Dernières décisions

This final order determines whether the college conducted a reasonable search for responsive records in response to Interim Order PO-4512-I. In compliance with the Interim Order, the college conducted further searches and provided four affidavits in support of its searches. The adjudicator finds that the college provided sufficient evidence to establish that it has conducted a reasonable search for responsive records. The appeal is dismissed.

On April 2, 2024, an individual asked the ministry for records between it, the staff of three private sector beverage companies, and the Beer Store since 2018. On May 1, 2024, the ministry provided the appellant with a fee estimate and on June 5, 2024, the appellant paid a deposit. Upon payment of the deposit, the ministry claimed a time extension of 240 days under section 27(1) of the Act until February 3, 2025. This order partly upholds the ministry’s decision to claim a time extension, but reduces it from 240 days to 223 days, and orders the ministry to issue a final access decision by January 14, 2025.

A company submitted a request for reconsideration of Order MO-4507, where the adjudicator upheld the city’s decision to withhold a report under the closed meeting exemption. The company claimed that there was a fundamental defect in the adjudication process.
In this reconsideration order, the adjudicator finds that neither a fundamental defect in the adjudication process nor any of the other grounds for reconsideration under section 18.01 of the IPC’s Code of Procedure has been established and denies the request for reconsideration.

An individual made a request to the Ministry of the Solicitor General under the Freedom of Information and Protection of Privacy Act for records of entities that have queried or accessed a specified OPP file. The ministry initially refused to confirm or deny the existence of the requested records (section 14(3)) but subsequently provided the requester with access to part of a record.
The requester believes that additional records regarding queries of and accesses to the OPP file ought to exist and challenged the reasonableness of the ministry’s search.
In this interim order, the adjudicator finds that the ministry has not provided sufficient evidence to demonstrate that reasonable efforts have been made to conduct a search for the records the appellant is seeking. The adjudicator orders the ministry to conduct a further search for records and to provide affidavit evidence explaining its searches.

A person asked the Barrie Police Services Board for a report related to the death of the person’s parent. The police gave the person partial access to two records. The police denied access to some information in the records because they contain another person’s personal information [section 38(b)]. The person seeks full access to one of the records.
The adjudicator agrees with the police’s decision not to share some information in the record at issue and dismisses the appeal.

An individual requested access from a social services administration board (the board) to all records relating to an apartment unit, including complaints, emails or other correspondence. The board denied access to the records, claiming the personal privacy exemptions. In this order, the adjudicator finds the records are exempt under the personal privacy exemptions because disclosure of the personal information in those records would be an unjustified invasion of personal privacy. She upholds the institution’s decision not to disclose them and dismisses the appeal.

This order resolves two related appeals. Under the Municipal Freedom of Information and Protection of Privacy Act, an individual requested access to records relating to his name being searched through the databases of the Niagara Police Services Board (the police), including the reasons that his name was being searched and underlying associated records. In response to one request, the appellant received access to some information; in response to the other, he was told that there were no responsive records. The requester challenged the reasonableness of the police’s searches because he believed other records should exist. In this order, the adjudicator upholds the reasonableness of the police’s search efforts and dismisses the appeals.

An individual submitted a request for reconsideration of Order MO-4560, which partly upheld the city’s access decision. With respect to the issue of the city’s custody or control of responsive records, the adjudicator found in Order MO-4560 that the city had custody or control over communications between city staff but not over communications between elected officials (including the mayor). The requester claimed that there was a fundamental defect in the adjudication process because the order did not address any communications that may have occurred between city staff and elected officials (including the mayor).
The adjudicator allows the reconsideration of Order MO-4560. As the issue of reasonable search was not addressed in Order MO-4560, the adjudicator finds that there was a fundamental defect in the adjudication process.
Further in this order, the adjudicator finds that the city conducted a reasonable search for records of communications between city staff and elected officials (including the mayor). As no responsive records between city staff and elected officials (including the mayor) exist, the adjudicator makes no finding on the city’s custody or control over such records.

The Sault Ste. Marie Police Services (the police) reported to the Office of the Information and Privacy Commissioner of Ontario that their network servers were infected with ransomware and that, as a result, records of personal information stored on data drives on the servers were encrypted.

