2008-2009 Noteworthy investigations
| Previous | Table of contents | Next |
Each year, a number of our investigations stand out from the others for one reason or another. Often it is their complexity or the light they shed on the access to information system that makes them noteworthy.
In addition to responding to access to information requests in a timely manner, institutions have an obligation to make every reasonable effort to help requesters get the information they seek. This “duty to assist” became an obligation under the Access to Information Act in 2007. A number of investigations in 2008–2009 uncovered instances of institutions not fully living up to that obligation.
“Double Double”
This investigation showed what some institutions are doing, against the spirit of the Act, to buy time to respond to requests.
Background
Subsection 9(1) of the Act allows institutions to extend the time limit to respond to a request for three reasons: the request is for a large volume of records, or requires a search through a large volume of records, and, as a result, meeting the 30-day deadline would interfere with operations; the institution needs to conduct consultations that cannot be completed within the original time limit; or the institution needs to consult a third party, which requires the institution to follow a formal notification process.
A requester asked Health Canada for drug submissions information. He subsequently complained to us about the length of a time extension Health Canada took to conduct consultations on his request. We discovered during our investigation that Health Canada had implemented a practice of claiming an extension to consult third parties (which is required to find out whether they consent to the disclosure of their information as described in subsection 20(1) of the Act) informally (citing the second reason, above) to give itself more time to complete the review of the technical records, and then take a second extension to consult the same third parties under the formal notification process.
Resolving the complaint
To evaluate whether institutions claimed the proper paragraph of section 9 for the extension, investigators usually verify the status of the organizations or individuals the institutions consulted. In this case, we also had to review the records to satisfy ourselves that the institution used the proper provision of the Act. Our review confirmed that consultations with third parties were required. However, the institution did not follow the proper process. This rendered the extension invalid, and the initial 30-day deadline remained unchanged.
Lessons learned
Although institutions need to consult third parties, it was never intended under the Act that institutions could use double extensions to give third parties more time to review records. Institutions must follow the specific process to notify third parties described in subsection 27(1), which includes claiming the extension under paragraph 9(1)(c) to consult third parties when the records pertain to section 20.
Please hold!
This investigation also uncovered innovative, but not advisable, action on the part of an institution to gain time to respond to a request.
Background
A requester complained about a 300-day time extension that Industry Canada claimed. In investigating this complaint, we discovered that the institution used “holds” during the processing of the request in order to extend the due date. The “hold” at issue was taken during the Christmas holidays and resulted in the due date being extended by two days. Industry Canada maintained that the requester had agreed to this. We could find no written confirmation of this on the file, although, when we contacted the requester, he confirmed that he had agreed to the delay.
Resolving the complaint
Our position is that an institution cannot put a request on hold for this reason. It may do so, for example, to clarify the request with the requester or when issuing a fee estimate. We informed the complainant that although we did not object to such arrangements being made with his consent, Industry Canada could not alter or modify the legal due date.
Lessons learned
While we recognize the resource shortages that lead institutions to search for creative ways to buy time in processing access requests, institutions have a legal obligation to respect the timeframes set out in the Act.
Where’s the record?
This investigation highlights the importance of regular communications between institutions and requesters—particularly when requested information is about to be published on the Web.
Background
Under section 26 of the Act, institutions may refuse to release records that they are intending to publish within 90 days of the request being made.
The requester asked Human Resources and Skills Development Canada (HRSDC) for copies of the deliverables resulting from various contracts. HRSDC refused to disclose all the requested records, since it was going to be publishing all of them within 90 days. The requester complained to us about this complete refusal.
Resolving the complaint
During our investigation, we learned that HRSDC did, in fact, publish the information requested online within 90 days of the request, which was before we received the complaint. However, HRSDC did not inform the requester of this, nor that some of the information was going to be posted on the Library and Archives Canada website.
HRSDC was of the view that it had properly applied the publication exemption and left it to us to tell the requester where he could obtain the requested information. We, in turn, informed HRSDC that it was its responsibility to inform the requester, which it did and also provided the information he had requested.
