2019 FC, 2019 FC 1279

Date: 20191009 Docket: T-1682-18 Citation: 2019 FC 1279 Ottawa, Ontario, October 9, 2019 PRESENT: Mr. Justice McHaffie BETWEEN: THE INFORMATION COMMISSIONER OF CANADA Applicant and THE MINISTER OF PUBLIC SAFETY AND EMERGENCY PREPAREDNESS Respondent JUDGMENT AND REASONS I. Overview [ 1 ] Information that relates to an object rather than a person, such as the firearm serial numbers at issue in this case, is not by itself generally considered " “personal information” " since it is not information about an identifiable individual.

However, such information may still be personal information exempt from disclosure under the Access to Information Act , RSC 1985, c A-1 [ ATIA ] if there is a serious possibility that the information could be used to identify an individual, either on its own or when combined with other available information. [ 2 ] The assessment of whether information could be used to identify an individual is necessarily fact-driven and context-specific. The " “other available information” " relevant to the inquiry will depend on the nature of the information being considered for release.

It will include information that is generally publicly available. Depending on the circumstances, it may also include information available to only a segment of the public. However, it will not typically include information that is only in the hands of government, given the purposes of both the ATIA and the personal information exemption. [ 3 ] The evidence in this case does not establish a serious possibility that the release of the firearm serial numbers at issue will allow identification of an individual.

To use the serial numbers to identify an individual would require either access to restricted government databases that already contain personal information, or a successful effort to trick either the government or the manufacturer into releasing personal information. The evidence does not establish a serious possibility of either occurring.

The respondent has not met the onus of establishing that the firearm serial numbers are " “personal information.” " No other grounds to exempt the information from disclosure under the ATIA were raised, and the serial numbers will therefore be ordered released to the requester in response to their ATIA request. [ 4 ] Had I concluded that the information was personal information exempt from disclosure, I would have remitted the matter back to the Royal Canadian Mounted Police to redetermine the exercise of discretion under subsection 19(2) of the ATIA , as the RCMP did not reasonably consider whether the public interest in disclosure would outweigh the invasion of privacy resulting from release.

II. Facts A. The Request for Access to Information and Partial Release of Information [ 5 ] In 2014, the RCMP received the following request for access to records under the ATIA : I am seeking all documentation regarding a Sig Sauer P226 serial number U 120 530 which was previously issued to RCMP ‘E’ Division Emergency Response Team. I am also seeking a copy of the “disposal list” as well as a list of all the firearms that were sent back on warranty replacement around 1986. [ 6 ] A " “Sig Sauer P226” " is a firearm, specifically a model of handgun manufactured by Sig Sauer, Inc. [Sig Sauer].

As with most other firearms, each Sig Sauer P226 bears a serial number, such as the " “U 120 530” " referenced in the request. No two Sig Sauer P226 guns will bear the same serial number, although two or more firearms of different makes or models might, coincidentally, carry the same number, particularly if the manufacturer adopted a fairly simple numbering system. Taken together, the make, model and serial number represent a unique firearm. [ 7 ] In response to the ATIA request, the RCMP identified a 13-page chart that listed information regarding 468 Sig Sauer P226 firearms.

With respect to each gun, the chart sets out the serial number, the model ( " “SIG SAUER 226” " in each case), the RCMP unit the firearm was initially issued to, the date of receipt, the disposition of the firearm ( " “Warranty Return” " in each case), and a column for comments (largely blank, but with the comment " “Cracked frame” " in respect to some firearms, and the comment " “Subject of ATIP” " for one firearm). [ 8 ] The RCMP determined that release of the firearm serial numbers would result in the disclosure of " “personal information” " within

the definition of

section 3 of the Privacy Act , RSC 1985, c P-21 , since disclosure of the serial numbers would result in disclosure of information about identifiable individuals. The RCMP therefore concluded that they had to refuse to disclose the serial numbers under subsection 19(1) of the ATIA . [ 9 ] The RCMP decided not to exercise the discretion available under subsection 19(2) of the ATIA to release the personal information.

The RCMP noted that there had been no consent to disclose by those affected, that it would be unreasonable to attempt to obtain that consent, that the serial numbers were not already public, and that it was not in the public interest to disclose the serial numbers. The chart was therefore released to the requester with the serial numbers of the firearms redacted. [ 10 ] The requester advised the RCMP that the serial number of his own firearm had been redacted from the released document. In response, the RCMP released to the requester the serial number of their own firearm.

However, the RCMP maintained the position that release of the other serial numbers would disclose personal information and refused to release the record with those numbers. B. The Information Commissioner’s Investigation and Recommendation [ 11 ] The requester filed a complaint with the Information Commissioner pursuant to paragraph 30(1) (

a) of the ATIA . During the resulting investigation, the RCMP made representations expressing the view that the serial numbers were akin to a social insurance number and were thus personal information. The RCMP indicated that of the 468 serial numbers set out in the record, 398 (or 85%) were linked to an individual in the Canadian Firearms Information System (CFIS), with information including their name, date of birth and full address. The RCMP considered that the serial numbers could therefore be used to glean personal information from the CFIS database. The RCMP noted that they had consulted with Sig Sauer, presumably pursuant to

section 27 of the ATIA , asking whether they had any objection to the release of the " “comments” " column in the record, and received no objection from Sig Sauer. [ 12 ] The Information Commissioner concluded that the complaint was well-founded, as the RCMP had not established that the serial numbers constituted personal information within the meaning of

section 3 of the Privacy Act .

