Purpose of the Act

s.1 FIPPA / s.1 MFIPPA The Freedom of Information and Protection of Privacy Act (FIPPA) and the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) provide individuals with a right of access to certain records and personal information under the custody or control of institutions covered by the Acts. The purposes of the FIPPA/MFIPPA are as follows:

  1.  to provide a right of access to information under the control of institutions in accordance with the principles that,
    • information should be available to the public,
    • necessary exemptions from the right of access should be limited and specific,
    • decisions on the disclosure of information should be reviewed independently of the institution controlling the information; and
  2.  to protect the privacy of individuals with respect to personal information about themselves held by institutions and to provide individuals with a right of access to that information.

How the Act is Organized

FIPPA came into force on January 1, 1988, MFIPPA became law 3 years later on January 1, 1991. FIPPA/MFIPPA are divided into four similar parts. FIPPA has an additional part at the beginning dealing with administrative matters covering both of FIPPA/MFIPPA. The sections are as follows:

FIPPA Part I: Administration covers administrative matters with respect to the Responsible Minister and the Information and Privacy Commissioner, Ontario(IPC).

FIPPA Part II / MFIPPA Part I: Freedom of Information deals with the right of access to records, exemptions to that right, access procedures and information to be published or made available to assist in locating government held records.

FIPPA Part III / MFIPPA Part II: Protection of Individual Privacy concerns the collection, retention, use, disclosure and disposal of personal information and personal information banks. This part also deals with an individual's right of access to his/her own personal information and the right to request correction of that information.

FIPPA Part IV / MFIPPA Part III: Appeal addresses the right to appeal and the procedures for appealing a decision made by an institution.

FIPPA Part V / MFIPPA Part IV: General covers general matters including the charging of fees, offences, regulations and the powers and duties of the IPC.

Scope of the Act

s.10, 63, 64, 65, 69, 70 FIPPA / 4, 50, 51, 52 MFIPPA

s.5 O.Reg.460 /s.5 O.Reg.823, O.Reg.372/91

FIPPA covers all ministries of the Ontario Government and any agency, board, commission, corporation or other body designated as an "institution" in the regulations. MFIPPA covers all municipal corporations, including a metropolitan, district or regional municipality, local boards and commissions. The term institution is defined in s.2 of FIPPA/MFIPPA and is set out in the Definitions segment of this chapter immediately below.

FIPPA/MFIPPA apply to any record in the custody or under the control of an institution, including records created both before and after the laws came into force.

FIPPA binds the Crown.

FIPPA/MFIPPA do not apply to:

  • records such as private donations placed in the Archives of Ontario (FIPPA) or the archives of an institution by or on behalf of a person or organization other than the institution (for MFIPPA institutions). This includes private donations of manuscripts and letters;
  • records covered by the disclosure scheme in the Young Offenders Act (YOA);
  • for FIPPA institutions: records of a patient in a psychiatric facility as defined by section 1 of the Mental Health Act where the record is a clinical record as defined by subsection 35(1) of the Mental Health Act, or contains information on the history, assessment, diagnosis, observation, examination, care or treatment of the patient;
  • for FIPPA institutions: wiretap application records covered by the Criminal Code;
  • for FIPPA institutions: notes for the personal use of a presiding judge (s.65(3));
  • for institutions covered by FIPPA/MFIPPA: labour relations or employment-related matters as described in s.65(6 & 7) FIPPA / s.52(3 & 4) MFIPPA.

FIPPA/MFIPPA do not impose any limitation on the information otherwise available by law to a party to litigation. Where an institution is required to produce documentary evidence pursuant to rules of court, the exemptions in FIPPA/MFIPPA do not apply.

FIPPA/MFIPPA is a comprehensive access scheme which must be implemented by all institutions, including administrative tribunals who are listed as "institutions" under the Act. It does not deny access to information through rules of natural justice or legal procedures. For example, it does not affect the power of a court or tribunal to compel a witness to testify or to compel the production of a document.

Not all requests for information need to be made under FIPPA/MFIPPA. Information can be provided in response to an oral request or in the absence of a request, where an institution may give access to that information under FIPPA/MFIPPA. The Acts should not be applied to preclude access to information (except personal information) that was available by custom or practice before they came into force.

Definitions

s.2 FIPPA / s.2 MFIPPA

The terms defined in the Act appear with the relevant section from the Act.

Control (of a record)

Means the power or authority to make a decision about the use or disclosure of the record.

