12 COMITÉ DES FINANCES ET DU 3. 2014 YEAR-END MFIPPA REPORT - SUMMARY RAPPORT DE FIN D ANNÉE SUR L APPLICATION DE LA LAIMPVP SOMMAIRE 2014 COMMITTEE RECOMMENDATION That Council receive this report for information. RECOMMANDATION DU COMITÉ Que le Conseil municipal prenne connaissance de ce rapport. DOCUMENTATION / DOCUMENTATION M. Rick O Connor, City Clerk and Solicitor, report dated March 30, 2015 (ACS2015- CMR-CCB-0050) M. Rick O Connor, Greffier municipal et chef du contentieux, rapport daté du 30 mars 2015 (ACS2015-CMR-CCB-0050)
13 COMITÉ DES FINANCES ET DU Report to Rapport au: Finance and Economic Development Committee Comité des finances et du développement économique 7 April 2015 / 7 avril 2015 and Council et au Conseil 15 April 2015 / 15 avril 2015 Submitted on March 30, 2015 Soumis le 30 mars 2015 Submitted by Soumis par: M. Rick O Connor, City Clerk and Solicitor / Greffier et Chef du contentieux Contact Person Personne ressource: M. Rick O Connor, City Clerk and Solicitor / Greffier et Chef du contentieux 613-580-2424, x. 21215, Rick.Oconnor@ottawa.ca Ward: CITY WIDE / À L'ÉCHELLE DE LA VILLE SUBJECT: 2014 Year-End MFIPPA Report - Summary File Number: ACS2015-CMR-CCB-0050 OBJET: Rapport de fin d année sur l application de la LAIMPVP Sommaire 2014
14 COMITÉ DES FINANCES ET DU REPORT RECOMMENDATION That the Finance and Economic Development Committee recommend Council receive this report for information. RECOMMANDATION DU RAPPORT Que le Comité des finances et du développement économique recommande que le Conseil municipal prenne connaissance de ce rapport. BACKGROUND The Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) applies to all local government institutions, including: municipalities; police services boards; public library boards; conservation authorities; and boards of health as well as other local boards. The dual purposes of the legislation are as follows: (1) to provide a right of access to information held by the institutions; and (2) to protect the privacy of individuals with respect to personal information. As such, MFIPPA sets out rules and regulations by which municipal institutions must abide in order to protect the privacy of an individual's personal information in government records. This includes rules regarding the collection, use, disclosure and disposal of personal information in the custody and control of a municipal institution. These obligations are balanced with the right to access municipal government information, including most general records and records containing an individual s personal information, subject to very specific and limited exemptions. As an institution defined under the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), the City is required to appoint a Head of the institution who is responsible for overseeing the administration of and for decisions made under the statute. At the City of Ottawa, the City Clerk and Solicitor has been designated as the head of institution for these purposes. In addition to the responsibilities under MFIPPA, the City Clerk and Solicitor also administers access requests related to the Personal Health Information Protection Act, 2004 (PHIPA). This legislation establishes rules for the collection, use and disclosure of
15 COMITÉ DES FINANCES ET DU personal health information for the Health Information Custodians (HICs) operating within the Province of Ontario. In keeping with the general principles outlined in the City s Accountability and Transparency Policy that, every new delegation of power authority will have a corresponding accountability mechanism, the purpose of this annual report is to outline the operations and responsive metrics of the Access to Information and Privacy (ATIP) Office in the City Clerk and Solicitor Department. For comparative purposes, data is being provided for 2012 through to 2014. DISCUSSION Requests for Access to Information As noted in prior year-end reports to Committee and Council, requests for access to general and personal information are received and processed pursuant to Part I of MFIPPA. Similarly, access to an individual s own personal health information under the custody and control of one of the City s Health Information Custodians (e.g. Public Health, Paramedic Services, etc.) are prescribed under Part V of PHIPA. In 2014, the City received a total of 927 requests for access to records. Of these, 700 were for general records, which represents a decrease of almost 7.3% over 2013 (755 requests). However, 215 requests were for personal information, which represents an increase of 187% over 2013 (75 requests). Furthermore, 12 were PHIPA requests, which represents a 25% decrease over 2013 (16 requests). While the number of requests for general information has continued to decrease since 2012, there has been a significant increase in the number of requests for personal information. This trend is discussed in greater detail later in the report. In responding to access requests, the ATIP Office reviewed 51,542 pages of records in 2014, a decrease of approximately 2% over 2013 (52,520 pages) but an increase of approximately 6% over 2012 (48,522 pages). Of the pages reviewed, the ATIP Office released 42,036 pages in 2014, a decrease of 7.6% over 2013 (45,501 pages) but an increase of more than 16% over 2012 (36,121 pages).
