|
|
Document
|
|
PO-2391
|
|
|
|
|
|
File #
|
|
PA-040296-1
|
|
|
|
|
|
Institution/HIC
|
|
Ministry of Consumer and Business Services
|
|
|
|
|
|
Summary
|
|
NATURE OF THE APPEAL:
The Ministry of Consumer and Business Services (the Ministry) received a request under the
Freedom of Information and Protection of Privacy Act (the Act) for the following:
Access to manuals, procedures, guides and directives, for years 1999, 2000 and
2001, dealing with the Registrar General’s Computer System, (Collection and
Storage of scanned images and data), including the implementation for year 2000
of [an identified system].
The Ministry located records responsive to the request and denied access to them on the basis of
the exemption in section 14(1)(i) (security of a system or procedure) of the Act.
The requester (now the appellant) appealed the Ministry’s decision.
Mediation did not resolve the issues in this appeal and it was transferred to the inquiry stage of
the process. I sent a Notice of Inquiry identifying the facts and issues to the Ministry initially,
and the Ministry provided representations. I then sent the Notice, along with a copy of the nonconfidential
portions of the Ministry’s representations, to the appellant, who also provided
representations in response.
RECORDS:
The records at issue relate to the computer system used by the Office of the Registrar General.
They include various user guides for collecting and keying in information, scanning documents,
and for proper installation, operation and maintenance; a workflow process description
document; and various other records relating to the system.
DISCUSSION:
PRELIMINARY ISSUES
In my cover letter to the Ministry enclosing a Notice of Inquiry, I stated that the representations
were due March 22, 2004. In accordance with this office’s usual practice, I also stated:
Should your representations not be received by the date specified in this letter, the
decision making process will proceed, and an order may be issued in the absence
of these representations.
The Ministry subsequently requested, and was granted, an extension of time to provide
representations to this office. The revised due date for representations was April 1, 2004. The
Ministry’s representations were received by this office on April 6, 2004.
In his representations, the appellant asks the question:
Did the Ministry comply with the Commission’s Procedures and submit its
representations by the due date?
- 2 -
[IPC Order PO-2391/May 16, 2005]
The appellant also suggests that I should not accept the representations of the Ministry in the
circumstances of this appeal, because they were received after the due date.
Previous orders of this office have examined the issue of whether representations received after
the due date should be considered. Senior Adjudicator David Goodis addressed this issue in
Order MO-1698 as follows:
The purpose of the paragraph [in the Notice of Inquiry referencing the
representations] is to ensure that parties are aware of the importance of providing
their representations on time, and that if they fail to do so, they risk the possibility
of an order being issued in the absence of their representations. I do not accept
the appellant’s position that, because I received the representations six days late, I
should not consider them. Under the Act, an adjudicator has the discretion to
consider late material, taking into account all of the circumstances, including any
prejudice that may accrue to either party. To act otherwise and take an overly
technical approach, in my view, would be contrary to principles of fairness and
natural justice. This approach is consistent with this office’s Code of Procedure,
which states at sections 2.03 and 2.04:
2.03 A failure to follow any procedure in this Code does not for
that reason alone render an appeal, or any step in an appeal,
invalid.
2.04 The IPC may in its discretion depart from any procedure in
this Code where it is just and appropriate to do so.
Here, the appellant did not suffer any significant prejudice by the relatively short
delay in the process. On the other hand, should I not consider the Police’s
representations, it may put me in a position of having to reject the exemption
claim for lack of evidence, leading to an order to disclose the record, where I
might reach a different result should I consider that material. In my view, the
potential prejudice to the Police clearly outweighs any prejudice to the appellant.
Accordingly, I do not accept the appellant’s request that I not consider the
Police’s representations.
I adopt the approach taken tot his issue in MO-1698 and apply it in this appeal. In this appeal,
the appellant did not suffer any significant prejudice by the relatively short delay in the process,
and, if I were not to consider the Ministry’s representations, it may put me in a position of having
to reject the exemption claim for lack of evidence, where I might reach a different result should I
consider that material. In my view, the potential prejudice to the Ministry clearly outweighs any
prejudice to the appellant, and I will consider the Ministry’s representations.
In addition, the appellant takes the position that the Ministry’s decision letter is inadequate as it
did not identify specifically the name and position of the person responsible for making the
- 3 -
[IPC Order PO-2391/May 16, 2005]
decision, as required by section 29(1)(b)(iii) of the Act. However, since this issue was not raised
in the earlier stages of this appeal, and the Ministry has not had the opportunity to address it, I
will not be reviewing it. In any event, even if the appellant were correct, in the circumstances of
this appeal, I would have seen no useful purpose in requiring the Ministry to provide a new
decision letter to the appellant to address this inadequacy, or in providing any other remedy at
this stage in the processing of the appeal (See Order MO-1731).
