of the Act.

Over the course of the investigation, CSC decided to no longer rely on paragraph 21(1)(a) and to disclose additional information following the response to the request. The Information Commissioner remained of the view that some information withheld under subsection 19(1) and section 20 was also improperly withheld. CSC agreed that the information previously withheld pursuant to subsection 19(1) did not meet the requirements of the exemptions on certain pages but maintained its application of section 20.

Therefore, the Information Commissioner ordered that the Commissioner of the Correctional Service of Canada release the specific information that was previously withheld pursuant to subsection 19(1) and section 20 to the complainant. Following this order, CSC has released the additional information.

The complaint is well founded.

Complaint

[1]      The complainant alleged that Correctional Service Canada (CSC) had improperly withheld information under subsection 19(1) (personal information) as well as paragraphs 20(1)(b) (confidential third-party financial, commercial, scientific or technical information), 20(1)(c) (financial impact on a third party) and 21(1)(a) (advice or recommendations) of the Access to Information Act in response to an access request for a contract between CSC and a third party, Presidia Security Consulting Inc. (Presidia).

Investigation

[2]      Over the course of the investigation, CSC decided to no longer rely on paragraph 21(1)(a) and conceded that in some instances, the information did not meet the criteria of personal information as described in subsection 19(1). As a result CSC is prepared to release the following information: all information previously exempt under paragraph 21(1)(a) as well as certain email addresses and names of individuals previously exempted under subsection 19(1). CSC however maintained its reliance on subsection 19(1), and paragraphs 20(1)(b) and 20(1)(c) to continue to withhold the remaining information.

[3]      The Office of the Information Commissioner (OIC) sought representations from Presidia and afforded it the opportunity to make representations on the application of section 20. These representations are reviewed in more detail below.

[4]      Under the Act, the burden of justifying a refusal of access to information rests on the parties opposing disclosure. Having reviewed the representations that were provided to the OIC, I am satisfied that CSC has correctly applied the Act to the remaining information, with the exception of the information withheld under section 20 on page 337. With respect to this information, I remain unconvinced that it meets the respective exemption requirements under the Act.

Subsection 19(1): personal information

[5]      Subsection 19(1) requires institutions to refuse to disclose personal information.

[6]      To claim this exemption, institutions must then show the following:

• The information is about an individual—that is, a human being, not a corporation.
• There is a serious possibility that disclosing the information would identify that individual.
• The information does not fall under one of the exceptions to the definition of “personal information” set out in paragraph 3(j) to 3(m) of the Privacy Act (for example, business contact information for public servants).

[7]      When these requirements are met, institutions must then consider whether the following circumstances exist:

• The person to whom the information relates consents to its disclosure.
• The information is publicly available.
• Disclosure of the information would be consistent with section 8 of the Privacy Act.

[8]      When one or more of these circumstances exist, subsection 19(2) of the Access to Information Act requires them to reasonably exercise their discretion to decide whether to disclose the information.

Does the information meet the requirements of the exemption?

[9]      In support of the application of the exemption to the remaining information withheld pursuant to subsection 19(1), CSC argued that, if disclosed, this information could reasonably be expected to identify individuals.

[10]    In reviewing the information in question and the representations provided, I am satisfied that it is personal information about identifiable individual(s) or information that could identify an individual(s). I am also satisfied that the information does not fall under one of the exceptions to the definition of “personal information” set out in paragraph 3(j) to 3(m) of the Privacy Act.

[11]    In light of the above, I conclude that CSC has properly exempted the remaining information in accordance with subsection 19(1).

Did the institution reasonably exercise its discretion to decide whether to release the information?

[12]    Under subsection 19(2), CSC was required to exercise its discretion to decide whether to release the remaining information when one or more of the circumstances set out in that subsection existed.

[13]    CSC provided a detailed rationale as to why the circumstances of subsection 19(2) did not exist in this case:

• It gave specific reasons why it would not have been appropriate to seek the consent of the individual(s) to whom the personal information relates.
• It showed that the information is not publicly available.
• It demonstrated that the disclosure of the information would not be consistent with section 8 of the Privacy Act.

[14]    In light of the above, I am satisfied that the circumstances set out in subsection 19(2) did not exist, meaning that the exercise of discretion was not required.

Paragraph 20(1)(b): confidential third-party financial, commercial, scientific or technical information

[15]    Paragraph 20(1)(b) requires institutions to refuse to disclose confidential financial, commercial, scientific or technical information provided to a government institution by a third party (that is, a private company or individual, but not the person who made the access request).

[16]    To claim this exemption, institutions must then show the following:

• The information is financial, commercial, scientific or technical.
• The information is confidential.
• The third party supplied the information to a government institution.
• The third party has consistently treated the information as confidential.

[17]    When these requirements are met, and the third party to whom the information relates consents to its disclosure, institutions must then reasonably exercise their discretion to decide whether to release the information.

[18]    Institutions must also reasonably exercise their discretion to decide whether to release the information for public health or public safety reasons, or to protect the environment, when both of the following circumstances exist:

• disclosure of the information would be in the public interest; and
• the public interest in disclosure clearly outweighs any financial impact on the third party, any prejudice to the security of the third party’s structures, networks or systems, or competitive position, or any interference with its contractual or other negotiations.