Pursuant to subsection 37(1) of the ATIA as it then read, the Information Commissioner reported these findings to the RCMP and recommended that the RCMP disclose the serial numbers of the firearms. [ 13 ] The RCMP considered the Information Commissioner’s recommendation, but decided not to adopt it, maintaining the view that the serial numbers were personal information associated with identifying information in the CFIS database, and noting the importance of a broad approach to the definition of " “personal information.” " [ 14 ] In light of the RCMP’s decision not to follow the recommendation, the Information Commissioner brought this application under paragraph 42(1) (

a) of the ATIA as it then read. The Information Commissioner obtained the consent of the requester as required, and named the respondent as the Minister responsible for the RCMP. The Information Commissioner seeks an order directing the RCMP to disclose the unredacted record to the requester, including the serial numbers. In the alternative, the Information Commissioner asks that the matter be sent back to the RCMP for the re-exercise of the RCMP’s discretion under subsection 19(2) of the ATIA , on the basis that the RCMP has not reasonably exercised that discretion. C.

Additional Evidence Filed by the RCMP on this Application [ 15 ] On this application, the RCMP filed an affidavit from Crystal Holub, the access officer responsible for handling the request, and an affidavit from Murray Smith, an RCMP employee with extensive experience with firearms including firearm serial numbers, who was presented as an expert to provide opinion evidence. [ 16 ] Ms.

Holub’s affidavit describes the RCMP’s response to the access request, including the conclusion that the serial numbers were subject to exemption under subsection 19(1) of the ATIA as " “personal information,” " and the RCMP’s exercise of its discretion under subsection 19(2) . [ 17 ] Mr. Smith’s affidavit provides information regarding the nature and use of firearm serial numbers, the various government databases in which those serial numbers reside, and the potential for personal information to be released—either from those databases or from other sources—if the serial numbers at issue are disclosed. III.

Issues [ 18 ] This application raises two primary issues: A . Are the firearm serial numbers at issue " “personal information” " within the meaning of

section 3 of the Privacy Act and thus exempt from disclosure under subsection 19(1) of the ATIA ? B . If so, did the RCMP reasonably exercise the discretion set out in subsection 19(2) of the ATIA in refusing to disclose the information? [ 19 ] These two issues will be addressed after a review of the applicable statutory provisions of the ATIA and the Privacy Act , and the relevant analytical principles.

The full provisions, as they stood at the time of the complaint and as currently amended, are set out in Appendices A and B respectively. [ 20 ] For the reasons given below, I conclude that the firearm serial numbers are not " “personal information,” " but that if they had been, the RCMP did not reasonably exercise their discretion to assess whether the numbers should nonetheless be released.

IV. The Legislative and Analytical Framework A. Preliminary Note: Amendments to the ATIA and the Privacy Act [21] On June 21, 2019, the ATIA was amended by

An Act to amend the Access to Information Act and the Privacy Act and to makeconsequential amendments to other Acts, SC 2019, c 18 (Bill C-58).

These amendments were made after the commencement of thisapplication and after the parties filed their records, including memorandums of fact and law. [22] The amendments to the ATIA include changes relating to vexatious or bad faith requests and complaints, changes to the powers ofthe Information Commissioner including the introduction of a power to make orders to release records, and the addition of a new part ofthe ATIA regarding proactive publication of government information.

The amendments to the Privacy Act include an amendment to thedefinition of "“personal information,”" but not one that is relevant to this application. [23] None of the substantive provisions relevant to this application were materially amended. In particular, the purpose

section of theATIA (section 2) was amended, but those amendments are in keeping with the prior jurisprudence regarding the purpose of the right toaccess in the ATIA.

Section 19 was also slightly amended, to replace the word "“Act”" with the word "“Part”" and to replace the words"“personal information as defined in

section 3 of the Privacy Act”" with simply the words "“personal information.”" However, since thedefinition of "“personal information”" that is now contained in

section 3 of the ATIA reads "“personal information has the samemeaning as in

section 3 of the Privacy Act,”" I take the amendment to be one of drafting and clarity, rather than any change in substance. [24] Had the amendments been in force at the time of the complaint, the matter might have taken a different route to come to this Court.In particular, the Information Commissioner might have ordered the RCMP to disclose the information after consulting with thePrivacy Commissioner, and the RCMP could have then applied to this Court for review: ATIA, ss 36.1, 36.2, 37(1)(b), 41(2); SC 2019, c18, s 45. The roles of applicant and respondent would then have been reversed on this application.

However, the onus and the relevantsubstantive provisions are the same under the current and former versions of the ATIA and Privacy Act. The recent amendmentstherefore do not affect the analysis or the outcome of this application. B. Applicable Substantive Provisions [25] Both the right to privacy and the right of access to information in the possession of government are sufficiently important that theATIA and the Privacy Act have each been described as "“quasi-constitutional”" statutes: Canada (Information Commissioner) v Canada(Minister of National Defence), 2011 SCC 25 at para 40; H.J.

Heinz Co. of Canada Ltd. v Canada (Attorney General), 2006 SCC 13[Heinz] at para 28. [26] Sections 2 and 4 of the ATIA set out the general principle that the public has a right to access information in records that are underthe control of government.