16 COMITÉ DES FINANCES ET DU Compliance Rate The statutory timeframe for responding to access requests is 30 days without an extension. For the 2014 reporting year, 467 requests for access to general records (71%) were completed within the 30-day timeframe, the same ratio as in 2013. However, where extensions on time limits were applied due to either the requirement for external consultation or the complexity of the request, the compliance rate was approximately 91%, which represents a 6% improvement over 2013. Set out below in Table 1 is data with respect to requests for access to general records from 2012 to 2014. Table 1 - Access to General Records Requests for access to General Records 2014 2013 2012 Number of new formal requests received 700 755 855 Number of formal requests completed 681 741 854 Number of formal requests completed within 30 days Number of formal requests completed within statutory timeframe with time limit extensions 497 537 660 638 629 792 % of formal requests completed within 30 days 71% 71% 77% % of formal requests completed within statutory timeframe with time limit extensions 91% 85% 93% With respect to requests for access to personal information, in 2014, 210 requests (80%) were completed within the 30-day timeframe, which represents a 7% increase over 2013. However, where extensions on time limits were applied due to either the requirement for external consultation or the complexity of the request, the compliance rate was approximately 92.5%, which represents a 9.5% improvement over 2013. As noted earlier in this report, the City has experienced a 187% increase in the number of requests for access to personal information. Personal information is defined in the
17 COMITÉ DES FINANCES ET DU statute as recorded information about an identifiable individual including, among other things, information related to race, national or ethnic origin, colour, religion, age, sex, sexual orientation, marital or family status, as well as education, medical, criminal or employment history or an individual. Upon review, it is suggested that this increase can be primarily attributed to two factors: the fact that beginning in 2014, the Office of the Information and Privacy Commissioner of Ontario (IPC) changed the definition of personal files to include any records related to an individual s property (ex. building permits, property assessments, etc.); and an increase in the practice of personal injury law firms requesting access to the personal records of clients. Staff estimates that the latter accounts for approximately 75% of the increase over the previous year or about 90 requests. Set out below in Table 2 is data with respect to requests for access to own personal records from 2012 to 2014. Table 2 - Access to Own Personal Information Requests for access to Own Personal Information 2014 2013 2012 Number of new formal requests received 215 75 35 Number of formal requests completed 210 70 35 Number of formal requests completed within 30 days Number of formal requests completed within statutory timeframe with time limit extensions 172 51 31 199 59 34 % of formal requests completed within 30 days 80% 73% 86% % of formal requests completed within statutory timeframe with time limit extensions 92.5% 83% 94% Set out below in Table 3 is data with respect to requests for access to requests related to the Personal Health Information Protection Act from 2012 to 2014.
18 COMITÉ DES FINANCES ET DU Table 3 - PHIPA Requests PHIPA Requests 2014 2013 2012 Number of new formal requests received 12 16 17 Number of formal requests completed 12 16 17 Number of formal requests completed within 30 days Number of formal requests completed within statutory timeframe with time limit extensions 12 14 16 n/a 15 17 % of formal requests completed within 30 days 100% 87% 94% % of formal requests completed within statutory timeframe with time limit extensions 100% 94% 100% Third Party Summary As indicated in previous annual reports, institutions under MFIPPA often acquire information about activities of third parties, such as private sector companies or organizations. Some of this information may represent a valuable asset to the third party and disclosure of such information could negatively affect the third party s competitive position or cause it financial harm. Accordingly, Subsection 10(1) of MFIPPA provides a mandatory exemption from disclosure for certain types of third party information where disclosure could reasonably be expected to cause certain harms. This exemption is not limited to commercial third parties, but may also apply to any supplier information. Section 21 of MFIPPA provides that, before access is granted to a record that may contain such information, the third party must be notified and given an opportunity to make written representations to the City before a final access decision is made. The statutory obligation of establishing whether the record is exempt from disclosure rests with the third party. To meet this statutory requirement, the affected third party must provide detailed and convincing evidence to establish a reasonable expectation of harm. It is important to note that speculation of possible harm is not sufficient to rely on this exemption.
