National Capital Commission (Re), 2023 OIC 34
Date: 2023-08-18
OIC file number: 5820-04528
Institution file number: A-2020-00085
Summary
The complainant alleged that the National Capital Commission (NCC) had improperly withheld information under paragraph 16(2)(c) (facilitating the commission of an offence), subsection 18(d) (negotiations by government institutions) and subsection 19(1) (personal information) of the Access to Information Act in response to an access request for records discussing specific renovation projects at Rideau Hall. The complaint falls within paragraph 30(1)(a) of the Act.
The application of paragraph 16(2)(c) and subsection 18(d) to withhold the records at issue was removed from the scope of the complaint.
During the investigation, the NCC decided to disclose information on four pages that it had withheld under subsection 19(1).
For the remaining information, the NCC could not show that the name, title and contact information of an NCC employee met all the requirements of subsection 19(1). In addition, the NCC did not reasonably exercise its discretion to decide whether to disclose publicly available personal information.
The Information Commissioner ordered the NCC to disclose the information at issue and to exercise its discretion to disclose publicly available personal information.
The NCC gave notice to the Commissioner that it would implement the order.
The complaint is well founded.
Complaint
[1] The complainant alleged that the National Capital Commission (NCC) had improperly withheld information under paragraph 16(2)(c) (facilitating the commission of an offence), subsection 18(d) (negotiations by government institutions) and subsection 19(1) (personal information) of the Access to Information Act in response to an access request for records discussing specific renovation projects at Rideau Hall. The complaint falls within paragraph 30(1)(a) of the Act.
Investigation
[2] When an institution withholds information, the institution bears the burden of showing that refusing to grant access is justified.
[3] The scope of the complaint is limited to the application of subsection 19(1) on pages 55-58, 120-121, 123 and 127-131 of the responsive records.
[4] During the course of the investigation, the NCC disclosed additional information which it had withheld under subsection 19(1) on pages 57-58 and 127-128 of the responsive records. The NCC conceded that this information would not qualify for exemption as personal information.
[5] The following analysis relates to the remaining information at issue.
Subsection 19(1): personal information
[6] Subsection 19(1) requires institutions to refuse to release personal information.
[7] To claim this exemption, institutions must show the following:
- The information is about an individual—that is, a human being, not a corporation.
- There is a serious possibility that disclosing the information would identify that individual.
- The information does not fall under one of the exceptions to the definition of “personal information” set out in paragraphs 3(j) to 3(m) of the Privacy Act (for example, business contact information for public servants).
[8] When these requirements are met, institutions must then consider whether the following circumstances exist:
- The person to whom the information relates consents to its release.
- The information is publicly available.
- Disclosure of the information would be consistent with section 8 of the Privacy Act.
[9] When one or more of these circumstances exist, subsection 19(2) of the Act requires institutions to reasonably exercise their discretion to decide whether to release the information.
Does the information meet the requirements of the exemption?
[10] The records at issue are email correspondence dated from 2018 to 2020 between officials of the NCC and the Office of the Governor General (OGG) and relate to ongoing and planned renovations of Rideau Hall.
[11] Since the OGG is not listed under Schedule I of the Act, I agree that the names of OGG employees are the personal information of identifiable individuals and qualify for exemption under subsection 19(1) of the Act.
[12] However, the remaining information, specifically the name and contact information of an NCC employee, does not meet the requirements for exemption pursuant to subsection 19(1) as it is excluded as personal information under paragraph 3(j) of the Privacy Act.
[13] Prior to issuing an order in respect of the information in question, the OIC consulted the Office of the Privacy Commissioner (OPC) pursuant to section 36.2 of the Act. The OPC agreed with my assessment. The name and title of the NCC employee falls within the exception to the definition of “personal information” in paragraph 3(j) of the Privacy Act and should not be withheld from the complainant as personal information under subsection 19(1) of the Access to Information Act.
Is disclosure warranted under subsection 19(2)?
[14] For the information that meets the requirements of subsection 19(1), the NCC was required to reasonably exercise its discretion under subsection 19(2) to decide whether to disclose the information when one or more of the circumstances described in subsection 19(2) existed when it responded to the access request.
[15] Under paragraph 19(2)(a), the NCC was required to determine whether consent was provided by making reasonable efforts to seek consent from the individuals whose personal information appears in the records. The investigation revealed that the NCC sought consent to release similar information while processing similar access requests in the past and that consent had always been declined. As a result, the NCC did not seek the consent of these individuals in the present instance. In light of the information before me, I find that seeking consent would not have been reasonable.
[16] I conclude that the circumstances set out in paragraph 19(2)(a) did not exist when the NCC responded to the access request. Consequently, there is no need to examine the issue of discretion under paragraph 19(2)(a).
[17] Under paragraph 19(2)(b), NCC’s discretion would have been triggered if the personal information was publicly available. The NCC did not provide sufficient information indicating that it had considered its obligation to exercise its discretion to decide whether to disclose the information where its discretion was triggered pursuant to paragraph 19(2)(b). Consequently, I must conclude that the NCC did not show that it had reasonably exercised its discretion.
[18] Discretion is also triggered under paragraph 19(2)(c) when the disclosure would be in accordance with section 8 of the Privacy Act. Based on the NCC’s representations, I am satisfied that disclosure of the information would not be consistent with section 8 of the Privacy Act.
[19] In light of all of the above, I find that the NCC’s exercise of discretion was not reasonable, specifically with respect to information which is publicly available.
Result
[20] The complaint is well founded.
Order
Under subsection 36.1(1) of the Act, I order the Chairperson of the NCC to:
- disclose the name, title and contact information of the NCC employee;
- exercise discretion to release publicly available personal information.
On July 5, 2023, I issued my initial report to the Chairperson of the NCC setting out my intended order.
On August 3, 2023, the NCC gave me notice that it would be implementing my order.
I have provided the Privacy Commissioner of Canada with this report.
When a complaint falls within the scope of paragraph 30(1)(a), (b), (c), (d), (d.1) or (e) of the Act, the complainant has the right to apply to the Federal Court for a review. The complainant must apply for this review within 35 business days after the date of this report.
When they do not, the Privacy Commissioner may apply for a review within the next 10 business days. The person who applies for a review must serve a copy of the application for review to the relevant parties, as per section 43. If no one applies for a review by these deadlines, this order takes effect on the 46th business day after the date of this report.