As previously stated in the jurisprudence and now express in the amended subsection 2(1) of the ATIA, thisgeneral principle enhances accountability and transparency in government and promotes an open and democratic society: see, e.g., MerckFrosst Canada Ltd v Canada (Health), 2012 SCC 3 [Merck Frosst] at paras 1, 21-22. [27] The general principle of access to information under the control of government is expressly limited by "“necessary exceptions to theright of access”" that are set out in the ATIA, which exceptions "“should be limited and specific”": ATIA, s 2; Merck Frosst at para 21.The exceptions to the right of access in the ATIA take the form of either discretionary exemptions (information that a governmentinstitution "“may”" refuse to disclose) or mandatory exemptions (information that a government institution "“shall”" refuse to disclose). [28] Subsection 19(1) of the ATIA sets out a mandatory exemption to the general principle of access in the case of records that contain"“personal information,”" a term that is defined in the ATIA with reference to

section 3 of the Privacy Act. Subject to a discretion set outin subsection 19(2), discussed further below, a government institution must refuse release of records that contain "“personalinformation.”" [29]

Section 3 of the Privacy Act defines "“personal information”" through a general definition; a non-exhaustive and non-restrictive listof examples that do not restrict the generality of the general definition (subsections 3(

a) to (i)); and a list of exceptions (subsections 3(

j) to(m)). The general definition is broadly drafted: "“personal information means information about an identifiable individual that isrecorded in any form…”" [Emphasis added.]

Section 2 of the Privacy Act sets out that the purpose of the statute is to "“protect theprivacy of individuals with respect to personal information about themselves held by a government institution and [to] provideindividuals with a right of access to that information.”" [30] In Dagg v Canada (Minister of Finance), (SCC), [1997] 2 SCR 403 [Dagg], the Supreme Court of Canadaconsidered both the scope of "“personal information”" in the Privacy Act and the interplay between the Privacy Act and the ATIA. JusticeLa Forest wrote in dissent, but spoke for the Court on the approach to interpreting the two statutes.

He underscored that the Privacy Actand the ATIA must be interpreted in parallel given their overlapping subject matter and legislative history. Since both statutes contain anexpress exemption of personal information from disclosure, privacy rights must be recognized as "“paramount”" over access to theextent that information falls within the definition of "“personal information,”" as Justice La Forest explained at paragraph 48: Both statutes regulate the disclosure of personal information to third parties.

Section 4(1) of the Access to Information Actstates that the right to government information is “[s]ubject to this Act”. Section 19(1) of the Act prohibits the disclosure ofa record that contains personal information “as defined in

section 3 of the Privacy Act”.

Section 8 of the Privacy Actcontains a parallel prohibition, forbidding the non-consensual release of personal information except in certain specifiedcircumstances. Personal information is thus specifically exempted from the general rule of disclosure. Both statutesrecognize that, in so far as it is encompassed by the definition of “personal information” in s. 3 of the Privacy Act, privacy isparamount over access. [Emphasis added.]

[31] Justice La Forest noted that the protection of privacy was a "“fundamental value in modern, democratic states”" and that thedefinition of "“personal information”" in

section 3 of the Privacy Act is "“undeniably expansive”" and "“deliberately broad”": Dagg atparas 65, 68-69. Its intent is to capture "“any information about a specific person, subject only to specific exceptions”": Dagg at para 69[Emphasis in original.] [32] As noted above, the examples that are set out in subsections (

a) to (

i) of the definition of "“personal information”" in

section 3 ofthe Privacy Act do not restrict the generality of the general definition.

Justice La Forest confirmed that they are merely examples of thetype of subject matter encompassed by the general definition, such that "“if a government record is captured by those opening words, itdoes not matter that it does not fall within any of the specific examples”": Dagg at para 68. [33] The recognition in Dagg of the supremacy of privacy over access and the broad definition of personal information has beenconsistently reaffirmed over the decades since Dagg by the Supreme Court of Canada and the Federal Courts: Heinz at paras 61, 71;Husky Oil Operations Limited v Canada-Newfoundland and Labrador Offshore Petroleum Board, 2018 FCA 10 [Husky Oil] at paras 25,55. [34] The general definition of "“personal information”" requires that information must be "“about an identifiable individual.”" Theimportance of privacy rights is such that the courts have recognized that even if information may not on its face reveal anything personal,it will be "“about”" an identifiable individual and exempt from disclosure if there is a serious possibility that the individual could beidentified through the release of the information.

In Canada (Information Commissioner) v Canada (Canadian Transportation AccidentInvestigation and Safety Board), 2006 FCA 157, leave to appeal to SCC refused, [NavCanada], Justice Desjardinswrote the following at paragraph 43: These two words, “about” and “concernant”, shed little light on the precise nature of the information which relates to theindividual, except to say that information recorded in any form is relevant if it is “about” an individual and if it permits orleads to the possible identification of the individual.

There is judicial authority holding that an “identifiable” individual isconsidered to be someone whom it is reasonable to expect can be identified from the information in issue when combinedwith information from sources otherwise available … [Emphasis added; citations omitted.] [35] Relying on NavCanada, Justice Gibson of this Court in Gordon v Canada (Health), 2008 FC 258 [Gordon] at paragraph 34 adoptedthe following test proposed by the Privacy Commissioner to determine when information is about an identifiable individual:"“Information will be about an identifiable individual where there is a serious possibility that an individual could be identified throughthe use of that information, alone or in combination with other available information”" [Emphasis added.] The parties were agreed onthis statement of the law as set out in Gordon. [36] Although personal information is subject to a mandatory exemption from release in subsection 19(1) of the ATIA, it may still bereleased as a discretionary matter in certain cases.