ENDANGER SECURITY
Introduction
The Ministry claims that the records are exempt under section 14(1)(i), which reads:
A head may refuse to disclose a record where the disclosure could reasonably be
expected to,
Endanger the security of a building or the security of a vehicle
carrying items, or of a system or procedure established for the
protection of items, for which protection is reasonably required;
To meet the test under section 14(1)(i), the Ministry must provide “detailed and convincing”
evidence to establish a “reasonable expectation of harm”. Evidence amounting to speculation of
possible harm is not sufficient [Order PO-2037, upheld on judicial review in Ontario (Attorney
General) v. Goodis (May 21, 2003), Toronto Doc. 570/02 (Ont. Div. Ct.), Ontario (Workers’
Compensation Board) v. Ontario (Assistant Information and Privacy Commissioner) (1998), 41
O.R. (3d) 464 (C.A.)].
It is not sufficient for an institution to take the position that the harms under section 14 are selfevident
from the record or that a continuing law enforcement matter constitutes a per se
fulfilment of the requirements of the exemption [Order PO-2040; Ontario (Attorney General) v.
Fineberg].
Generally, the law enforcement exemption must be approached in a sensitive manner,
recognizing the difficulty of predicting future events in a law enforcement context [Ontario
(Attorney General) v. Fineberg (1994), 19 O.R. (3d) 197 (Div. Ct.)].
Representations
The Ministry begins by identifying that the request is for information concerning the computer
operating system used by the Office of the Registrar General (the ORG). The Ministry identifies
the broad range of information administered by the ORG under the Vital Statistics Act, which
requires a uniform system of registration for all vital events that occur in Ontario (including
births, deaths, marriages, stillbirths, adoptions and changes-of-name). The Ministry also
identifies
- 4 -
[IPC Order PO-2391/May 16, 2005]
identifies the vast number of registration documents the ORG has in its custody (more than 20
million documents), and that the documents contain the personal information of Ontarians.
The Ministry takes the position that the release of any or all of the records requested could
reasonably be expected to endanger the security of the ORG’s computer systems and/or its
operational procedures. The Ministry states that these systems and procedures protect the
personal information in the custody of the ORG.
In support of its position, the Ministry provides an affidavit sworn by the Chief Security Officer
for the ORG, who identifies the broad nature of the registration information which the ORG is
responsible for. He also describes the nature of the information contained in the systems
manuals requested in this appeal – that they contain detailed and specific information about the
ORG’s computer operations, including sensitive login procedures, diagrams, screen
reproductions and step-by-step instructions. Furthermore, the affidavit identifies the security
arrangements in place for these records, and that access to these records is very limited, even
within the Ministry.
The Ministry also refers to previous orders of this office which have found that information
pertaining to computer and operating systems can qualify for exemption under section 14(1)(i).
It refers to Orders P-1078, P-874, P-756 and P-649 in support of its position.
Finally, with respect to the question of whether portions of the records could be made available,
the Ministry takes the position that this is not an appropriate case for severance of the records, as
very little material could be disclosed, and “the appellant would be left with nonsensical
material.”
The appellant takes the position that the disclosure of the requested records could not result in
the anticipated harm. In support of his position, the appellant refers to articles available to the
public which he states provide a description of the records requested, and he attaches copies of
those articles to his representations. He states that the identity of the supplier of the computer
system and the nature of the specific software used is generally known, and refers to this
information in both his request letter and his representations. The appellant also states that the
computer system and related software has been described as an “out of the box” product. In his
view, the records requested relate to general information about a computer system that is used by
many companies worldwide. He states:
The Registrar General’s Office is just 1 of 1300 companies worldwide and their
employees, not to mention the 4000 employees at [the computer supplier
company] that would have access to these or similar type manuals for the …
software.
- 5 -
[IPC Order PO-2391/May 16, 2005]
Findings
I have carefully reviewed the representations, as well as the records at issue in this appeal, which
relate to the computer system used by the ORG and contain detailed, specific information about
this system including login procedures, disgrams, screen reproductions and step-by-step
instructions.
With respect to the information stored in the computer system, the Ministry identified that this
information consists of a broad range of personal information of Ontarians administered by the
ORG under the Vital Statistics Act, including specific information about individual births, deaths,
marriages, stillbirths, adoptions and changes-of-name. I am satisfied that the protection of this
information is reasonably required, including protection from tampering or unauthorized
modification.
