National Defence (Re), 2024 OIC 34
Date: 2024-06-25
OIC file number: 5822-07099
Access request number: A-2019-01864
Summary
The complainant alleged that National Defence (DND) improperly withheld information under subsection 19(1) (personal information) of the Access to Information Act and did not conduct a reasonable search when responding to an access request. The request was for records related to the funding of a medical residency training program for a specified period. The allegations fall within paragraph 30(1)(a) of the Act.
DND conceded that it had not properly applied subsection 19(1) in all instances it was applied, and issued a supplementary disclosure. The Information Commissioner was satisfied that the remaining withheld information met the requirements of the exemption.
During the investigation, DND conducted additional searches and found additional records. The Information Commissioner concluded that DND did not conduct a reasonable search when it initially responded to the request. Also, the investigation determined that more records responsive to the request should have existed but, for various reasons, had not been retained by DND. The Information Commissioner further concluded that DND failed to pursue inquiries to ensure all responsive records were located at the time it processed the request.
The Commissioner recommended that DND ensure that its employees receive training and support on information management responsibilities and procedures, and are instructed to comply with those responsibilities. DND gave notice to the Commissioner that it would be implementing the recommendations and shared its plan to improve practices regarding records management.
The complaint is well founded.
Complaint
[1] The complainant alleged that National Defence (DND) had improperly withheld information under the following provision of the Access to Information Act in response to an access request for records related to the funding of a medical residency training program for a specified period:
- subsection 19(1) (personal information).
[2] The complainant also alleges the following:
- DND did not conduct a reasonable search for records in response to the access request.
[3] The allegations fall under paragraph 30(1)(a) of the Act.
Investigation
Exemptions
[4] When an institution withholds information under an exemption, it bears the burden of showing that refusing to grant access is justified.
Subsection 19(1): personal information
[5] Subsection 19(1) requires institutions to refuse to release personal information.
[6] To claim this exemption, institutions must show the following:
- The information is about an individual—that is, a human being, not a corporation.
- There is a serious possibility that disclosing the information would identify that individual.
- The information does not fall under one of the exceptions to the definition of “personal information” set out in paragraphs 3(j) to 3(m) of the Privacy Act (for example, business contact information for public servants).
[7] When these requirements are met, institutions must then consider whether the following circumstances exist:
- The person to whom the information relates consents to its release.
- The information is publicly available.
- Disclosure of the information would be consistent with section 8 of the Privacy Act.
[8] When one or more of these circumstances exist, subsection 19(2) of the Access to Information Act requires institutions to reasonably exercise their discretion to decide whether to release the information.
Does the information meet the requirements of the exemption?
[9] On November 30, 2023, DND conceded that it had not properly applied subsection 19(1) and provided a new disclosure to the complainant, disclosing most of what was previously redacted. However, certain information continues to be withheld. The remaining information can be classified in three categories: signatures of individuals, personal details and names of candidates and personal emails.
[10] During the investigation, the Office of the Information Commissioner (OIC) reviewed the remaining information to confirm whether the requirements of subsection 19(1) were met. Based on a review of the records, the remaining information is about an individual, there is a serious possibility that disclosing the information would identify that individual and the information does not fall under any of the exceptions to the definition of “personal information” set out in paragraphs 3(j) to 3(m) of the Privacy Act.
[11] Consequently, I am of the view that the remaining information meets the requirements of subsection 19(1).
Did the institution reasonably exercise its discretion to decide whether to disclose the information?
[12] Since the information meets the requirements of subsection 19(1), DND was required to reasonably exercise its discretion under subsection 19(2) to decide whether to disclose the information when one or both of the circumstances described in subsection 19(2) existed when it responded to the access request.
[13] The OIC confirmed that the circumstances set out in subsection 19(2) do not apply to the remaining information, with the exception of consent. In this regard, given the scope of the request and that the remaining information relates to applicants to a medical residency training program, the OIC finds it reasonable that DND has not taken steps to seek consent from each of these individuals.
[14] Based on the representations provided, I am satisfied that DND considered all relevant factors when it decided not to disclose the remainder of the withheld information.
[15] Consequently, DND’s exercise of discretion was reasonable.