Subsection 19(2) provides that personal information may disclose a record thatcontains personal information in one of three circumstances: (

a) where the individual to whom it relates consents; (

b) where theinformation is publicly available; or (

c) where the disclosure is in accordance with

section 8 of the Privacy Act. This further cross-reference to the Privacy Act again highlights the interlocking nature of the two statutes. [37] Subsection 8(1) of the Privacy Act sets out a general prohibition on disclosure of personal information without consent, mirroringthe mandatory exemption from release in subsection 19(1) of the ATIA.

Subsection 8(2) then sets out a series of 13 exceptions in whichpersonal information may be disclosed, some of which are narrow (e.g., paragraph 8(2)(c): for the purpose of complying with a subpoenaor disclosure obligations), and some of which are broader (notably subparagraph 8(2)(m)(i): for any purpose where in the opinion of thehead of the institution, the "“public interest in disclosure clearly outweighs any invasion of privacy that could result from thedisclosure”").

The combined operation of the provisions is such that where one or more of the exceptions in subsection 8(2) of thePrivacy Act applies, subsection 19(2) of the ATIA permits the personal information to be released as a discretionary matter. C. Applicable Procedural Provisions and Standard of Review [38] As noted, this application was commenced before the recent amendments to the ATIA came into force. The application was broughtunder the former paragraph 42(1)(

a) of the ATIA, which permitted the Information Commissioner to apply to this Court for review wherea government institution declined to follow a recommendation to disclose information, if the requester has consented, as they did in thiscase. Such a review is effectively conducted de novo (Merck Frosst at para 53), a standard confirmed in the recent amendments: ATIA, s44.1. [39] The former

section 48 of the ATIA provided that on an application under

section 42, the burden of establishing that the governmentinstitution is authorized to refuse disclosure is on the government institution. Thus, as the parties agreed, the RCMP had the burden inthis case to establish that the serial numbers at issue are "“personal information”" exempt from disclosure, even though the InformationCommissioner is the applicant. Again, the amendments to the ATIA do not change this onus: ATIA, s 48(1). [40] The parties are also in agreement as to the applicable standards of review.

This Court is to reach its own conclusion as to whetherthe information at issue is exempt from disclosure under subsection 19(1), i.e., it must determine whether the mandatory exemption hasbeen applied correctly: Canada (Information Commissioner) v Canada (Commissioner of the Royal Canadian Mounted Police), 2003SCC 8 at para 19; Merck Frosst at para 53. With respect to the exercise of discretion under subsection 19(2), however, thereasonableness standard applies: Canada (Information Commissioner) v Canada (Prime Minister), 2019 FCA 95 at para 31. [41] If the Court finds that a refusal to disclose under

section 19 is not authorized by the ATIA, the Court shall order the disclosure of therecord, subject to such conditions as the Court deems appropriate, or shall make such other order as the Court deems appropriate: ATIA, s49. [42] While the parties were in overall agreement with the foregoing principles, they disagreed with certain aspects regarding theirapplication, both in principle and in their application to the information at issue. These disagreements are addressed in the analysis

below. V. Analysis A. The serial numbers at issue are not " “personal information” "

(1) Numbers assigned to objects and numbers assigned to individuals [ 43 ] The firearm serial numbers at issue are not inherently personal, in that on their face they neither identify an individual nor reveal any information about an identifiable individual. The numbers are assigned to and associated with a particular firearm, and will remain with that firearm regardless of who may own or possess the firearm or who may be associated with the firearm in a given database or registry.

In this way, the serial numbers are primarily information " “about an object,” " rather than " “about an identifiable individual.” " [ 44 ] This was the conclusion of the Alberta Court of Appeal in Leon’s Furniture Limited v Alberta (Information and Privacy Commissioner) , 2011 ABCA 94 [ Leon’s ]. A central issue in that case was whether driver’s licence numbers and vehicle licence plate numbers were " “personal information” " under Alberta’s Personal Information Protection Act , SA 2003, c P-6.5 [ PIPA ].

The Alberta statute uses a definition of personal information that is the same as the general definition in the Privacy Act , namely " “information about an identifiable individual” " : PIPA , s 1(1)( k ). While the PIPA definition does not set out a list of examples and exceptions like the Privacy Act , examples are provided in the definition of " “personal information” " in subsection 1 (

n) of Alberta’s Freedom of Information and Protection of Privacy Act , RSA 2000, c F-25 , which has purposes equivalent to aspects of the ATIA and the Privacy Act . [ 45 ] At paragraph 49 of Leon’s , Justice Slatter for the majority concluded that while driver’s licence numbers were personal information, vehicle licence plate numbers were not: The adjudicator’s conclusion that the driver’s licence number is “personal information” is reasonable, because it (like a social insurance number or a passport number) is uniquely related to an individual.

With access to the proper database, the unique driver’s licence number can be used to identify a particular person: Gordon [ … ] at paras. 32-4 . But a vehicle licence is a different thing. It is linked to a vehicle, not a person. The fact that the vehicle is owned by somebody does not make the licence plate number information about that individual. It is “about” the vehicle . The same reasoning would apply to vehicle information (serial or VIN) numbers of vehicles. Likewise a street address identifies a property, not a person, even though someone may well live in the property.