[19]    However, subsections 20(2) and 20(4) specifically prohibit institutions from using paragraph 20(1)(b) to refuse to release information that contains the results of product or environmental testing carried out by or on behalf of a government institution, unless the testing was done for a fee for an individual or an organization other than a government institution.

Does the information meet the requirements of the exemption?

[20]    This exemption was applied to information regarding an investigation and was used concurrently with paragraph 20(1)(c).

[21]    Based on representations received from both CSC and Presidia, I agree that the remaining information withheld pursuant to paragraph 20(1)(b) meets the requirements of the exemption with the exception of the information contained on page 337.

[22]    According to CSC, the information on page 337 could be considered commercial information. CSC added that Presidia may not want its competitors to know the process by which it conducts its third-party investigations. However, I note that in its own representations, Presidia did not provide any rationale to support the claim that this information is commercial information. As a result, I am not satisfied that the information meets the first criterion of paragraph 20(1)(b).

[23]    In addition, the representations provided by both CSC and Presidia fail to demonstrate how the information on page 337 is objectively confidential and whether Presidia has consistently treated the information as such. As a result, I am not convinced that the second and fourth criterion are met as well.

[24]    In light of the above, I conclude that the information withheld on page 337 does not meet the requirements of paragraph 20(1)(b).

Paragraph 20(1)(c): financial impact on a third party

[25]    Paragraph 20(1)(c) requires institutions to refuse to release information that, if disclosed, could reasonably be expected to have a substantial financial impact on a third party (that is, a private company or individual, but not the person who made the access request) or harm its competitive position.

[26]    To claim this exemption with regard to financial impact on a third party, institutions must show the following:

• Disclosing the information could result in substantial financial loss or gain to the third party.
• There is a reasonable expectation that this prejudice could occur—that is, the expectation is well beyond a mere possibility.

[27]    To claim this exemption with regard to competitive position, institutions must show the following:

• Disclosing the information could injure the competitive position of the third party.
• There is a reasonable expectation that this prejudice could occur—that is, the expectation is well beyond a mere possibility.

[28]    When these requirements are met, and the third party to whom the information relates consents to its disclosure, section 20(5) requires institutions to reasonably exercise their discretion to decide whether to release the information.

[29]    In addition, when the requirements are met, subsection 20(6) requires institutions to reasonably exercise their discretion to decide whether to disclose the information for public health or public safety reasons, or to protect the environment, when both of the following circumstances exist:

• disclosure of the information would be in the public interest; and
• the public interest in disclosure clearly outweighs any financial impact on the third party, any prejudice to the security of the third party’s structures, networks or systems, or competitive position, or any interference with its contractual or other negotiations.

[30]    However, subsections 20(2) and 20(4) specifically prohibit institutions from using paragraph 20(1)(c) to refuse to release information that contains the results of product or environmental testing carried out by or on behalf of a government institution, unless the testing was done for a fee for an individual or an organization other than a government institution.

Does the information meet the requirements of the exemption?

[31]    This exemption was applied to information regarding an investigation and was used concurrently with paragraph 20(1)(b).

[32]    Based on the representations received from both CSC and Presidia, I agree that the information withheld pursuant to paragraph 20(1)(c) meets the requirements of the exemption with the exception of the information contained on page 337.

[33]    With regards to the information on page 337, I note that neither Presidia nor CSC explained how paragraph 20(1)(c) can be used to protect the information contained on this page. To this effect, it is not clear how disclosing this information could result in any financial loss or gain to Presidia and/or how it would injure the company’s competitive position. In addition, there is no indication that this risk of harm is reasonably expected to occur.

[34]    In light of the above, I conclude that the information does not meet the requirements of paragraph 20(1)(c).

Result

[35]    The complaint is well founded.

Order

Under subsection 36.1(1) of the Act, I order to the Commissioner of the Correctional Service of Canada to:

• Release all information that CSC has already agreed to release on pages 14, 50, 81, 94, 113, 126, 142, 143, 144, 146, 155, 189, 227, 255, 302, 304, 310, 311, 327, 337, 338, 339, 340, 345, 346, 347, 358-361, 376, 399, 401, 429, 488 and 505 of the responsive records.
• Release all information previously withheld pursuant to section 20 on page 337 of the responsive records.
• Email a copy of the response letter to the Office of the Information Commissioner’s Registry ( Greffe-Registry@oci-ci.gc.ca ).

On December 6, 2021, I issued my initial report to the Commissioner of the Correctional Service of Canada setting out my intended order.

On January 14, 2022, the Commissioner of the Correctional Service of Canada gave me notice that she would be implementing my order.

I have provided Presidia with this report.

Section 41 of the Act provides a right to any person who receives this report to apply to the Federal Court for a review. Complainants and institutions must apply for this review within 35 business days after the date of this report. When they do not, third parties may apply for a review within the next 10 business days. The person who applies for a review must serve a copy of the application for review to the relevant parties, as per section 43. If no one applies for a review by these deadlines, this order will take effect in accordance with subsection 36.1(4).