Reasonable search
[16] DND was required to conduct a reasonable search for records that fall within the scope of the access request—that is, one or more experienced employees, knowledgeable in the subject matter of the request, must have made reasonable efforts to identify and locate all records reasonably related to the request.
[17] A reasonable search involves a level of effort that would be expected of any fair, sensible person tasked with searching for responsive records where they are likely to be stored.
[18] This search does not have to be perfect. An institution is therefore not required to prove with absolute certainty that further records do not exist. Institutions must however be able to show that they took reasonable steps to identify and locate responsive records.
Did the institution conduct a reasonable search for records?
[19] In its initial response, DND found 292 pages of records with certain information withheld from disclosure pursuant to subsection 19(1). Following the investigation, DND found additional 3 pages of records that happen to be the attachment mentioned on pages 48 and 50 of the relevant documents. These pages were included in the subsequent disclosure provided to the complainant on November 30, 2023
[20] The investigation confirmed that DND tasked the relevant Office of Primary Interest (OPI) to search for the responsive records and that the details of this search were appropriate.
[21] As a result of further queries from my office, DND explained that there were three individuals who might have relevant records regarding the Family Medicine Residency Programs. The investigation revealed that of the three individuals who might have had documents, two were unable to provide them. One individual lost all of their records from 2018 to 2021 following an external hard drive failure. According to DND, the second individual did not save the records prior to their departure from DND. The last individual was able to share records and provided explanations about the program mentioned in the access to information request.
[22] DND confirmed that steps had been taken to try and recover the lost documents, however, without success.
[23] During the investigation, DND explained that the only individual who originally contacted the family medicine residency programs, and who would therefore have received mail from the programs that declined to participate, no longer works for the department. None of the emails were saved in a repository that colleagues could access.
[24] Based on the investigation, I am not satisfied that DND conducted a reasonable search when initially responding to the request. Where, as here, it was clear that additional records responsive to the request should have existed at the time of its receipt of the request, it is my view that, it was unreasonable for DND to have failed to pursue further inquiries.
[25] However, as a result of the additional actions undertaken by DND during the investigation, I am now satisfied that a reasonable search has been conducted by DND.
[26] The investigation raises serious concerns about information management practices within DND and highlights certain deficiencies that have an impact on the right of access. The right of access cannot exist without records, it is therefore contingent on institutions’ proper documentation and retention of records of business value. The investigation brings to the fore the importance of these matters. I must remind DND of the importance of adopting better practices regarding records management to avoid situations of this kind.
Outcome
[27] The complaint is well founded, because:
- DND improperly withheld information under subsection 19(1).
- DND did not conduct a reasonable search when it first processed the request.
Recommendations
I recommend to the Minister of National Defence to ensure that DND’s employees receive training and support on information management responsibilities and procedures and are instructed to comply with those responsibilities. Effective information management is crucial for organizational efficiency, accountability and transparency.
Initial report and notice from institution
On May 3, 2024, I issued my initial report to the Minister of National Defence setting out my recommendations.
On May 31, 2024, the Deputy Minister of National Defence gave me notice that DND would be implementing my recommendations. More specifically, the Deputy Minister advised that DND recognizes the critical importance of access and transparency and is committed to improvements in these areas. DND further confirmed that since receiving the notice of complaint from my office, they have undertaken steps to improve the Information Management (IM) practices across the organization. Among other things, DND:
- Enhanced collaboration between the IM, Digital Transformation and Access to Information (ATI) teams: The teams are working to establish improved measurements and reporting to identify additional areas for awareness and improvement in IM practices.
- Published metadata standards: Established baseline set of metadata standards to ensure consistency, accuracy, and reliability in data management, which enhances the ability to locate, use, and share information effectively.
- Posted and promoted updated IM courses to staff.
DND also shared its plan for continued IM improvements for 2024-25, which is structured around the improvement of IM learning and performance support, ATI actions and IM modernization.
Review by Federal Court
When an allegation in a complaint falls under paragraph 30(1)(a), (b), (c), (d), (d.1) or (e) of the Act, the complainant has the right to apply to the Federal Court for a review. When the Information Commissioner makes an order(s), the institution also has the right to apply for a review. Whoever applies for a review must do so within 35 business days after the date of this report and serve a copy of the application for review to the relevant parties, as per section 43. If no one applies for a review by this deadline, the order(s) takes effect on the 36th business day after the date of this report.