19 COMITÉ DES FINANCES ET DU Table 4 below sets out data about requests for access to records involving third party interests. Table 4 - Third Party Interests Access Requests Third Party Interests 2014 2013 2012 Access to General Records Number affecting interests of a third party 37 37 58 Appeals to the Information and Privacy Commissioner Mediation A person who has made a request for information under MFIPPA or PHIPA or whose interests are affected by the records at issue (e.g. third party) may appeal the City s ruling to the Information and Privacy Commissioner of Ontario (IPC) within 30 days after the City has issued its decision. Mediation is the preferred method of dispute resolution with the IPC. The Mediator assigned is authorized to investigate the circumstances of any appeal and try to achieve a settlement of the matter. To do so, all parties must reach an agreement about the issue under appeal. If such a resolution is unable to be mediated, it may proceed to the adjudication stage. The following table sets out the number of appeals to requests for access to general records from 2012 to 2014 that were received and resolved. Set out below in Table 5 is data with respect to appeals to requests for access to general records. Table 5 - Appeals Appeals to Requests for Access to General Records 2014 2013 2012 Number of Appeals received and resolved 6 8 11 Average number of days to complete Appeals 120 40 112
20 COMITÉ DES FINANCES ET DU Adjudication and Orders The IPC assigns an Adjudicator to conduct an adjudication of those matters outstanding from the mediation process. All parties involved are entitled to make written representations to the IPC. Once the representations are received, they are considered by the Adjudicator and an Order is issued to resolve the outstanding matters. The Order is published on the IPC website shortly thereafter setting out whether the IPC upholds or varies the decision taken by the institution. In 2014, there were three Orders issued by the IPC to the City of Ottawa. These are summarized in Document 1. Outreach Activities Training has proven to reduce the risk of privacy breaches because such incidents tend to result from human error due to a lack of guidance and knowledge about privacy and security. To reduce this risk, the ATIP Office regularly offers privacy training; 16 such sessions were conducted in 2014 for approximately 650 employees. Routine Disclosure / Active Dissemination Policy Routine Disclosure is the regular or automatic release of certain types of administrative and operational records in response to requests made either informally or formally under the MFIPPA process. Pro-active Disclosure is the periodic release of general records prior to, or in the absence of, a formal or informal request. Pro-active Disclosure, also referred to as Active Dissemination, is usually applied to general records or statistics. The City of Ottawa s Routine Disclosure/Active Dissemination Policy (RD/AD) provides clear guidelines, accompanied by departmental plans for pro-active disclosure. These departmental plans will be listed as schedules to the Routine Disclosure/Active Dissemination Policy. Schedules will let the public know what information can be released without going to the ATIP Office. These plans will also help City staff understand what information can be routinely disclosed to the public, their obligation to disclose such information and what information requires formal access procedures and must be referred to the ATIP Office.
21 COMITÉ DES FINANCES ET DU Following the approval of the Routine Disclosure and Active Dissemination Policy in July 2013, the City Clerk and Solicitor Department made available requests for general records received under MFIPPA on a quarterly basis on Ottawa.ca. Requests that were closed during the previous fiscal quarter are included through routine disclosure. Identifying records for routine disclosure and authorizing staff to make them available is a labour intensive and time consuming process. Therefore, although the creation of departmental pro-active disclosure plans has been initiated, it is anticipated that this corporate-wide exercise will take a number of years to fully implement. In June 2014, we reported that the ATIP Office was working with the Building Code Services and Ottawa Paramedic Service Branches to identify documents that are frequently requested and to determine which would be proactively listed and which would be routinely disclosed. Accordingly, departmental pro-active disclosure plans are now in place for these two branches. In moving forward, the ATIP office will be working with Transit Services to identify documents that are frequently requested and to determine which would be proactively listed and which would be routinely disclosed. Also, as a result of lessons learned from the process of developing the departmental pro-active disclosure plans for Building Code Services and Ottawa Paramedic Services, ATIP staff is working on a set of guidelines to facilitate the process of developing subsequent departmental plans. Until such time as all of the Routine Disclosure and Active Dissemination schedules are complete, when ATIP staff receive an MFIPPA request that they believe should be routinely disclosed, they will continue to work with operational staff to that end. Privacy Awareness Week This event was created in 2014 to raise awareness of ATIP and MFIPPA and the Mayor officially proclaimed the last week of March to be designated as Privacy Awareness Week in the City of Ottawa. In 2014, in preparation for this event, staff produced a brochure, a privacy tip sheet, a privacy quiz and a privacy breach guide. Over a thousand brochures were handed out in the context of the 2014 Privacy Awareness Week. To promote the City s second annual Privacy Awareness Week, the ATIP Office
22 COMITÉ DES FINANCES ET DU undertook one outreach event on Wednesday, March 25 and published an article through In The Loop, the City-wide employee e-newsletter. Bill 8, the Public Sector and MPP Accountability and Transparency Act, 2014 In December 2014, Bill 8 passed Third Reading in the Legislative Assembly of Ontario and received Royal Assent. The Bill, also known as the Public Sector and MPP Accountability and Transparency Act, 2014, provides a wide variety of measures the Ontario Government believes will strengthen political accountability, enhance oversight and increase transparency at both the provincial level and within the MUSH sector (municipalities, universities, school boards and hospitals). In particular, Schedule 6 of Bill 8 amends the Municipal Freedom of Information and Protection of Privacy Act to: Require that the Head of an Institution ensure that reasonable measures respecting the records in the custody or under the control of the institution are developed, documented and put into place to preserve the records in accordance with any applicable record-keeping or records retention requirements, rules or policies, whether established under an Act or otherwise; and Add a new offense for any person who wilfully alters, conceals or destroys records, or causes any other person to do so, with the intention of denying a right under MFIPPA to access the record or the information contained in the record. The annual report on the subject of Information Management and record retention will speak to this issue in greater detail. At the time of the writing of this report, it is not known precisely when provisions of Bill 8 related to municipalities will come into effect. Staff will continue to monitor the progress of this new legislation and provide information to Council or take further action as appropriate. RURAL IMPLICATIONS There are no rural implications associated with this report.