The licence plate number may well be connected to a database that contains other personal information, but that is not determinative.

The appellant had no access to that database, and did not insist that the customer provide access to it. [Emphasis added; citation abbreviated.] [ 46 ] Justice Conrad in dissent agreed with the conclusion of the majority regarding driver’s licence numbers, but would also have upheld the adjudicator’s conclusion that licence plate numbers were " “personal information.” " While recognizing that the question was " “not as clear” " as for a driver’s licence number, Justice Conrad noted that as with a driver’s licence number, a licence plate number " “when searched in the appropriate database, also produces information about the owner” " : Leon’s at para 119. [ 47 ] Both sets of reasons in Leon’s recognized that numbers that are assigned to an object are qualitatively different from those that are assigned to an individual.

A number that is assigned to an individual, such as a social insurance number, health insurance number or passport number, is inherently " “personal” " and is recognized as " “personal information” " by the example in subsection 3 (

c) of the Privacy Act : " “any identifying number, symbol or other particular assigned to the individual .” " [Emphasis added.] Such information is exempt from disclosure under section 19(1) of the ATIA , without the need to establish that it could be used to obtain further personal information. [ 48 ] A number that is assigned to an object does not have this feature of being inherently personal. The serial numbers at issue are of this nature: they are assigned to a particular firearm rather than to an individual, they do not on their face reveal personal information, and they do not fall within subsection 3 (

c) of the Privacy Act . However, this does not end the inquiry. As set out in Dagg , the question remains whether the serial numbers fall within the general definition of " “personal information” " by being " “about an identifiable individual.” " In such a case, as the RCMP submits, the information would be about both the object and the individual.

(2) The test for assessing whether information is " “about” " an identifiable person [ 49 ] Even facially impersonal information may be " “personal information” " if it is associated with an identifiable individual in a manner or context that reveals personal information.

Thus, for example, this Court in Gordon found that the " “province” " field in the Canadian Adverse Drug Reactions Information System (CADRIS) was personal information, since it could be used together with released CADRIS information and other public information such as obituaries to greatly increase the ability to identify particular individuals.

In the present case, if the firearm serial numbers could be linked with identifiable individuals, this would reveal that those individuals were gun owners, which the parties agreed is " “personal information.” " [ 50 ] As set out above, the Court in Gordon phrased the relevant question as being whether there is a " “serious possibility that an individual could be identified through the use of that information, alone or in combination with other available information.” " In NavCanada , the Federal Court of Appeal described an identifiable individual as " “someone whom it is reasonable to expect can be identified from the information in issue when combined with information from sources otherwise available.” " [ 51 ] The parties expressed disagreement with respect to three aspects of these tests: the nature of the " “serious possibility” " and " “reasonable to expect” " standards; the scope of " “available information” " to be considered for purposes of the assessment; and the Information Commissioner’s reliance on NavCanada . (a) " “serious possibility” " / " “reasonable to expect” "

[ 52 ] The Information Commissioner submitted that the " “serious possibility” " and " “reasonable to expect” " standards were substantially the same. They submitted that " “reasonable to expect” " was equivalent to the " “could reasonably be expected” " language in paragraph 20(1) (

c) of the ATIA , which was interpreted in Merck Frosst as an " “expectation for which real and substantial grounds exist when looked at objectively” " : Merck Frosst at para 204 . The Minister disputed the applicability of Merck Frosst , noting that it addressed a statutory test for establishing harm, and that the

section 19 exemption is a class exemption and not an injury-based one. [ 53 ] I agree that standards and approaches applicable to

section 20 of the ATIA are not necessarily applicable to

section 19 , given the different nature of the interests at stake in the two sections. At the same time, however, the " “serious possibility” " of Gordon and the " “reasonable to expect” " of NavCanada both appear to convey effectively the same standard: a possibility that is greater than speculation or a " “mere possibility,” " but does not need to reach the level of " “more likely than not” " ( i.e. , need not be " “probable” " on a balance of probabilities).

Applying such a standard recognizes the importance of access to information by not exempting information from disclosure on the basis of mere speculative possibilities, while respecting the importance of privacy rights and the inherently prospective nature of the analysis by not requiring an unduly high degree of proof that personal information will be released. [ 54 ] Beyond this, it seems unnecessary, and may even be impossible, to try to further subdivide or parse the requisite degree of likelihood that an individual could be identified.

For ease of reference, and since both parties accepted the formulation of Gordon , I will use the " “serious possibility” " language to express the applicable standard described above. (b) " “available information” " [ 55 ] The parties have a more substantial disagreement regarding what should be considered " “available information” " for assessing whether the information at issue, in combination with other available information, could identify an individual. Is it only information that is available to the general public? Does it include more narrowly available information?

Or could it even include information that is only in the hands of the government or the requester? [ 56 ] The issue arises since the RCMP asserts that access to the serial numbers could lead to disclosure of personal information in several different ways. First, the RCMP argues that if the serial numbers were released, the owners of the firearms could each identify themselves by linking their own firearm serial number to the information disclosed.

Second, the RCMP argues that the serial numbers could be linked to personal information contained in one of four government databases, namely the CFIS database, the Canadian Police Information Centre (CPIC) database, the Canadian Firearms Registry On-line (CFRO) database, and the Public Agents Firearms database. Third, the RCMP argues that the serial numbers could be linked to personal information in the hands of private businesses, such as firearms manufacturers or shooting clubs.

