WxT Language switcher

Exemption from disclosure: personal information

Contents

Requirements: subsection 19(1)

  1. Whether the information is about an individual
  2. Whether there is a serious possibility that disclosing the information would identify the individual
  3. Whether the information falls under one of the exceptions to the definition of “personal information”

Requirements: subsection 19(2)

  1. Whether the person to whom the information relates consented to its release
  2. Whether the information is publicly available
  3. Whether the disclosure is in accordance with section 8 of the Privacy Act.

Exercise of discretion

  1. Whether the institution turned its mind to the exercise of discretion
  2. Whether the institution considered all relevant factors in the exercise of discretion
  3. Whether the institution’s decision on the exercise of discretion is justified, transparent and intelligible

References

Commissioner’s decisions

Requirements: subsection 19(1)

Personal information

Subject to subsection 19(2), the head of a government institution shall refuse to disclose any record requested under this Part that contains personal information.

Subsection 19(1) is an exemption that requires institutions to refuse to release personal information. 

To claim this exemption, institutions must meet all the following requirements:

  1. The information is about an individual—that is, a human being, not a corporation.
  2. There is a serious possibility that disclosing the information would identify that individual.
  3. The information does not fall under one of the exceptions to the definition of “personal information” set out in paragraphs 3(j) to 3(m) of the Privacy Act.
     

The onus is on institutions to establish that the exemption applies to the records. The Office of the Information Commissioner (OIC) examines the records at issue and analyzes the representations provided by the parties to assess whether the institution has properly claimed this exemption. 

1. Whether the information is about an individual

“Personal information” is defined at section 3 of the Privacy Act as “information about an identifiable individual that is recorded in any form.” In the Dagg case, the Supreme Court considered this definition to be “undeniably expansive,” and apparently aimed at capturing any information about a specific person, subject to specific exceptions. 

Examples

Examples of types of information that constitute “personal information” (and are therefore “about” individuals) are set out in paragraphs 3(a) to (i) of the Privacy Act. These examples are not exhaustive; information need not fall within one of these examples to constitute personal information.  
Examples of information “about” individuals include the following:

  • race, national or ethnic origin, religion, age and marital status;
  • medical or employment history;
  • history of financial transactions;
  • a social insurance number or bank number;
  • contact information of private sector employees (i.e. name, business title and business address);
  • personal opinions or views of individuals (with certain exceptions); and
  • names, where they appear with other personal information relating to individuals, or where disclosure of the name itself would reveal information about the individual.

A corporation, group or association is not an “individual.” Those entities may be legal “persons” but they are not “individuals.”  

Information is “about” an individual if it relates to an individual and indicates something about them; it need not reveal anything specific or sensitive. 

One consideration in determining whether information is “about” an individual, from the NAV Canada decision of the Federal Court of Appeal, is whether the information speaks to the intimacy, identity, dignity and integrity of the individual.  

In addition, it should be noted that the same information can be “about” multiple individuals.

When the information is “about” an individual, the analysis continues. The information must also meet the two requirements below in order for the institution to have validly claimed this exemption. 

2. Whether there is a serious possibility that disclosing the information would identify the individual

In cases where individuals are not named or their identity is in question, the information is considered to be about an identifiable individual if there is a serious possibility that an individual could be identified from the information itself or in combination with other available information.  

A “serious possibility” is a degree of likelihood: 

  • It does not require that disclosure of the information will identify an individual.
  • It is a degree of likelihood that is above a mere possibility or speculation, but it does not need to reach the level of being more likely than not (50% + 1). 

The scope of “other available information” for the serious possibility test depends on the specific facts of each case. In the Public Safety decision, the Federal Court found the following: 

  • It does not include information held confidentially by government.
  • It does not include information in the mind of the individual to whom the information relates, where only that individual can identify themselves (i.e. it does not include information that an individual recognizes is their own because of the knowledge they have in their own mind).
  • It does include information that is available to the general public.
  • It may include information available only to a segment of the public, depending on the context. 

Information about an object can be personal information—if this information is also about an individual and if disclosure of this information would create a serious possibility that an individual could be identified. This is necessarily a fact-driven and context-specific analysis.