Custody (of a record)

Means the keeping, care, watch, preservation or security of the record for a legitimate business purpose. While physical possession of a record may not always constitute custody, it is the best evidence of custody.

In Order # P-120 the IPC first outlined 10 factors that could be considered to determine the custody or control of a record. These factors are listed in s.10/4 of the Annotation under (Custody or Control).

Directory of Institutions

s.31 FIPPA / s.24 MFIPPA

Is a compilation listing all institutions covered by the Acts, including information on where requests can be made and whether institutions have a library or reading room available to the public and if so, its address.

Directory of Records

s.32, 33, 35, 45 FIPPA / s.25, 34 MFIPPA

Is a publication which lists, for institutions covered by FIPPA,

  1.  information on the general classes or types of records and manuals maintained by institutions and
  2.  the personal information banks maintained by each institution. Each MFIPPA institution is required to to make available similar information for public inspection.

Each MFIPPA institution is required to to make available similar information for public inspection.

Exemptions: Mandatory and Discretionary

There are two types of exemptions in FIPPA/MFIPPA.

Mandatory exemptions impose a duty on the head of an institution to refuse to disclose a record. Mandatory exemptions begin with the words: "a head shall refuse to disclose...". There are three mandatory exemptions in FIPPA. They are: s.12 (Cabinet records), s.17 ( third party information) and s.21 (personal privacy). The three mandatory exemptions for MFIPPA are: s.9 (relations with other governments), s.10 (third party information) and s.14 (personal privacy). In the case of mandatory exemptions the head must determine whether the facts exist or may exist which bring the record requested within the exemption.

If grounds for a mandatory exemption exist, the head must refuse access unless a compelling public interest outweighs the purpose of the exemption (e.g. s.21 FIPPA / s.14 MFIPPA). The public interest override does not apply to s.12, 14, 16, 19 and 22 FIPPA / s.6, 8, 12, and 15 MFIPPA.

All other exemptions are discretionary exemptions. They permit the head to disclose a record despite the existence of the exemption. Discretionary exemptions are introduced by the words: "(A) head may refuse to disclose...". FIPPA/MFIPPA require a two-stage process in determining whether a discretionary exemption is to be applied. First, the head must determine whether the facts exist or may exist which bring the record requested within the exemption. Second, the head must decide whether he/she is willing to release the record, despite the existence of grounds for the exemption. A decision by a head to disclose information falling within an exemption is an exercise of discretion.

Frivolous and Vexatious (requests)

s.27.1 FIPPA / s.20.1 MFIPPA

s.5.1 O.Reg.460 /s.5.1 O.Reg.823

An institution is not required to proceed with a request it views as frivolous or vexatious. If a requester appeals this decision, the institution is required to present evidence that the request is frivolous and/or vexatious and the IPC will determine if the institution's decision is reasonable.

Under the regulations, a frivolous or vexatious request occurs where the request is part of a pattern of conduct that amounts to an abuse of the right of access or where responding to the request would interfere with the operations of the institution. Examples of the meaning of "abuse" in the legal context include:

  • proceedings instituted without any reasonable ground;
  • proceedings whose purpose is not legitimate, but is rather designed to harass, or to accomplish some other objective unrelated to the process being used;
  • situations where a process is used more than once, for the purpose of revisiting an issue previously addressed.

In addition, the regulations provide that a request meets the definition of frivolous or vexatious if it is made in bad faith. Bad faith is not simply bad judgment or negligence, but rather it implies the conscious doing of a wrong because of dishonest purpose. It contemplates a state of mind which views the access process with contempt and for the nuisance it creates, rather than a valid means of obtaining information.

Head

s.2 FIPPA / s.2 MFIPPA

Under FIPPA, means,

  1.  in the case of a ministry, the minister of the Crown who presides over the ministry, and
  2.  in the case of any other institution, the person designated as head of that institution in the regulations. 

For FIPPA institutions other than ministries (such as agencies listed in the regulations), the minister responsible for that institution shall be deemed to be the head of that institution, unless the regulation designates someone else.

Under MFIPPA, means,

  1. in respect of an institution, means the individual or body determined to be head under section 3;

The selection of a head for MFIPPA institutions is discussed in greater detail in the Administration chapter (Chapter 2) of this manual.

Individual

Means a human being; it does not include a corporation (see also the definition of "Person").

