Employment and Social Development Canada (Re), 2023 OIC 32

Date: 2023-07-20
OIC file number: 5821-02741
Institution file number: A-2020-00280

Summary

The complainant alleged that Employment and Social Development Canada (ESDC) had improperly withheld information under subsection 19(1) (personal information) and paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information) of the Access to Information Act. This was in response to an access request for fatality investigation reports completed by rail industry employers and submitted to ESDC. The complaint falls within paragraph 30(1)(a) of the Act.

The Information Commissioner found that a significant amount of the withheld information met the requirements of subsection 19(1), as it was information about the victims, witnesses and other individuals involved, but found that certain information was not about identifiable individuals.

The Office of the Information Commissioner sought representations from four third parties. One of the third parties claimed the information was also exempt under paragraph 20(1)(c) (financial impact on a third party). With respect to the third-party information, neither ESDC nor the third parties provided sufficient representations to support that all of the withheld third-party information met the requirements of paragraph 20(1)(b) or 20(1)(c).

The Information Commissioner ordered that ESDC: disclose information that is not about identifiable individuals, determine to what extent the information is publicly available and re-exercise discretion under paragraph 19(2)(b), disclose information not meeting the requirements of paragraph 20(1)(b) and re-exercise discretion under subsection 20(5).

ESDC gave notice that it would implement the order.

The complaint is well founded.

Complaint

[1]      The complainant alleged that Employment and Social Development Canada (ESDC) had improperly withheld information under subsection 19(1) (personal information) and paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information) of the Access to Information Act. This was in response to an access request for fatality investigation reports completed by rail industry employers and submitted to ESDC for rail workplace fatalities occurring between 2000 and 2020. The complaint falls within paragraph 30(1)(a) of the Act.

Investigation

[3]      When an institution withholds information, including information related to third parties, the third parties and/or the institution bear the burden of showing that refusing to grant access is justified.

[4]      The OIC sought representations from four third parties pursuant to paragraph 35(2)(c): Canadian National Railway Company (CN), Canadian Pacific Railway Company (CP), Northstar Frontier Services (Northstar) and the City of Ottawa. While CN and CP responded, neither Northstar nor the City of Ottawa provided representations pursuant to paragraph 35(2)(c) of the Act.

[5]      As required by section 36.3, I notified all four third parties of my intention to order ESDC to disclose some of the information at issue. CN was the only third party to respond.

Subsection 19(1): personal information

[6]      Subsection 19(1) requires institutions to refuse to disclose personal information.

[7]      To claim this exemption, institutions must show the following:

• The information is about an individual—that is, a human being, not a corporation.
• There is a serious possibility that disclosing the information would identify that individual.
• The information does not fall under one of the exceptions to the definition of “personal information” set out in paragraphs 3(j) to 3(m) of the Privacy Act (for example, business contact information for public servants).

[8]      When these requirements are met, institutions must then consider whether the following circumstances (listed in subsection 19(2)) exist:

• The person to whom the information relates consents to its disclosure.
• The information is publicly available.
• Disclosure of the information would be consistent with section 8 of the Privacy Act.

[9]      When one or more of these circumstances exist, subsection 19(2) of the Act requires the institution to reasonably exercise its discretion to decide whether to disclose the information.

Does the information meet the requirements of the exemption?

[10]    I accept that the requested records contain a significant amount of personal information about identifiable individuals. The OIC questioned, however, whether all of the information withheld pursuant to subsection 19(1) meets the requirements of the exemption.

[11]    ESDC applied subsection 19(1) to withhold information that on its face, does not appear to be about an identifiable individual, examples of which were included in my initial report to ESDC. During the investigation, ESDC provided no representations as to how this type of information meets the requirements of subsection 19(1).

[12]    Under the terms of paragraph 35(2)(d), the OIC consulted the Office of the Privacy Commissioner (OPC). The OPC agreed with my assessment, indicating: “In this specific context, we agree that releasing the titles of reports, boilerplate information […], would not meet the test under section 19(1)”. Accordingly, this information should have been released.