An example of a serious possibility test being met is in the Gordon decision of the Federal Court. In that case, Health Canada had disclosed about 82 fields of information from the Canadian Adverse Drug Reaction Information System database, including year of birth, gender, height, weight, outcome and reaction description. However, the requester wanted one additional field that remained undisclosed: the province field. Health Canada considered this field to be personal information. The Federal Court agreed with Health Canada, finding that Health Canada had advanced “substantial evidence” that the province field was personal information because its disclosure would “substantially increase” the possibility of identification of individuals. 

Specifically, the Federal Court found that the disclosure of

  • the information at issue (the province field); combined with 
  • other available information (that is, the information already disclosed from the database and other information, e.g., information from obituaries, information known to a neighbour) 

would create a serious possibility of identification of individuals. Because of the other available information that the province field could be matched with, to identify individuals, the province field was found to constitute personal information. This idea is sometimes referred to as the “mosaic effect.”

An example of the serious possibility test not being met is the Public Safety decision. In that case, the Federal Court found that the disclosure of serial numbers of a particular type of firearm would not create a serious possibility of identification of the firearm owners. 

3. Whether the information falls under one of the exceptions to the definition of “personal information”

The exceptions set out in paragraphs 3(j) to 3(m) of the Privacy Act set limits on the definition of “personal information” for the purposes of the personal information exemption. Paragraphs 3(j), (j.1), (k) and (l) seek to make the government, and its officials and employees more accountable to the public. The 3(m) exception applies to individuals who have been dead for more than 20 years. 

Paragraph 3(j)
This is the most common exception. It applies to information about an individual who is or was an officer or employee of a government institution and that relates to the position or functions of the individual. The list of examples provided in subparagraphs 3(j)(i–v) is not exhaustive and does not limit the application of the introductory wording of 3(j). 

For paragraph 3(j) to apply, the information must relate to the position or functions held by a federal officer or employee. In the RCMP case, the Supreme Court found the following:

  • This does not include information relating to the competence and characteristics of the employee.
  • This exception applies when the information requested is sufficiently related to the general characteristics associated with the position held by an employee or the functions the employee carries out.

Examples
Examples of information found to fall within the scope of the 3(j) exception include the following: 

  • the kind of information disclosed in a job description: terms and conditions associated with a particular person, including qualifications, responsibilities, hours of work and salary range; 
  • the names of individuals on a sign-in log for a department denoting that they entered and left the workplace on weekends (Dagg); and
  • the historical postings of RCMP officers, including status, ranks achieved, years of service, and anniversary dates (RCMP).

Paragraph 3(j.1)
This exception only applies to records created on or after June 21, 2019. For such records, information revealing that an individual is or was a ministerial adviser or a member of a ministerial staff, as well as the individual’s name and title, falls within the exception. 

Furthermore, if a record created on or after June 21, 2019, reveals additional information other than the above, the exception would not apply for the additional information. For example, if a record also reveals the ministerial adviser’s or ministerial staff member’s views and opinions, or financial history, that information would constitute personal information. 

Paragraphs 3(k), 3(l), 3(m)
Paragraphs 3(k) (individual performing services under contract), 3(l) (discretionary benefit of a financial nature) and 3(m) (deceased individual) are not as commonly used as other paragraphs. 

Paragraph 3(k) applies to information

  • about an individual who is or was performing services under contract for a government institution; and
  • that relates to the services performed.  

Examples of what this exception covers are the name of the individual and the views or opinions of the individual given in the course of the performance of those services.

Paragraph 3(l) applies to information relating to any discretionary benefit of a financial nature conferred on an individual (e.g. the granting of a licence or permit), including the individual’s name and the exact nature of the benefit.  

In the Prime Minister decision, the Federal Court of Appeal found that the reimbursement of expenses that an employee incurred by virtue of being employed in a particular position, and that resulted directly from the performance of work duties, does not constitute benefits (e.g. relocation costs, travel expenses). 

Paragraph 3(m) is self-explanatory; the individual must have been deceased for more than 20 years. 

Requirements: subsection 19(2)

Where disclosure authorized

(2) The head of a government institution may disclose any record requested under this Part that contains personal information if
    (a) the individual to whom it relates consents to the disclosure;
    (b) the information is publicly available; or
    (c) the disclosure is in accordance with section 8 of the Privacy Act.