In the RCMP’s submission, for information to fall outside the exemption in subsection 19(1), it should not be seriously possible for anyone to identify an individual, including the government institution itself or the very person to whom the information relates. [ 57 ] The Information Commissioner, on the other hand, suggested that information should only be considered " “available information” " if it is publicly available, relying on passages in Gordon that refer to disclosure " “in conjunction with other publicly available information.” " The Information Commissioner accepted that the information need not be easily available, but suggested that it must be available to an " “informed and knowledgeable member of the public.” " [ 58 ] In my view, the appropriate approach to " “available information” " lies between the Minister’s position and that of the Information Commissioner. [ 59 ] I agree with the Information Commissioner that information that is kept confidential in the hands of the government institution cannot be considered " “available” " for purposes of the analysis.

Information requested under the ATIA is by definition already held by a government institution. The purpose of section 19(1) of the ATIA is to avoid disclosing personal information to requesters, not to avoid " “disclosing” " it to the government institution that already has it. [ 60 ] If information were to be considered personal information simply because the government institution could itself use it to identify an individual, this would effectively capture (and exempt from disclosure) a wide variety of impersonal information.

Indeed, in the present case, any and all of the information in the chart at issue could be considered " “personal information” " on the RCMP’s approach since the RCMP—being in possession of the unredacted chart and having access to the databases—could use it to identify an individual.

The same is true of a variety of documents that are commonly released with personal information such as names and addresses removed; the government institution itself would remain able to " “identify” " the individuals whose names have been removed simply by referring to the original document. [ 61 ] Similarly, the fact that an individual may be able to identify themselves from released information does not make that information " “personal information.” " The goal of the Privacy Act and subsection 19(1) of the ATIA is to prevent the undue disclosure of one’s personal information to others, not to oneself.

Indeed, the Privacy Act expressly provides individuals with a right of access to personal information about themselves in the hands of a government institution: Privacy Act at ss 2, 12.

That an individual might know that it is their name that is redacted from a document, for example, does not make the remainder of the document personal information. [ 62 ] On the other hand, limiting the approach to " “available information” " to information that is available to the public at large, even an " “informed and knowledgeable member of the public” " as proposed by the Information Commissioner, risks an inappropriate disclosure of personal information and undermines the " “paramount” " status of privacy rights.

The importance of privacy rights is such that unauthorized release of personal information should be avoided, even if only some members of the public could draw the connections that would link the information to an identifiable individual. [ 63 ] An example will help illustrate the concern. An employer will often have information regarding its employees that is not available to the general public. Information in a released record might allow the employer to use their special knowledge to identify an employee even if an " “informed and knowledgeable member of the public” " could not.

The result could be the disclosure of personal information to the employer—health information, financial status, union activities, or other personal information—that they are not already privy to,

contrary to the objectives of the ATIA and the Privacy Act.

Thus even information not available to an informed and knowledgeablemember of the general public may potentially be used to identify an individual and result in the inappropriate release of personalinformation. [64] At the same time, if the record to be released would only repeat information already known to the employer (e.g., if they alreadypossess an unredacted copy of the record in question), then the employer’s ability to "“identify”" the individual from the informationmay not mean that personal information would be disclosed by releasing the record. [65] That "“available information”" may go beyond what is in the hands of an "“informed and knowledgeable member of the public”" isconsistent with both Gordon and NavCanada.

Justice Gibson in Gordon did conclude that the "“province”" field at issue in that casecould be used in conjunction with other "“publicly available information”" to identify individuals. However, Justice Gibson does notappear to have intended to limit the analysis to information available to the public at large.

At paragraphs 33-34 of his reasons, hereferred to the relevant available information as "“including”" publicly available sources, and adopted the Privacy Commissioner’sformulation, which does not include the "“publicly available”" qualifier: Thus, information recorded in any form is information “about” a particular individual if it “permits” or “leads” to thepossible identification of the individual, whether alone or when combined with information from sources “otherwiseavailable” including sources publicly available.

Counsel for the Privacy Commissioner, the Intervener, urged the adoption of the following test in determining wheninformation is about an identifiable individual: Information will be about an identifiable individual where there is a serious possibility that an individual couldbe identified through the use of that information, alone or in combination with other available information.

I am satisfied that the foregoing is an appropriate statement of the applicable text. [Emphasis added.] [66] Similarly, in NavCanada, the Court of Appeal adopted the "“reasonable to expect”" formulation referring simply to "“sourcesotherwise available”" without requiring that it be publicly available: NavCanada at para 43. In doing so, the Court of Appeal citedOntario (Attorney General) v Pascoe, (ONSCDC), aff’d (ONCA) [Pascoe].

There, the OntarioDivisional Court noted that a person might be identifiable from a record "“where he or she could be identified by those familiar with theparticular circumstances or events contained in the record.”" [Emphasis added]: Pascoe at para 15.

The Divisional Court thus recognizedthat the information may be held by a smaller subset of the public and still be considered "“available”" in assessing whether anindividual may be identified as the result of information being released. [67] As will be clear from the illustrative example given above and the facts in Gordon, NavCanada and Pascoe, the assessment ofwhether there is a serious possibility that an individual could be identified—by someone other than the government institution or theindividual themselves—will of necessity be dependent on the particular facts, including the type of information at issue, the context inwhich it appears in the records at issue, and the nature of the other information that is available.