Under s.66 FIPPA / s.54 MFIPPA, Any right or power conferred on an individual by this Act may be exercised,

  1. where (FIPPA)/if (MFIPPA) the individual is deceased, by the individual's personal representative if exercise of the right or power relates to the administration of the individual's estate;
  2. by the individual's attorney under a continuing power of attorney, the individual's attorney under a power of attorney for personal care, the individual's guardian of the person, or the individual's guardian of property; and
  3. where (FIPPA)/if (MFIPPA) the individual is less than sixteen years of age, by a person who has lawful custody of the individual.

The personal representative referred to in clause (a) is the executor named in a will or, where there is no will, the administrator appointed by a court to administer the estate of the deceased person. In order for the personal representative of a deceased to exercise a right or power of the deceased, the exercise of the right or power must relate to the administration of the estate. As a result, the rights of the representative are narrower than the rights the deceased could have exercised while alive.

In clause (b), a guardian may be appointed by a court order for a person who is incapable of managing his/her own affairs or who is capable of making decisions about personal care. In addition, the Public Guardian and Trustee may become an individual's statutory guardian as provided by the Mental Health Act and the Substitute Decisions Act.

In clause (c) the IPC has held that the rights under FIPPA/MFIPPA of an individual with lawful custody of a child are not absolute; for instance the rights cannot be used to access records for personal objectives that are not those of the child.

The rights or powers which may be exercised on behalf of an individual include the right to make a request for access to a record, the right to consent to the use and disclosure of personal information under s.21(1)(a), 41(a) and 42(b) FIPPA/ s.14(1)(a), 31(a) and 32(b) MFIPPA, and the right to authorize personal information to be collected other than directly from the individual under s.39(1)(a) FIPPA / s.29(1)(a) MFIPPA.

Information and Privacy Commissioner (Commissioner)

s.4, 5, 6, 7, 8, 9, 50, 51, 52, 54, 55, 56, 58, 59, 61 FIPPA / s.39, 40, 41, 43, 44, 46, 48 MFIPPA

The Commissioner is appointed by the Lieutenant Gover nor in Council. The Commissioner is an officer of the Legislature and is independent of the government.

The IPC hears appeals of decisions made by heads of institutions, issues binding orders, conducts privacy investigations, and has certain powers relating to the protection of personal privacy. In the Appeals chapter (Chapter 7) of this manual the role of the Commissioner is discussed in more detail.

Institution

s.2 FIPPA / s.2 MFIPPA

Under FIPPA "institution" means,

  1.  a ministry of the Government of Ontario,
  2.  any agency, board, commission, corporation or other body designated as an institution in the regulations.

Under MFIPPA there are three parts to the definition of institution:

  1. a municipal corporation, including a metropolitan, district or regional municipality or the County of Oxford,

Each municipal corporation (village, town, township, city, county, and district and regional municipality) is a separate institution for the purposes of the Act.

The following bodies are considered to part of a municipal corporation: boards of control, sinking fund committees, fence viewing boards, courts of revision, planning advisory committees, property standards committees, cemetery boards, committees of adjustment, land division committees, parking authorities, parks boards,arena boards and recreation boards, and other bodies where all the members or officers are appointed by council.

For example: A board of management for a Business Improvement Area would be covered as part of the municipal corporation because all of the members of the board are appointed by a municipal council.

Where only some of the members of an agency or board are appointed by the municipal institution, that agency or body is not considered part of the municipality for the purposes of the Act.

For example: A non-profit housing corporation may not be an institution under the Act when some members are appointed by community groups rather than the municipality.

  1. a school board, public utilities commission, hydro-electric commission, transit commission, suburban roads commission, public library board, board of health,police commission, conservation authority, district welfare administration board, local services board, planning board, local roads board, police village or joint committee of management or joint board of management established under the Municipal Act.

These institutions, some of which are closely connected to municipal corporations, are designated separate institutions for the purposes of the Act.

  1. any agency, board, commission, corporation or other body designated as an institution in the regulations.

Other bodies may be prescribed as separate institutions for the purposes of the Act.

For example: A municipality might have a corporation established under a private statute that operates a convention centre. Except for the fact that the centre is owned by the municipality, it operates as an autonomous entity. In this case it may be appropriate that the centre be designated in regulation as a separate institution for the purposes of the Act (e.g., The Hamilton Entertainment and Convention Facilities Inc.)

Labour Relations

Means the collective relationship between an employer and its employees. (see Chapter 5 on Privacy Protection for a further discussion of labour relations and employment-related records).

Law Enforcement

Law enforcement means,

  1. policing,
  2. investigations or inspections that lead or could lead to proceedings in a court or tribunal if a penalty or sanction could be imposed in those proceedings, and
  3. the conduct of proceedings referred to in clause (b).