If the requirements of subsection 19(1) are met, institutions must then consider whether the following circumstances exist:

  1. The person to whom the information relates consents to its release.
  2. The information is publicly available.
  3. Disclosure of the information would be consistent with section 8 of the Privacy Act.

The standard for considering whether these circumstances exist is reasonableness; that is, institutions are under a positive obligation to take reasonable measures to ascertain whether these circumstances exist.  

If these circumstances exist, then subsection 19(2) requires institutions to reasonably exercise their discretion to decide whether to release the information. (See “Exercise of discretion,” below.)  

1. Whether the person to whom the information relates consented to its release

The institution must make reasonable efforts to seek the consent of the individual to whom the information pertains. The onus is on the institution to demonstrate that they have tried to seek this consent, or explain why they have not done so.

In the Fontaine decision, the Federal Court of Appeal found that, at most, it is an obligation of means, institutions must make reasonable efforts to seek consent of individuals. The Court also found that, in that case, the RCMP was not required to seek consent of a considerable number of individuals involved in a large-scale police investigation.

There are a few circumstances when it may not be reasonable to seek consent: when there are a very large number of individuals involved; when, in sensitive situations, it is very unlikely that consent would be obtained; or when locating individuals is likely unfeasible. However, in other instances where such difficulties are not present, and there is only one or a few individuals who can easily be located, reasonable efforts will often require that consent be sought.

2. Whether the information is publicly available

The institution must reasonably consider whether the personal information is publicly available. This does not require the institution “to search every possible source before determining whether personal information is publicly available” (Federal Court’s decision in Natural Resources). However, the institution must act reasonably in the circumstances when determining whether it has discretion to disclose under paragraph 19(2)(b). 

The meaning of “publicly available”

There are multiple definitions of “publicly available.” In Lukács, the Federal Court of Appeal found that it meant “available to the citizenry at large.” In Minister of Industry, however, the majority of the Federal Court of Appeal found that it included information available to a segment of the population—and not necessarily the entire population. Institutions’ decisions to use either definition, in determining whether they have the discretion to disclose under paragraph 19(2)(b), may be reasonable.

Certain provisions of the Corrections and Conditional Release Act state that, in the context of parole hearings, certain information is not “publicly available” within the meaning of paragraph 19(2)(b).

Personal information that has been inadvertently disclosed publicly is generally not considered to be publicly available for the purposes of paragraph 19(2)(b).

Complex cases: determining what, exactly, is the personal information

Determining whether personal information is publicly available, requires careful attention to what, exactly, is the personal information in question. Records can contain multiple types of personal information. 

Consider the example of an email chain between a private sector employee and a government institution. The private sector employee’s name and email address would reveal where they work, and potentially their position title, which would meet the definition of personal information. If that same information—that is, the link between the employee, their employer, and their position title—is publicly available on LinkedIn, the personal information would appear to be publicly available within the meaning of paragraph 19(2)(b). 

However, the private sector employee’s name and email address, as they appear on the email chain, may potentially reveal additional personal information, depending on the context of the email chain. This additional information that would be revealed about the private sector employee may not be publicly available (e.g. details about specific work done by the employee that are not captured by their publicly available position title, or personal views or opinions that are not publicly available). In such instances, it may be reasonable for an institution to conclude that the personal information is not publicly available. 

In the Husky and Suncor decisions, the Federal Court of Appeal determined that the names and job titles of private sector employees on administrative documents could be released by the Canada–Newfoundland and Labrador Offshore Petroleum Board under paragraph 19(2)(b). The names of employees, their job titles and their relationship with their employer (Husky and Suncor) were publicly available on either LinkedIn or ZoomInfo. Husky and Suncor argued that the administrative documents revealed additional personal information about the employees than what was publicly available, and that the Board therefore did not have the discretion to disclose this information under paragraph 19(2)(b). The Federal Court of Appeal rejected this argument, because Husky and Suncor had not shown that there was any additional personal information that was not publicly available.  
The question in complex cases will often be whether the record at issue, containing personal information, reveals more personal information than is already publicly available. 