Lessons learned
We were left to wonder about the understanding institutions have of their duty to assist requesters. We believe that in circumstances such as those described here, the obligation includes the duty to inform requesters of when and how the information will be published if they know this when they refuse to disclose the information.
It’s going to cost me how much?!
We receive many complaints about fees. This investigation underlines how important it is for institutions to carefully estimate the time required to prepare records for release to ensure fees are not a barrier to access.
Background
Preparation involves severing from records information that needs to be protected when the records are released. The Act and the regulations allow institutions to charge for preparation, but do not specify what constitutes preparation time. Guidelines exist to assist institutions in making this determination.
In response to a request, the Department of National Defence (DND) asked the requester for $2,650 in preparation fees. The requester complained to us, since he felt strongly that the institution had essentially refused him access to the information he sought by charging such high fees. He also took issue with the fact that the Department did not contact him to ascertain whether he would be willing to reduce the scope of the request to reduce or eliminate the fees.
Resolving the complaint
The Department was using a benchmark of two minutes per page to prepare the requested records, while recognizing that processing varies by file. However, according to DND, the benchmark is only an estimate and so it would reimburse the requester if the processing took less time or absorb the extra costs if it was longer.
We asked DND to demonstrate the preparation process using the ATIPIMAGE software. The demonstration showed that the request could be prepared more quickly than two minutes a page. Consequently, DND reduced the fee estimate by half.
Lessons learned
Institutions have a legislated obligation to assist requesters at all stages of the access to information process. The possibility of a large fee presents the perfect opportunity for an institution to work with a requester to ensure his or her access rights are respected.
Other institutions, including the Department of Foreign Affairs and International Trade Canada (DFAIT), are closing or abandoning requests when they do not hear back from requesters within a certain timeframe after issuing fee estimates. In some instances, however, the institutions waited months or years before sending the estimates, while having little or no contact with the requesters in the meantime.
We are currently investigating complaints against DFAIT dealing with preparation fees and are monitoring practices in other institutions.
Due diligence in the digital world
The investigation highlights the need for institutions to take considerable care when introducing new technology or processes for responding to requests.
Background
Along with several government institutions, Public Works and Government Services Canada (PWGSC) frequently discloses information electronically. In August 2007, PWGSC became aware that information it redacted from documents and provided in electronic format to requesters might have been at risk of being recovered by individuals with technical expertise. We were asked to investigate when the legal representative of a company complained that its client might have incurred serious commercial damages as a result of the possible breach.
Resolving the complaint
With PWGSC’s cooperation, we confirmed that a problem had, indeed, occurred with the transfer of information onto CD-ROM. As soon as PWGSC had become aware of the problem, it had stopped the practice of transferring information onto CD-ROM and had undertaken a full review of its processes. It had also identified 138 files that might have been at risk and reviewed all of the documents to assess the level of risk for each one. It had then notified all of the affected parties and, whenever possible, retrieved the CD-ROMs, and provided the requested records again.
We reported to the complainant that, although an error had occurred in the exporting of information onto CD-ROM, PWGSC had since changed its practice of burning CD-ROMs and was now using an appropriate format. We also reported that the potential disclosure of the client’s information by PWGSC in the three access requests concerned was due to a technical error and, as such, was inadvertent and unintentional. In summary, our investigation satisfied us that PWGSC had provided timely notice of the potential disclosure, that it had properly and fully investigated the matter, and that it had taken the necessary steps to correct the problem.
Lessons learned
Government institutions continuously search for ways to process access requests in the most efficient and timely manner. Burgeoning technology in the area of electronic document redaction has provided institutions with a faster, more efficient way to remove sensitive information from documents. However, the complexity of electronic document formats increases the possibility that information exported to CD-ROM may retain sensitive information. The incident at PWGSC indicates that the potential for inadvertent disclosure of sensitive information is real.
While advancements in technology can prove useful, institutions must carefully assess and mitigate risks before introducing new software and procedures. To underline the importance of this, the Treasury Board Secretariat sent an information notice to all access to information and privacy directors on October 12, 2007. The notice alerts institutions to the potential risks of using electronic document redaction and urges institutions to ensure that they carefully test software and follow procedures governing its use to prevent the inadvertent disclosure of sensitive information.