[13]    The OIC also questioned how some of the withheld information is the personal information of an identifiable individual. Although on its face, the cause of death and details of the incidents is not about an identifiable individual, I considered whether there existed a serious possibility that the individual could be identified using this information in combination with other available information. Given the small number of incidents, the fact that some information about certain deaths is available online, and the likelihood that some details are known within the communities of the deceased, I find that there is a serious possibility that releasing further information would render the individuals identifiable. As such, information such as the cause of death and details of the incidents meets the requirements of subsection 19(1) within the context of these records.

[14]    I conclude that some of the withheld information does not meet the requirements of subsection 19(1), where the information is not personal in nature or where the individual to whom the information relates is not identifiable. ESDC withheld such information on pages 3-16, 18-26 and 34-35 of the records.

Did the institution reasonably exercise its discretion to decide whether to disclose the information?

[15]    Since some of the information meets the requirements of subsection 19(1), ESDC was required to reasonably exercise its discretion under subsection 19(2) to decide whether to disclose the information when one or more of the circumstances described in subsection 19(2) existed when it responded to the access request.

[16]    Under paragraph 19(2)(a), ESDC was required to determine whether consent was provided by making reasonable efforts to seek consent from the individuals whose personal information appears in the records. The OIC questioned whether ESDC made reasonable efforts to seek consent, and where it did not seek consent, why ESDC did not consider it reasonable to seek such consent. I am satisfied that seeking consent from the individuals to whom the information relates would not have been reasonable.

[17]    I conclude that the circumstances set out in paragraph 19(2)(a) did not exist when ESDC responded to the access request.

[18]    Under paragraph 19(2)(b), ESDC’s discretion would have been triggered if any of the personal information was publicly available. The OIC asked if ESDC turned its mind to whether the personal information was publicly available at the time it processed the request.

[19]    In its representations, ESDC did not indicate whether it found any of the information to be publicly available, and if so, how disclosure of the information within the records would reveal more than what is already publicly available information. ESDC did indicate that, should its discretion be triggered, it could reasonably exercise its discretion in order to withhold publicly available information. It did not, however, indicate what factors it considered that would favour the non-disclosure of any public information.

[20]    I conclude that ESDC has not demonstrated that it adequately considered whether its discretion was triggered under paragraph 19(2)(b).

[21]    Discretion is also triggered under paragraph 19(2)(c) when the disclosure would be in accordance with section 8 of the Privacy Act. Given that the records relate to workplace fatalities, the OIC questioned whether ESDC considered subparagraph 8(2)(m)(i) of the Privacy Act, which would allow ESDC to disclose personal information if the “public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure”.

[22]    ESDC indicated that it had considered whether any public interest existed, but felt that in most cases it did not, as the deaths were either deemed not to be work related or accidental. Where ESDC did consider there could be a public interest in disclosure, ESDC did not find it outweighed the invasion of privacy that would have resulted from disclosure, as safety related details were already released to the media and disclosure would not further the public interest. It does appear that where there would be a public interest in disclosure, related information has already been made public, and I find it is not unreasonable for ESDC to have concluded that the public safety interest in disclosure does not outweigh the invasion of privacy.

[23]    I conclude that the circumstances set out in paragraph 19(2)(c) did not exist when ESDC responded to the access request.

Paragraph 20(1)(b): confidential third-party financial, commercial, scientific or technical information

[24]    Paragraph 20(1)(b) requires institutions to refuse to disclose confidential financial, commercial, scientific or technical information provided to a government institution by a third party (that is, a private company or individual, but not the person who made the access request).

To claim this exemption, institutions must show the following:

• The information is financial, commercial, scientific or technical.
• The information is confidential.
• The third party supplied the information to a government institution.
• The third party has consistently treated the information as confidential.

[25]    When these requirements are met, and the third party to whom the information relates consents to its disclosure, subsection 20(5) requires institutions to reasonably exercise their discretion to decide whether to disclose the information.