The ultimate question is and shouldremain focused on whether release of the record will result in the disclosure of personal information, either directly or through theserious possibility that an individual could be identified. [68] I note for clarity that subsection 8(2) of the Privacy Act contains provisions regarding the disclosure of information from onegovernment entity to another. Those provisions do not arise in this matter and nothing in the foregoing should be taken as affecting thatquestion. (

c) Relevance of the "“concept of privacy”" [69] The RCMP submitted that the Information Commissioner’s reliance on NavCanada reflected an overly narrow approach to theconcept of "“personal information”" by requiring that information touch on "“concepts of intimacy, identity, dignity and integrity of theindividual”": NavCanada at paras 52-54.

The RCMP argued that the broader approach reflected in Canada (Minister of Health) vJanssen-Ortho Inc., 2007 FCA 252 [Janssen-Ortho] is to be preferred. [70] There has been suggestion that these two cases from the Federal Court of Appeal represent different approaches to personalinformation that have to be resolved.

In recent companion cases, Suncor Energy Inc v Canada-Newfoundland and Labrador OffshorePetroleum Board, 2018 FCA 11 [Suncor] and Husky Oil, the Federal Court of Appeal was invited to resolve the "“apparentcontradiction”" between NavCanada and Janssen-Ortho: Suncor at para 16; Husky Oil at paras 33, 59.

While Justice de Montignyaddressed this question, noting that in his view "“these two decisions are not necessarily inconsistent,”" the majority of the Court felt itunnecessary to do so: Husky Oil at paras 33-46 per de Montigny JA, paras 56, 59-60 per Gauthier JA. [71] In the present case, the issue does not arise and the approaches in the two cases need not be addressed at length for two reasons.First, the Information Commissioner relies on NavCanada not for its discussion of the concept of privacy, but for its conclusion that anidentifiable individual is one whom it is "“reasonable to expect can be identified from the information in issue when combined withinformation from sources otherwise available.”" As noted above, that test is effectively the same as the test in Gordon, which relied onNavCanada and which the RCMP accepts.

Second, the parties did not dispute—and the Court agrees—that whether an individual is afirearm owner constitutes personal information, regardless of whether it is viewed through the lens of NavCanada or Janssen-Ortho. Tothe extent that there is a difference in approach reflected in NavCanada and Janssen-Ortho, it does not affect the assessment in thecurrent case.

(3) There is no serious possibility that the firearm serial numbers could be used to identify an individual [72] As set out above, the RCMP argues that if the serial numbers were released, individuals could be identified as owners of thefirearms by (

i) the individuals themselves recognizing their own firearm serial number; (ii) the government institution using information

contained in the CFIS, CPIC, CFRO or Public Agents Firearms databases; or (iii) a third party, using the serial number(

s) to obtain information from one of these databases or from a private business, such as firearms manufacturers or shooting clubs. [ 73 ] I have explained above why I reject the RCMP’s contention that the serial numbers are " “personal information” " based on an individual’s ability to identify their own serial number. Similarly, I have explained why the government’s own ability to access one of the identified databases and correlate the serial number with a name does not make the serial number personal information. [ 74 ] The RCMP’s expert, Mr.

Smith, confirmed that the identified databases are government data banks, and that there are security measures in effect regarding access to them. Those with access to the database already have access to the serial number, the name and all other personal information contained in the database. Release of the serial number would therefore add nothing to their ability to access both the serial number and the personal information in the database. Mr.

Smith, perhaps not surprisingly, did not give evidence suggesting that unauthorized individuals would have any serious possibility of accessing the restricted firearms databases, or that their ability to do so would be increased by having the serial numbers. Such information cannot be considered " “available information” " for purposes of assessing whether an individual could be identified as the result of release of the serial numbers. [ 75 ] Mr.

Smith did give evidence that there is a website associated with the CPIC database that allows the public to input a serial number to determine whether a firearm has been reported stolen. He suggested that with this information and other publicly available information, such as news reports of crime events, this could allow the serial number to be linked to a particular individual. While this evidence comes closer to the type of evidence at issue in Gordon , it is insufficient to go beyond mere speculation.

There was no evidence filed that any of the Sig Sauer firearms in question were stolen or would be identified on the public website—Mr. Smith did not conduct such searches—or that even if they were, how crime reports could be used to link the serial number to a particular individual. This is in contrast to the evidence provided in Gordon , which showed that information from the CADRIS database had in fact been used to identify individuals, and that the disclosure of the " “province” " field increased the possibility of that occurring: Gordon at paras 35-43 . [ 76 ] Mr.

Smith also asserted that having the serial numbers could permit someone to obtain personal information from private businesses, namely the manufacturer or a gun club. This could be done in one of two ways. First, some manufacturers will provide what is termed a " “factory letter,” " based on the make, model and serial number of the firearm. The factory letter sets out when the firearm was manufactured and sold, and to whom it was first sold (which could be an individual, a business or a government entity).

Regardless of whether such information might be obtained in certain cases, the evidence was that Sig Sauer does not provide factory letters, so it can have no bearing on whether the serial numbers at issue are personal information. [ 77 ] Second, Mr. Smith suggested that the serial number could be used to fraudulently obtain personal information from Sig Sauer, such as a name and address associated with a warranty registration. While this might be possible in theory, Mr.

