Employment and Social Development Canada (Re), 2023 OIC 02

Date: 2023-01-13
OIC file number: 5819-00296
Institution file number: A-2017-00273

Summary

The complainant alleged that Employment and Social Development Canada (ESDC) had improperly withheld information under subsection 19(1) (personal information), paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information) and subsection 24(1) (disclosure restricted by another law) of the Access to Information Act in response to an access request for records pertaining to the engagement of Canadian universities in the Federal Contractors Program. The complaint falls within paragraph 30(1)(a) of the Act.

Business numbers, the only information withheld under subsection 24(1), were removed from the scope of the complaint.

The institution did not demonstrate that all information it withheld under subsection 19(1) was personal information about identifiable individuals, or that it appropriately exercised its discretion under paragraph 19(2)(b).

The institution and third party did not demonstrate that the requirements of paragraph 20(1)(b) were met where ESDC withheld a completed Employment Equity Achievement Awards Application Form.

The complaint is well founded.

The Information Commissioner ordered the Minister of Employment and Social Development to disclose all information at issue.

ESDC gave notice that it would fully implement the order.

Complaint

[1]      The complainant alleged that Employment and Social Development Canada (ESDC) had improperly withheld information under subsection 19(1) (personal information), paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information) and subsection 24(1) (disclosure restricted by another law) of the Access to Information Act in response to an access request for records pertaining to the engagement of Canadian universities in the Federal Contractors Program. The complaint falls within paragraph 30(1)(a) of the Act.

[2]      During the investigation, the complainant decided it was no longer necessary for the Office of the Information Commissioner (OIC) to investigate ESDC’s withholding of signatures, details about personal leave/vacation, and business numbers. As business numbers were the only information withheld under subsection 24(1), no information withheld pursuant to subsection 24(1) remained within the scope of the complaint, and no further examination of that exemption was necessary.

Investigation

[3]      When an institution withholds information, including information related to a third party, the third party and/or the institution bears the burden of showing that refusing to grant access is justified.

Subsection 19(1): personal information

[4]      Subsection 19(1) requires institutions to refuse to release personal information.

[5]      To claim this exemption, institutions must show the following:

• The information is about an individual—that is, a human being, not a corporation.
• There is a serious possibility that disclosing the information would identify that individual.
• The information does not fall under one of the exceptions to the definition of “personal information” set out in paragraphs 3(j) to 3(m) of the Privacy Act (for example, business contact information for public servants).

[6]      When these requirements are met, institutions must then consider whether the following circumstances exist:

• The person to whom the information relates consents to its release.
• The information is publicly available.
• Disclosure of the information would be consistent with section 8 of the Privacy Act.

[7]      When one or more of these circumstances exist, subsection 19(2) of the Act requires institutions to reasonably exercise their discretion to decide whether to release the information.

Does the information meet the requirements of the exemption?

[8]      In reviewing the information at issue, it is clear that the following information satisfies the requirements of subsection 19(1), in that it is about named individuals who are clearly identifiable and none of the exceptions to the definition of personal information set out in paragraph 3(j) to (m) of the Privacy Act apply, including but not limited to names, user names, passwords, email addresses and cell phone numbers of university employees.

[9]      Much of the remaining information redacted under subsection 19(1) consists of universities’ statistics about employment representation by equity designated groups (women, aboriginal, visible minority, disability) within specified categories of occupation based on employees’ self-identification. On their face these statistics are about groups of individuals; it is not immediately apparent how this information is about any identifiable individuals.

[10]    The Federal Court of Appeal in Canada (Information Commissioner) v. Canada (Canadian Transportation Accident Investigation and Safety Board), 2006 FCA 157 stated that “an ‘identifiable’ individual is considered to be someone whom it is reasonable to expect can be identified from the information in issue when combined with information from sources otherwise available”. The Federal Court has since framed the test as requiring that there be a serious possibility or reasonable expectation that an individual could be identified using available information (see Gordon v. Canada (Health), 2008 FC 258, paras. 32-34; Canada (Information Commissioner) v. Canada (Minister of Public Safety and Emergency Preparedness), 2019 FC 1279, (“Minister of Public Safety”), para. 53).