[26]    In addition, when the requirements are met, subsection 20(6) requires institutions to reasonably exercise their discretion to decide whether to disclose the information for public health or public safety reasons, or to protect the environment, when both of the following circumstances (listed in subsection 20(6)) exist:

• disclosure of the information would be in the public interest; and
• the public interest in disclosure clearly outweighs any financial impact on the third party, any prejudice to the security of the third party’s structures, networks or systems, or competitive position, or any interference with its contractual or other negotiations.

Does the information meet the requirements of the exemption?

[27]    I accept that some of the withheld information relates to third-party-specific procedures, equipment and processes, making some of it commercial or technical information meeting the first requirement of the exemption. Neither ESDC nor the third parties provided me with sufficient representations to determine to what extent the withheld information is commercial or technical in nature. Fatality incidents would not seem to be an integral part of these companies’ commercial operations. The OIC questioned to what extent the records reveal third party methods or how the third parties conduct their operations, so as to make the information fall under the ordinary meanings of commercial or technical information.

[28]    Some information in particular does not clearly fit within the common definitions of financial, commercial, scientific or technical information. More specifically, the OIC questioned how the following types of information fall within these categories: summaries of the events leading up to employee fatalities, who witnessed the events, who was involved in the internal investigations and what steps they took, details uncovered by the third parties during internal investigations.

[29]    It should be noted that the fact that operations have a commercial purpose, does not render all information related to those operations commercial information, within the ordinary meaning of that term. Such a broad interpretation was rejected in Canada (Information Commissioner) v. Canada (Canadian Transportation Accident Investigation and Safety Board) et al., 2006 FCA 157 at para. 69, where the Federal Court of Appeal explained:

[30]    The information at issue does not pertain to trade or commerce. Instead, the records relate to reports of employee fatalities. This is not commercial information and does not become commercial information simply because it somehow relates to an entity’s commercial operations.

[31]    I am also not convinced that the bulk of the redacted information constitutes technical information, within the ordinary meaning of that term. While it may be that small portions of the information at issue could fit this criterion, no such portions have been specifically identified by the third parties or ESDC. Additionally, those portions would only be capable of being withheld under paragraph 20(1)(b) if all other requirements of the exemption are met.

[32]    I find that the information does not meet the first requirement of the exemption where the information does not relate to third-party-specific training, procedures, equipment or processes.

[33]    The second requirement of paragraph 20(1)(b) is that the information be confidential by an objective standard. As a result, a party claiming that information is confidential under paragraph 20(1)(b) must establish that each of the following conditions are met:

• the content of the record is not available from sources otherwise accessible to the public or obtainable by observation or independent study by a member of the public acting on their own;
• the information originates and is communicated in a reasonable expectation of confidence that it will not be disclosed; and
• the information, whether provided by law or supplied voluntarily, be communicated in a relationship between government and the third party that is either a fiduciary relationship or one that is not contrary to the public interest, and that will be fostered for the public benefit by confidential communication. (see: Air Atonabee Ltd. v. Canada (Minister of Transport), [1989] F.C.J. No. 453).

[34]    Details of the deaths of at least one employee have been made public. As a result, I am not convinced that the conditions for objective confidentiality can be met where disclosure would only reveal already public information.

[35]    In its representations to ESDC during the initial processing of the request, CN submitted that confidentiality is provided for under the Canada Labour Code. Although subsection 144(3) of the Canada Labour Code is listed under Schedule II and would allow ESDC to invoke subsection 24(1) of the Access to Information Act to withhold secret processes and trade secrets, ESDC did not invoke subsection 24(1) at the time it processed the request, and did not claim it in response to my representations request. Nor did CN provide ESDC or the OIC with representations as to how the withheld information constitutes secret processes or trade secrets. Consequently, I conclude that the information at issue here is not confidential by virtue of the Canada Labour Code. If Parliament had intended section 144 of the Canada Labour Code to protect the confidentiality of all information gathered by ESDC during investigations, the OIC would expect Schedule II of the Access to Information Act to include more than the explicit protection for trade secrets or secret processes.