3. Whether the disclosure is in accordance with section 8 of the Privacy Act. 

Section 8 of the Privacy Act sets out specific circumstances in which personal information can be disclosed without the consent of an individual. The institution must reasonably consider whether the disclosure of information would be in accordance with this section. 

The vast majority of the circumstances set out in section 8 of the Privacy Act are usually not relevant in the context of paragraph 19(2)(c). As found by the Federal Court in the Public Safety decision, institutions need not provide explanations for each circumstance provided for in section 8 of the Privacy Act, where it is clear that most have no application at all. 

The most commonly used provision for disclosure under paragraph 19(2)(c) is subparagraph 8(2)(m)(i) of the Privacy Act, which permits disclosure where both of the following conditions are met: 

  • There is a public interest in the disclosure (meaning a greater interest than the requester’s private interest in the information being released).
  • This public interest in disclosure clearly outweighs the invasion of privacy that would result from disclosure.

The privacy interest forms part of the balancing exercise described in the second bullet point above to determine the extent to which privacy can be invaded. In the Ruby decision, the Federal Court of Appeal found that the privacy interest can be considered in two different ways: 

  • in a specific manner—focussing on the privacy interest of the individual in question; and/or
  • in a general manner—focussing on the privacy interest as a general objective for society, without reference to a specific individual. 

As determined by the Federal Court in the Public Safety decision, an institution must provide a sufficiently transparent and intelligible explanation of why it considers that the public interest does or does not clearly outweigh the relevant invasion of privacy. However, this explanation need not be extensive or detailed.  

Exercise of discretion

If one of the circumstances in subsection 19(2) exists, the institution must demonstrate that it reasonably exercised its discretion in deciding whether to release the information. 

The exercise of discretion should be evaluated with deference to the institution. Deference means restraint and respect for the institution in evaluating a decision that the Act empowers the institution to make.  

When evaluating the exercise of discretion, the following issues should be determined: 

  1. Whether the institution turned its mind to the exercise of discretion
  2. Whether the institution considered all relevant factors in the exercise of discretion
  3. Whether the institution’s decision on the exercise of discretion is justified, transparent and intelligible

1. Whether the institution turned its mind to the exercise of discretion

The OIC must be satisfied that the institution understood that it had discretion and then exercised that discretion. This determination is to be made on the evidence and representations before it.  

2. Whether the institution considered all relevant factors in the exercise of discretion

Relevant factors that must be considered include the following: 

  • the purpose of the Act 
  • the purpose of the exemption claimed 
  • the public interest in disclosure 
  • the risk of harm from disclosure. 

This list is not exhaustive; the existence of other relevant factors will depend on the circumstances of each case. 

The OIC must be satisfied, based on the evidence and representations before it, that all relevant factors were considered. This requires more than a boilerplate declaration by the institution that all relevant factors were considered, but it need not require a detailed analysis of each and every factor and how they were weighed against each other (Federal Court of Appeal in the Prime Minister decision). 

Put another way, the institution does not have to explain in full detail that it considered factors x, y and z, assigned particular weighting to each factor and then exercised its discretion by deciding to disclose or not.  

Instead, the OIC may infer from the evidence before it that the institution considered relevant factors even if it did not expressly discuss them in its representations. 

Apart from relevant factors, no irrelevant or improper factors can be considered in an exercise of discretion, including potential embarrassment to an institution. 

3. Whether the institution’s decision on the exercise of discretion is justified, transparent and intelligible

It is possible to determine by inference whether the institution’s decision on the exercise of discretion is justified, transparent and intelligible, based on the evidence and representations before the OIC. Justification, transparency and intelligibility notably require:

  • that the reasoning behind the exercise of discretion be discernible, rational and logical in the circumstances;
  • evidence on who exercised discretion and their authority to do so;
  • the factors that were considered in this exercise; and 
  • the reasons why the decision was made—as found by the Federal Court of Appeal in the Prime Minister decision.  

The decision of the institution is to be evaluated as a whole—including its rationale and outcome.

References

Commissioner’s decisions

  • Consult the Commissioner’s decisions on the OIC website.
     
Date modified:
Submit a complaint