23 COMITÉ DES FINANCES ET DU CONSULTATION This is an internal information report and did not require public consultation. COMMENTS BY THE WARD COUNCILLOR(S) This report is City-wide. LEGAL IMPLICATIONS There are no legal impediments to Committee and Council receiving this report for information. RISK MANAGEMENT IMPLICATIONS There are no risk management implications associated with this report. FINANCIAL IMPLICATIONS There are no financial implications associated with this report. ACCESSIBILITY IMPACTS There are no accessibility implications associated with this report. ENVIRONMENTAL IMPLICATIONS There are no environmental implications associated with this report. TERM OF COUNCIL PRIORITIES This matter is associated with Term of Council priority GP1, Improve the public s confidence in and satisfaction with the way Council works. SUPPORTING DOCUMENTATION Document 1 Summary of Orders issued by the IPC to the City of Ottawa in 2014
24 COMITÉ DES FINANCES ET DU DISPOSITION The City Clerk and Solicitor will implement any decisions made by Council in relation to this report.
25 COMITÉ DES FINANCES ET DU Document 1 MO-3015 (February 21, 2014) The City received three separate requests from the same requester for access to various records, including building plans, relating to three model homes at three identified addresses. After notifying a third party and receiving the third party s objection to the disclosure of the records, the City issued three decisions stating that it was disclosing the records to the requester. The third party appealed the City s decisions to disclose the records, and argued that portions of the records qualified for exemption under Sections 10(1) (third party information) and 14(1) (personal privacy) of the Act. This order determines that one page of the records is not responsive to the request, but that the remaining records do not qualify for exemption under either Section 10(1) or 14(1) of the Act. The City s decisions to disclose the remaining records to the requester are upheld. MO-3062 (June 24, 2014) The City of Ottawa received a request under the Act for access to two Para Transpo taxi contracts. The City granted partial access to the responsive records. Portions of them were withheld pursuant to Section 10(1) (third party commercial information), Sections 11(c) and (d) (economic and other interests) and Section 14(1) (personal privacy) of the Act. During mediation, the appellant confirmed that he does not seek access to the information for which Section 14(1) was claimed. That information was removed from the scope of the appeal. Although additional records were disclosed to the appellant during mediation, the appellant advised that he believes that more responsive records should exist. As a result, the issue of the reasonableness of the City s search was included in the appeal. This order finds that the city conducted a reasonable search for responsive records. This order also finds that the portions of the records withheld from disclosure are not exempt pursuant to Section 10(1) or Sections 11(c) or (d). The City is ordered to disclose the records, in full, to the appellant.
26 COMITÉ DES FINANCES ET DU MO 3100 (September 26, 2014) The City of Ottawa received a request for all records related to an identified property covering a specified time frame. The City located approximately 300 pages of responsive records and denied access to portions of them pursuant to the exemptions at Section 7(1) (advice or recommendations), Sections 8(1)(a) and (d) (law enforcement), Section 12 (solicitor-client privilege) and Section 14(1) (personal privacy) of the Act. During mediation, the City conducted an additional search and located additional records. Portions of the additional records were denied pursuant to the same exemptions identified in the previous access decision. In this order, the Adjudicator finds that some of the records contain the personal information of the appellant and other identifiable individuals, and that the personal privacy exemption at Section 38(b) applies to the majority of information for which it was claimed. However, she finds that the absurd result principle applies to several records, which are ordered disclosed. The Adjudicator also finds that Section 38(a), read in conjunction with Sections 7(1) and 12, applies to the information for which it was claimed. Finally, the adjudicator finds that the record claimed to be not responsive, is indeed not responsive to the request and upholds the City s search for responsive records.