[11]    A “serious possibility” means something more than a frivolous chance, but less than a balance of probabilities and “other available information” is not limited to information available to the public at large, but may be available only to a smaller subset of the public (Minister of Public Safety, supra, para.65).

[12]    Having considered the matter, I am satisfied that the serious possibility test is met with respect to the withheld statistics. These statistics pertain to small groups of individuals (i.e. less than 10) that are employed within specified occupations at named universities and have self-identified as fitting within a particular equity designated group. I accept that the disclosure of this information, when combined with information from sources otherwise available, would give rise to a serious possibility of individuals, to whom the information is about, being identified.

[13]    I find there is a serious possibility that disclosing the statistics pertaining to such small groups would in each instance reveal added information about some identifiable individuals that is not already within the public domain. This conclusion is supported by a detailed analysis conducted by the Office of the Privacy Commissioner (OPC), from which the OIC sought representations during the course of this investigation.

[14]    In my view, ESDC’s previous disclosure, in November of 2020, of similar information in response to a motion made by the Standing Committee on Government Operations and Estimates (the “OGGO release”) does not negate subsection 19(1)’s application to the statistics within the responsive records. As was noted by the OPC, “it is not clear, in [that] case, whether any identifiability assessments were conducted prior to releasing this data.” If personal information was disclosed in a different context, this does not mean that personal information in the records at issue should also be disclosed. As such, I find that all of the withheld statistics meet the requirements of subsection 19(1).

[15]    The remaining information withheld under subsection 19(1) consists of emails at pages 72-73, 176 and 1827-1828 of the responsive records. In reviewing these emails, I am not satisfied that the contents of emails at pages 1827-1828 consist of information about an identifiable individual so as to fall within the scope of subsection 19(1). Notably, this was conceded by ESDC during the course of the investigation, and is also in keeping with representations from the OPC.

[16]    As for the emails at pages 72-73 and 176, while I agree that they contain personal information, they also contain additional information that can reasonably be severed and disclosed in accordance with section 25 of the Act. It is my view that specific information on these pages cannot justifiably be withheld under subsection 19(1), as detailed in my initial report to the Minister of Employment and Social Development.

[17]    ESDC agreed that further severance was possible and the OPC agreed that the information I have specified in my initial report can be severed and disclosed.

[18]    I conclude that not all of the information withheld under subsection 19(1) meets the requirements for exemption – specifically:

• Where the information is not about an identifiable individual: such as on pages 1827-1828;
• Where ESDC did not properly sever non-personal information from personal information on pages 72-73 and 176.

Did the institution reasonably exercise its discretion to decide whether to disclose the information?

[19]    Since much of the information meets the requirements of subsection 19(1), ESDC was required to reasonably exercise its discretion under subsection 19(2) to decide whether to disclose the information when one or more of the circumstances described in subsection 19(2) existed when it responded to the access request.

[20]    I accept that it would not have been reasonable in the present instance for ESDC to have sought the consent of the numerous third party employees whose information is involved. There was therefore no discretion to disclose the information under paragraph 19(2)(a).

[21]    I also accept that there is no indication that disclosure would be in accordance with section 8 of the Privacy Act, so as to permit the information’s disclosure under paragraph 19(2)(c).

[22]    With regard to paragraph 19(2)b), during the investigation, the OIC noted that some of the redacted statistics are available, as they can readily be discerned based on information that ESDC has disclosed. Moreover, the OGGO release also contains similar information. I recognize that the statistics might have been disclosed inadvertently and that the similar information from the OGGO release was not publicly available at the time of ESDC’s response to the access request. Regardless, ESDC did not provide sufficient representations to demonstrate that it had considered whether the circumstances set out in paragraph 19(2)(b) existed when it responded to the access request. Consequently, I must conclude that ESDC did not show that it had determined whether those circumstances existed, which prevented it from exercising its discretion when appropriate.