There are three parts to the definition. Part (a) encompasses the activities of police forces. These activities include the investigation and prosecution of offences, the collection and analysis of intelligence information, the prevention of crime, the maintenance of law and order and the provision of security and protective services. This part does not apply to internal employment-related investigations for breach of contract.

Part (b) of the definition includes activities by an institution to enforce compliance with standards, duties and responsibilities set out in a statute or regulation. Many institutions have a branch which is responsible for the enforcement of statutes administered by the institution.

In part (b) the words "lead or could lead" indicate that inspections and investigations may be part of "law enforcement" even if they do not actually result in proceedings in a court or tribunal.

For example: The result of an investigation to determine whether an offence has been committed under the Environmental Protection Act or a Municipal By-law may be that there is insufficient evidence of an offence and therefore no charge should be laid. The investigation would still come within the definition of law enforcement.

Part (b) refers to proceedings where a "penalty or sanction" could be imposed in those proceedings. This includes the imposition of imprisonment or a fine, the revocation of a licence and the issuance of an order requiring a person to cease an activity. A civil action for monetary damages or recovery of debt, as well as internal employment-related investigations where a tribunal could hear the matter only at the insistence of the employee would not be included.

Part (c) of the definition refers to the actual conduct of proceedings before a court or tribunal.

For example: Prosecution of an offence under the Criminal Code, and investigations under the Ontario Human Rights Code and the conduct of a hearing before a regulatory tribunal such as the Ontario Securities Commission or the Superintendent of Insurance are included.

Person

The term refers to an individual and to organizations such as business entities and associations.

Personal Information

Personal information means recorded information about an identifiable individual, including:

  1. information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual;
  2. information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved;
  3. any identifying number, symbol or other particular assigned to the individual;
  4. the address, telephone number, fingerprints or blood type of the individual;
  5. the personal opinions or views of the individual except if they relate to another individual;
  6. correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence;
  7. the views or opinions of another individual about the individual; and
  8. the individual's name if it appears with other personal information relating to the individual or where disclosure of the name would reveal other personal information about the individual.

Personal information must be about an identifiable individual, however an individual's name need not be attached to the information to qualify as personal information. A physical description or a photograph of a person attached to other personal information about that person is personal information although no name is ever indicated. This individual is "identifiable" and all of the kinds of information described above are his/her personal information.

Generally, information about a property or a specific municipal address, such as market value assessment, hydro-electric consumption or building permit information, is not personal information. However, records containing such property-related information may also contain an individual's name and personal information such as a home telephone number. Care should be taken to ensure that any disclosure of that personal information complies with the privacy protection provisions of the Act (see the Privacy chapter (Chapter 5) for a discussion regarding the disclosure of personal information).

An individual's name on its own is not personal information. To be personal information within the meaning of the Act, the name must be associated with other personal information as defined in s.2.

For example: An individual's name kept by a social services department would be personal information because the fact that the name was on a record at the department might indicate that the person was, or is, in receipt of public assistance.

The term "person" when used in legislation may refer to both individuals and to organizations such as business entities and associations. However, an "individual", which is the term related to privacy rights in the context of FIPPA and MFIPPA, does not include sole proprietorships, partnerships, unincorporated associations, corporations, trade unions or law firms or the names of officers of a corporation writing in their official capacity. Nevertheless records of sole proprietorships and other small businesses such as partnerships may contain information about business entities that is also personal information about individuals.

For example: In a sole proprietorship or family business the finances of the individual may be virtually identical to the finances of the business. Where this is the case, the information in the custody or control of an institution would be subject to the Act's privacy provisions.

Correspondence submitted to an institution by a representative of a group or association is not the personal information of the author of the correspondence if: 1) the correspondence submitted to an institution is on the letterhead of the organization and 2) it is signed by an individual in his/her capacity as a spokesperson of the organization.

However, the information about individuals acting in their business or official capacities becomes personal information when they are affected as private individuals.

For example: The witness statements of by-law enforcement officers who were physically assaulted while acting in their official capacity would contain their personal information.

Personal information also includes opinions and views.

For example: If A expresses an opinion about B, that opinion is part B's personal information. Other views or opinions, which are not about an individual are the personal information of the individual who has expressed the opinion.

Personal information does not include information about an individual who has been dead for more than thirty years (s.2(2)).

The definition of personal information under the Act refers to recorded information about an identifiable individual. For the purpose of regulating the collection of personal information under the privacy protection provisions of the Act, personal information includes personal information collected orally on behalf of an institution. This is discussed in detail in the chapter dealing with Privacy (Chapter 5).