In response, the police took steps to contain, investigate, remediate and inform local residents about the ransomware attack. However, the police did not believe that the attack resulted in a privacy breach because their investigation determined that the information was encrypted in place, and neither obtained or exfiltrated by the threat actor.

In this report, I find that the threat actor’s encryption of the data drives affected the personal information stored on them by making this information inaccessible to the police. I also find that the ransomware attack resulted in an unauthorized use of personal information and, therefore, a privacy breach under the Municipal Freedom of Information and Protection of Privacy Act.

I am satisfied with the steps taken by the police to contain the breach. Although the police informed the public of the breach through a press release issued at the time of the ransomware attack, I find that there would be no useful purpose in deciding whether they should renotify affected individuals given the passage of time since the breach. I am not entirely satisfied with the police’s investigative and remedial steps because they have not reviewed their policies and practices in protecting personal information. As such, I find that the police have not responded adequately to the breach and recommend that they conduct this review.

Further, it appears that the police understand the nature of their information holdings, the threats posed by ransomware attacks and the steps required to mitigate these attacks. However, despite requests, the police did not provide this office with materials relating to their privacy training practices and, therefore, I could not evaluate the reasonableness of these practices which are important for reducing the risk of a threat actor gaining unauthorized access to an institution’s records. Because of this, I am not satisfied that the police haves reasonable measures in place to prevent unauthorized access to records as required by section 3(1) of Regulation 823 under MFIPPA (security of records) and recommend that they ensure that their training materials comply with this section.

A requester asked the hospital for video surveillance footage after his visit to the hospital. The hospital found several hours of video footage, but stated that some of the requested footage had been deleted in accordance with its retention policy. The requester complained about the hospital’s response to the IPC, stating that it had improperly deleted the footage. The fee the hospital was charging for the footage, and the hospital refusing a fee waiver, was also disputed in the complaint.
In this decision, the adjudicator finds that the hospital did not improperly delete the video footage, and he upholds the hospital’s fee and denial of a fee waiver. He dismisses the complaint.

In a request made under the Freedom of Information and Protection of Privacy Act, an individual asked the ministry for records of the Ontario Provincial Police that relate to him. The ministry provided access to the records in part. It did not disclose some information saying that it contained the personal information of the appellant (section 49(a)), that, if disclosed could facilitate the commission of an unlawful act (section 14(1)(l)). It also said that disclosure would result in an unjustified invasion of the personal privacy of individuals other than the appellant (section 49(b)). In this order, the adjudicator finds that some of the information the ministry did not disclose should be provided to the appellant. However, he upholds the decision of the ministry not to disclose the remaining information to the appellant.

On November 5, 2023, the appellant asked the ministry for records related to vaccine passports, vaccine mandates and exemption grounds. The requester filed an appeal with the IPC because the ministry did not issue an access decision within the prescribed time limit. The decision-maker agrees that the ministry is deemed to have refused the access request under section 29(4) of the Act and orders the ministry to issue a final access decision by December 27, 2024.

The Ministry of the Solicitor General (the ministry) received a request under the Freedom of Information and Protection of Privacy Act (the Act) for a police report relating to the suicide of an individual. The request was made by the sister of the deceased. The ministry decided to disclose parts of the police report to the requester for compassionate reasons, under section 21(4)(d) of the Act, but not the rest of the report. The requester did not appeal the ministry’s decision to withhold the rest of the report, but the widower of the deceased appealed the ministry’s decision to disclose any information about his late wife. In this order, the adjudicator upholds the ministry’s decision and dismisses the appeal.

An individual made two requests under the Freedom of Information and Protection of Privacy Act for access to the call logs from the Premier of Ontario’s (the Premier’s) personal cell phone. Cabinet Office denied the individual access to the call logs, claiming it does not have custody or control of them. In this order, the adjudicator finds some of the entries in the call logs are under Cabinet Office’s control. She orders Cabinet Office to obtain these entries from the Premier and issue an access decision to the appellant.

The appellant sought access under the Municipal Freedom of Information and Protection of Privacy Act for records related to the construction of a residential pool and related structures. The City of Mississauga (the city) denied access to records and portions of the records on the basis that they contain third party information (section 10(1)), information that is subject to solicitor-client privilege (section 12), and information that, if disclosed, would be an unjustified invasion of personal privacy (section 14(1)).