[36]    Subsections 144(5) and (5.01) of the Canada Labour Code would appear to reduce any reasonable expectation of confidentiality of information obtained as a result of activities carried out in section 141. These provisions permit the publication or disclosure of such information if the Head is satisfied that this publication or disclosure would be in the interest of occupational health and safety or the public interest. I am not satisfied that all of the information was communicated within the context of a relationship between the third party and ESDC that would be fostered for public benefit by the communication’s confidentiality. Some of the information pertains to matters of safety. In light of this, the relationship would seem to be fostered for public benefit by the information’s disclosure, as opposed to confidentiality over the information that has been withheld.

[37]    Based on the above, it has not been established that the second requirement of paragraph 20(1)(b) is met.

[38]    Turning to the third requirement of paragraph 20(1)(b), I accept that the withheld information, apart from specific information on page 6 of the records as detailed in my initial report, was supplied to ESDC by the third parties.

[39]    Finally, turning to the last requirement of paragraph 20(1)(b), based on the representations CN and CP have already provided to ESDC, it generally appears that CN and CP have consistently treated this information as confidential. Northstar, on the other hand, made no such representations. Rather it provided its consent for ESDC to disclose the information, during the initial processing of the request. Neither Northstar nor the City of Ottawa responded to the OIC’s request for representations pursuant to paragraph 35(2)(c) of the Act. Therefore, I cannot conclude that Northstar and the City of Ottawa have consistently treated this information as confidential.

[40]    I conclude that some of the withheld information does not meet all four of the requirements of paragraph 20(1)(b). More specifically, I only accept that the requirements of paragraph 20(1)(b) are met where:

• the information relates to CN and CP;
• disclosure would reveal details of third-party-specific training, procedures, equipment or processes;
• the information is not publicly available; and
• disclosure would not be in the public interest for health and safety reasons.

Did the institution reasonably exercise its discretion to decide whether to disclose the information?

[41]    Since some of the information meets the requirements of paragraph 20(1)(b), ESDC was required to reasonably exercise its discretion to decide whether to disclose the information when the third party to whom it relates consents to its disclosure, as per subsection 20(5). Northstar consented to disclosure of the information related to it.

[42]    In addition, ESDC was required to reasonably exercise its discretion to decide whether to disclose the information for public health or public safety reasons, or to protect the environment, when the two circumstances described in subsection 20(6) existed when it responded to the access request.

[43]    Given that some of the records relate to potentially preventable workplace fatalities, and that section 44 of the Railway Safety Act opens the door for railways to be somewhat self-policing, the information does appear to be relevant to public safety.

[44]    The OIC questioned whether ESDC turned its mind to the matter of public interest in disclosure and weighed the public interest against any financial impact on the third parties, any prejudice to their competitive positions, or any interference with their contractual or other negotiations.

[45]    ESDC indicated that it had considered whether any public interest existed, but felt that in most cases it did not, as the deaths were either deemed not to be work related or accidental. Where ESDC did consider there could be a public interest in disclosure, ESDC did not find it outweighed the potential impact disclosure could have on the third parties, as safety related details were already released to the media and disclosure would not further the public interest. It does appear that where there would be a public interest in disclosure, related information has already been made public, and I find it is not unreasonable for ESDC to have concluded that the public safety interest in disclosure does not outweigh the potential impact on the third parties.

[46]    I conclude that the circumstances set out in subsection 20(6) did not exist when ESDC responded to the access request. Consequently, there is no need to examine the issue of discretion under subsection 20(6).

[47]    In light of Northstar’s consent, I conclude that the circumstances set out in subsection 20(5) existed when ESDC responded to the access request. Consequently, ESDC was required to reasonably exercise its discretion to decide whether to disclose the information. In doing so, ESDC had to consider all the relevant factors for and against disclosure.

[48]    ESDC did not provide any information indicating that it had considered its obligation to exercise its discretion to decide whether to disclose the information related to Northstar. Consequently, I must conclude that ESDC did not show that it had reasonably exercised its discretion to decide not to disclose the information related to Northstar.

Paragraph 20(1)(c): financial impact on a third party

[49]    Paragraph 20(1)(c) requires institutions to refuse to disclose information that, if disclosed, could reasonably be expected to have a material financial impact on a third party (that is, a private company or individual, but not the person who made the access request) or harm its competitive position.