Personal Information Bank

s.44, 45 FIPPA / s.34 MFIPPA

A Personal Information Bank (PIB) is a collection of personal information that is organized and capable of being retrieved by an individual's name or other individual identifier.

A collection of personal information in the custody or control of an institution would be a personal information bank if it has the following characteristics:

  • it must contain personal information;
  • information contained in the bank must be a collection of like or similar information about individuals;
  • information must be linked to an identifiable individual; and
  • the information must be capable of being retrieved by the individual's name or identifying symbol (such as a client identification number).

For example: A public library's circulation records that contain the names, addresses and borrowing records of patrons is a personal information bank.

Usually a personal information bank serves an important administrative or operational function and is used in reaching decisions that affect the individuals in the bank. A number of personal information banks can support one function.

Institutions will often have collections of records containing some personal information, but these do not meet the criteria for the definition of a personal information bank (e.g., records of purchase orders or general correspondence). The Act does not require an institution to rearrange its personal information into personal information banks.

Collections of personal information that meet the characteristics of a personal information bank (as set out above) must be identified and described by the institution. Generally, individuals have a right to information about themselves contained in an institution's personal information banks. These descriptions must be made available to assist the public in exercising privacy rights.

Public Interest

Means the interest of the public in general, not of any individual or group of individuals.

The interest may be a pecuniary one or one by which legal rights or liabilities are affected. It may be an interest in public health or safety or an interest in the maintenance of confidence in the conduct of government or in the administration of an institution.

For example: A breach of security occurring within a sensitive government function, might raise serious questions about how and why the breach happened. If information contained in a record could inform the public in some way about the incident by adding to the information they have to express opinion or to make political choices, it could be considered in the public interest to release it.

Record

s.2 FIPPA / s.2 MFIPPA

A record is any record of information however recorded, whether in printed form, on film, by electronic means or otherwise, and includes:

  1. correspondence, a memorandum, a book, a plan, a map, a drawing, a diagram, a pictorial or graphic work, a photograph, a film, a microfilm, a sound recording, a videotape, a machine-readable record, any other documentary material regardless of physical form or characteristics, and any copy thereof; and
  2. subject to the regulations, any record that is capable of being produced from a machine-readable record under the control of an institution by means of computer hardware and software or any other information storage equipment and technical expertise normally used by the institution.

The definition of record is very broad and includes virtually every form of information held in some recorded form by an institution. The definition is not restricted to actual physical documents, but includes records that can be created from existing data in a computer bank. Even documents such as electronic mail are considered to be records. For further information on computer records, see the definition of "machine readable records" immediately below.

Handwritten notes or other notations on records form a part of the records. Working copies and drafts of reports and letters are also records.

Machine Readable Record

s.2, 60 FIPPA / s.2, 47 MFIPPA

s.2 O.Reg.460 /s.1 O.Reg.823

In cases where a request is for information that can not currently be extracted in a way that is useful to a requester, but is capable of being produced from a machine readable record, the Act gives the requester the right (subject to the regulations) to the information which would answer all or part of a request.

If the process of producing a record from a machine readable format would unreasonably interfere with the operations of an institution, the machine readable record would not be included in the definition of a record as outlined above. Unreasonable interference with operations could include instances where normal business activities would have to stop or change in order to produce the record. It may also include instances where the cost of producing the record would result in the inability of an institution to meet its other obligations.

See the regulations for further information.

Third Party

Any person whose interests might be affected by disclosure other than the person making a request for access or the institution. Where the third party is an individual, his/her rights may in some cases be exercised by another person. See the definition of "individual" above.

Use

Use (of personal information): to take action, to employ, to put to use.

Waiver or Notice

s.39(2) FIPPA/s.29(3)(b) MFIPPA

This is a letter signed by the Minister responsible for FIPPA/MFIPPA that allows an institution to forego giving a notice of collection in specified circumstances. 

Role of the Responsible Minister and Management Board Secretariat

The Responsible Minister: the minister of the Crown who is designated by order of the Lieutenant Governor in Council under section 3 (subsection 2(1) of FIPPA).

The Responsible Minister is the Chair of Management Board of Cabinet.

The Corporate Freedom of Access and Privacy Office of Management Board Secretariat supports the Chair of Management Board of Cabinet as the minister responsible for FIPPA/MFIPPA. The Office assists institutions that are covered by FIPPA/MFIPPA by providing training, policy and operational advice.