Paragraph 20(1)(b): confidential third-party financial, commercial, scientific or technical information

[23]    Paragraph 20(1)(b) requires institutions to refuse to release confidential financial, commercial, scientific or technical information provided to a government institution by a third party (that is, a private company or individual, but not the person who made the access request).

[24]    To claim this exemption, institutions must show the following:

• The information is financial, commercial, scientific or technical.
• The information is confidential.
• The third party supplied the information to a government institution.
• The third party has consistently treated the information as confidential.

[25]    When these requirements are met, and the third party to whom the information relates consents to its disclosure, subsection 20(5) requires institutions to reasonably exercise their discretion to decide whether to release the information.

[26]    In addition, when the requirements are met, subsection 20(6) requires institutions to reasonably exercise their discretion to decide whether to release the information for public health or public safety reasons, or to protect the environment, when both of the following circumstances exist:

• disclosure of the information would be in the public interest; and
• the public interest in disclosure clearly outweighs any financial impact on the third party, any prejudice to the security of the third party’s structures, networks or systems, or competitive position, or any interference with its contractual or other negotiations.

[27]    However, subsections 20(2) and 20(4) specifically prohibit institutions from using paragraph 20(1)(b) to refuse to release information that contains the results of product or environmental testing carried out by or on behalf of a government institution, unless the testing was done for a fee for an individual or an organization other than a government institution.

Does the information meet the requirements of the exemption?

[28]    ESDC withheld a 10-page Employment Equity Achievement Awards Application Form (application form), submitted to ESDC by the University of Waterloo, relying on paragraph 20(1)(b).

[29]    During the investigation, both ESDC and the University of Waterloo conceded that this record does not fall within the scope of paragraph 20(1)(b), and that this record can be disclosed. I agree. Although the record was supplied by the University of Waterloo to a government institution so as to meet the third criterion of paragraph 20(1)(b), the other requirements of this exemption are not met. More specifically, the record does not consist of financial, commercial, scientific or technical information. It is also clear that the record is neither objectively confidential nor has it consistently been treated as confidential by the University of Waterloo. Evidence of this is the inclusion of a clause within the signed Application form that authorizes the “publication by the Government of Canada of all information and items included with this application.”

[30]    Consequently, I conclude that the information does not meet the requirements of paragraph 20(1)(b).

Result

[31]    The complaint is well founded.

Order

Under subsection 36.1(1) of the Act, I order the Minister of Employment and Social Development to:

1. Sever and disclose the information on pages 72-73 and 176 that does not meet the requirements of subsection 19(1), as described in my initial report;
2. Disclose the information withheld under subsection 19(1) on pages 1827-1828;
3. Disclose the information withheld under paragraph 20(1)(b);
4. Consider the extent to which redacted information is publicly available and, in turn, reasonably exercise discretion to decide whether to disclose that information under paragraph 19(2)(b).

The Minister must abide by the terms of subsection 37(4) when disclosing any records in response to my order.

On January 3, 2023, I issued my initial report setting out my order.

On January 10, 2023, the Acting Manager, Access to Information and Privacy Secretariat gave me notice that ESDC would be implementing my order.

I have provided the University of Waterloo and the Privacy Commissioner of Canada with this report.

When a complaint falls within the scope of paragraph 30(1)(a), (b), (c), (d), (d.1) or (e) of the Act, the complainant and institution have the right to apply to the Federal Court for a review. They must apply for this review within 35 business days after the date of this report. When they do not, third parties and the Privacy Commissioner may apply for a review within the next 10 business days. The person who applies for a review must serve a copy of the application for review to the relevant parties, as per section 43. If no one applies for a review by these deadlines, this order takes effect on the 46th business day after the date of this report.