[50]    To claim this exemption with regard to financial impact on a third party, institutions must show the following:

• Disclosing the information could result in material financial loss or gain to the third party.
• There is a reasonable expectation that this harm could occur—that is, the expectation is well beyond a mere possibility.

[51]    To claim this exemption with regard to competitive position, institutions must show the following:

• Disclosing the information could injure the competitive position of the third party.
• There is a reasonable expectation that this prejudice could occur—that is, the expectation is well beyond a mere possibility.

Does the information meet the requirements of the exemption?

[52]    In the present instance, ESDC has not applied paragraph 20(1)(c) to the records, but CN has asserted that the exemption applies to the information at issue. CN’s representations in support of paragraph 20(1)(c) relate to ESDC investigation reports, which are not responsive to this access request. Consequently, CN has not provided any representations as to the harm that would result from disclosure of the records at issue.

[53]    For paragraph 20(1)(c) to apply, there must be a clear and direct connection between the disclosure of specific information and a risk of harm well beyond the merely possible or speculative (see Merck Frosst Canada Ltd. v. Canada (Health), 2012 SCC 3, paras. 197, 206).

[54]    CN has provided no explanation as to how disclosure could reasonably be expected to result in either a material financial loss or gain, or injury to a third party’s competitive position. Therefore, ESDC and the third parties have not demonstrated a clear and direct connection between disclosure of the information at issue, and a risk of harm within the meaning of paragraph 20(1)(c) that is well beyond the merely possible or speculative.

[55]    I conclude that the information does not meet the requirements of paragraph 20(1)(c).

Section 25: severance

[56]    Section 25 applies notwithstanding any other provision in the Act. It requires institutions to disclose any part of a record that does not contain exempt information under the Act, and which can reasonably be severed from exempt information on the record. This is an extension of the principle that necessary exceptions to access should be limited and specific.

[57]    I note that ESDC withheld records related to CN and the City of Ottawa in their entirety, while applying severance to the same type of information related to CP and Northstar. Given this discrepancy, it appears that further severance should have been possible.

[58]    Consequently, I find that ESDC failed to adhere to section 25 in exempting the entirety of records related to CN and the City of Ottawa. Accordingly, I ask that ESDC engage in a severance exercise in accordance with section 25, and the guidance provided on this section by the majority of the Supreme Court in Merck Frosst Canada Ltd. v. Canada (Health), 2012 SCC 3, paras. 229-238.

Result

[59]    The complaint is well founded.

Order

Under subsection 36.1(1) of the Act, I order the Minister of Employment and Social Development to:

1. Disclose information withheld under subsection 19(1) that is not about an identifiable individual on pages 3-16, 18-26 and 34-35 of the records;
2. Determine whether the circumstance described in paragraph 19(2)(b) exists by considering the relevant publicly available information and; where ESDC finds that disclosure would not reveal any more information than is public, reasonably exercise discretion to decide whether to release the personal information;
3. Disclose all information withheld under paragraph 20(1)(b) where I have found the requirements of the exemption are not met and where I have not found the requirements of subsection 19(1) to be met; and
4. Re-Exercise discretion under subsection 20(5) with respect to the information related to Northstar, where the information does not meet the requirements of subsection 19(1) and no other third party has an interest in the same information, taking into account all relevant factors for and against disclosure.

On June 5, 2023, I issued my initial report to the Minister of Employment and Social Development setting out my order.

On June 29, 2023, ESDC gave notice that it would be implementing my order.

I have provided a copy of this report to CN, CP and the Privacy Commissioner of Canada.

When a complaint falls within the scope of paragraph 30(1)(a), (b), (c), (d), (d.1) or (e) of the Act, the complainant and institution have the right to apply to the Federal Court for a review. They must apply for this review within 35 business days after the date of this report. When they do not, third parties and the Privacy Commissioner may apply for a review within the next 10 business days. The person who applies for a review must serve a copy of the application for review to the relevant parties, as per section 43. If no one applies for a review by these deadlines, this order takes effect on the 46th business day after the date of this report.