Communication is key
This investigation highlights most clearly the potential consequences of poor communications between institutions and requesters.
Background
This investigation concerned a request that the Department of National Defence (DND) received for a large number of records which resulted in a $500 preparation fee. The requester refused to pay the fee and abandoned the request, but only after the access to information office had sought and received the records from departmental officials.
The requester then made 37 new requests for the same or similar information. Upon receipt of these requests, DND claimed an extension under paragraph 9(1) (a) of the Act on the grounds that it had already sent the records back to the originating office and implying that meeting the original deadline, given the large number of records involved, would interfere with its operations.
A few days later, the requester submitted 13 more requests for the records that were the subject of the first request. In response, DND advised the requester that it considered these records to be duplicates of those subject to the 37 requests. Therefore, it would respond to the most recent requests based on responses to the previous ones, and would abandon the last 13 requests submitted. The requester complained to the Information Commissioner about the processing of his requests.
The institution admitted during the course of the investigation that if it had had a better relationship with the requester, it would have been able to resolve some of the issues before he complained.
Resolving the complaint
The requester admitted that his motivation for abandoning his initial request was to be able to take advantage of the five free hours the Act allows per request by separating the requests. We dealt with whether this is allowed in our 1994–1995 annual report, concluding that as long as all of the requirements for a valid request exist, the institution must accept the individual requests. In the current case, then, the requester was within his rights to make other requests in place of his initial request.
The larger question is whether the institution had the right to abandon the subsequent 13 requests, claiming that they were duplicates. However, since the investigator was able to negotiate an agreement between the complainant and the institution, this question was never answered. The complainant agreed to discontinue his complaints and the institution agreed to provide a refund of $65 in the form of a “credit” towards the complainant’s next 13 requests.
Lessons learned
Although the complaints in this case were discontinued following a negotiated agreement between the parties, the investigation showed that when requesters and institutions refuse to communicate, the situation can escalate. Had the institution communicated with the requester in an attempt to help to reduce the $500 fee, the subsequent requests would not have been necessary. At the same time, the requester—in submitting 50 requests within a few days—stretched the limited resources of the institution, which was unable to deal with the extra workload. An efficient and workable access to information system requires both the assistance of institutions and the reasonableness of the requesters.
The GASPARD case
This investigation shows how important it is for institutions to look at the specifics of each request before deciding on a course of action.
Background
This investigation involved a request for access to all the Supreme Court of Canada and Federal Court of Canada decisions in the Department of Justice Canada’s GASPARD database—an electronic management information system that the Department uses for research in support of litigation activities. The requester asked that the 30,000-plus decisions be provided on CD-ROM.
The records the requester was seeking are available free of charge on the two courts’ websites. In light of this, the institution advised the requester that it would not be providing the records under paragraph 68(a) of the Access to Information Act, which refers to published material or material available for purchase by the public. The requester complained to the Information Commissioner about this response.
Resolving the complaint
The institution claimed that the information was free online to the public and that to produce it, it would have had to hire a consultant at a cost of approximately $10,000—a cost it was not willing to incur.
The mitigating factor in this investigation, however, was that the requester was an inmate and did not have access to the Internet. He did have access to a stand-alone computer and could therefore access information on CD-ROM. The issue that stands out, of course, is whether it could be argued that the requested information was not, in fact, available to an interested member of the public, of which the inmate was one. In the course of our investigation, the Department conceded that the information was not readily available to the requester and agreed to recalculate the cost to produce it. The investigator reviewed the new calculations, agreed they were reasonable and informed the requester.
Lessons learned
This investigation showed that institutions must be careful not to invoke an exclusion simply as a barrier to access. In this case, the information excluded was not available to the requester, although it would have been under normal circumstances. On occasion, institutions must consider the special circumstances of a request or a requester before refusing access, in order to ensure that they are truly respecting requesters’ access rights.
| Previous | Table of contents | Next |