Furthermore, I am satisfied that the records at issue relate to the security of a system as well as a
procedure established for the protection of the information contained in the system. The
Ministry identifies that one of the reasons the computer system and the operational procedures
were put in place by the Ministry was to protect the specific information in the system. The
affidavit provided by the Ministry also identifies the security arrangements in place for these
records.
Finally, I am satisfied that disclosure of the records could reasonably be expected to endanger the
security of the system or procedure established for the protection of the information. The records
contain detailed, specific information about this system and the operational procedures including
sensitive login procedures, diagrams, screen reproductions and step-by-step instructions, as well
as information about the security of the system itself.
With respect to the appellant’s contention that the records merely relate to general information
about a computer system that is used by many companies worldwide, my review of the records
has confirmed that they relate to the specific system used by the ORG for the information it is
responsible for under the Vital Statistics Act, and is not the sort of generic information referred to
by the appellant.
Accordingly, I am satisfied that the disclosure of the records could reasonably be expected to
endanger the security of a system or procedure established for the protection of the information
contained in the system, for which protection is reasonably required, and that section 14(1)(i)
applies to the records.
Additional Issue
As a final matter, the appellant takes the position that the Ministry improperly relies on two
different parts of the section 14(1)(i) exemption, and argues that the Ministry cannot do so. He
refers to the Ministry’s representations which state that the exemption in section 14(1)(i) applies
because the disclosure of the record “could reasonably be expected to endanger the security of
the ORG’s computer systems and/or its operational procedures” (emphasis added). The
- 6 -
[IPC Order PO-2391/May 16, 2005]
appellant then identifies that the exemption in section 14(1)(i) refers to endangering “the security
of a building or the security of a vehicle carrying items, or of a system or procedure…”. The
appellant states that, by referring to the disclosure of the information as endangering the security
of a system and/or a procedure, the Ministry is adding to the clear wording of the Act, which it
cannot do.
I do not accept the appellant’s position.
The meaning of the word “or”, as it is found in legislative contexts, has been reviewed in a
number of court decisions and legal texts. These confirm that the word “or” is presumed to be
inclusive, unless this presumption is clearly rebutted. The way in which the word “or” has been
interpreted is succinctly set out by Ruth Sullivan in her textbook entitled Statutory Interpretation
(Faculty of Law, University of Ottawa. (C) 1997 Irwin Law Inc.) as follows:
In most legislative contexts, the “and” is joint rather than joint and several. To
express the idea of “and/or”, the inclusive “or” is normally used.
“Or” is always disjunctive in the sense that it always indicates that the things
listed before and after the “or” are alternatives. However, “or” is ambiguous in
that it may be inclusive or exclusive. In the case of the exclusive “or”, the
alternatives are mutually exclusive: (a) or (b), but not both; (a) or (b) or (c), but
only one of them to the exclusion of the others. In the case of the inclusive “or”,
the alternatives may be cumulated: (a) or (b) or both; (a) or (b) or (c), or any two,
or all three.
Like the joint and several “and”, the inclusive “or” expresses the idea of “and/or.”
…
In legislation, “or’s” are presumed to be inclusive, but the presumption is rebutted
where it is clear from the context that the listed alternatives are meant to be
mutually exclusive. For example, many Criminal Code provisions sa that a
person who acts in a certain way is guilty of an indictable offence and is liable to
imprisonment for a stipulated number of years or is guilty of an offence
punishable on summary conviction. In this context, in keeping with normal
practice, the “and” is joint: the person is both guilty of an offence and liable to
punishment. However, the presumption of inclusive “or” is rebutted. Since the
same Code violation cannot be treated as both an indictable and a summary
conviction offence, the “or” in this provision is exclusive: an indictable offence or
a summary conviction offence, but not both.
I adopt the above interpretation of the word “or” in the circumstances of this appeal and with
respect to that word as found in section 14(1)(i). In my view it is clear that the word “or” found
in that section is meant to be inclusive. The nature of the exemption and the harms it seeks to
protect, as well as the wording of the exemption support such a finding, and there is nothing in
the wording or the context of the section to rebut the presumption that the word “or” is meant to
- 7 -
[IPC Order PO-2391/May 16, 2005]
|
|
|
|
|
|
Legislation
|
|
|
|
|
|
|
|
Subject Index
|
|
|
|
|
|
|
|
Signed by
|
|
Frank DeVries
|
|
|
|
|
|
Published
|
|
May 16, 2005
|
|
|
|
|
|
Type
|
|
Order
|
|
|
|
|
|
<<
Back
|
|
|