Smith provided no evidence regarding how Sig Sauer responds to requests for information, or how likely it would be that Sig Sauer would have or could be convinced to release that information.

In the absence of further evidence, the suggestion that an individual could use the serial numbers to trick Sig Sauer into releasing personal information remains in the realm of speculation or " “mere possibility.” " I am not satisfied that the evidence shows that this is a serious possibility. [ 78 ] Similarly, there is no evidence beyond speculation about the ability to use the serial numbers to obtain information from gun clubs. Mr. Smith indicated that the extent to which gun clubs collect personal information regarding members or visitors varies depending on the club.

In any event, to the extent that a gun club obtains personal information, its use and protection of that information would be subject to privacy legislation, provincially or under the Personal Information Protection and Electronic Documents Act , SC 2000, c 5 . Again, there was no evidence beyond mere speculation that would satisfy the RCMP’s onus to demonstrate that there is a serious possibility that an individual with access to the serial numbers could use it to convince a gun club or other business to circumvent their privacy obligations. [ 79 ] Finally, I note that Mr.

Smith gave evidence that some firearms are sufficiently rare that only one is present in Canada, such that the make and model may alone be enough to uniquely identify the firearm and link it to an individual. Accepting that this may be so, it is not the case with the Sig Sauer P226 firearms that are at issue in this case. [ 80 ] I therefore conclude that there is no serious possibility that the Sig Sauer firearm serial numbers at issue could be used, alone or in combination with other available information, to identify an individual. The serial numbers are not " “personal information” " within the meaning of

section 3 of the Privacy Act and are not exempt from disclosure under subsection 19(1) of the ATIA . [ 81 ] While Mr. Smith gave brief evidence, which he described as " “additional considerations,” " regarding the potential for use of serial numbers in other manners that might have a negative impact on law enforcement, this evidence was scant, and no claim was made by the RCMP that the serial numbers were exempt from disclosure pursuant to

section 16 of the ATIA . As no other basis for redaction was asserted by the RCMP, the serial numbers at issue will be ordered released to the requester. B. The RCMP did not reasonably exercise its discretion under subsection 19(2) of the ATIA [ 82 ] Having determined that the information was personal information exempt from disclosure under subsection 19(1) of the ATIA , the RCMP concluded that it should not exercise its discretion under subsection 19(2) to nevertheless release the information. As set out above, subsection 19(2) permits the head of a government institution to release the information as a discretionary matter where (

a) the individual to whom it relates consents to the disclosure, (

b) the information is publicly available, or (

c) the disclosure is in accordance with

section 8 of the Privacy Act . [ 83 ] As I have found that the information in question is not personal information, subsection 19(2) does not come into play. Had I concluded otherwise, I would have found that the matter should be sent back to the RCMP for redetermination, as there is no indication that the RCMP gave substantive consideration to the release of the information in the public interest.

[ 84 ] In their letter of submission to the Information Commissioner in the course of the investigation, the RCMP stated the following regarding the exercise of discretion under subsection 19(2): As required during the course of our review, due consideration was given to the exercise of discretion as outlined in subsection 19(2) of the Act. It was established during the course of the exercise that there was no existence of consent and no likelihood of consent from individual gun owners could be obtained and would be [ sic ] unreasonable to attempt consent for release.

The information ultimately withheld under 19(1) in this instance had not been previously made public. Finally, the test governing a disclosure in the public interest could not be met. [ 85 ] Similarly, on this application, Ms. Holub provided the following evidence regarding the exercise of discretion: The RCMP also considered the potential exercise of discretion under subsection 19(2) of the ATIA . In making the determination that discretion should not be exercised to disclose the serial numbers, the following factors were considered: (

a) no consent to disclosure existed from the individual firearm owners, obtaining their consent was unlikely and attempting to obtain their consent would be unreasonable; (

b) the serial numbers have not been made public; and (

c) it was not in the public interest to disclose the serial numbers. [ 86 ] The foregoing evidence confirms that paragraphs 19(2) (

a) and (

b) of the ATIA are not applicable, since there was no consent to release from those affected, and the serial numbers are not already public. However, with respect to paragraph 19(2)( c ), the RCMP’s analysis appears to be limited to bald statements that " “the test governing a disclosure in the public interest could not be met” " and " “it was not in the public interest to disclose the serial numbers.” " While these statements indicate that the RCMP is aware of and has at least turned its mind to subparagraph 8(2) ( m )(

i) of the Privacy Act , they contain no statement of the grounds for the conclusion reached. [ 87 ] Where a decision-maker has provided no grounds at all for having exercised their discretion, a reviewing court is effectively prevented from assessing whether the decision is a reasonable one.

As the Federal Court of Appeal noted in Leahy v Canada (Citizenship and Immigration) , 2012 FCA 227 at para 121 : If the reasons for decision are non-existent, opaque or otherwise indiscernible, and if the record before the administrative decision-maker does not shed light on the reasons why the administrative decision-maker decided or could have decided in the way it did, the requirement that administrative decisions be transparent and intelligible is not met... [Citations omitted.] [ 88 ] Similarly, Justice Simon Noël of this Court stated in Canada (Information Commissioner) v Canada (Transport) , 2016 FC 448 at para 66 that in exercising a discretion under the ATIA , " “the decision-maker cannot simply state that he has considered all of the relevant factors; he must concretely demonstrate how he has considered them.” " [ 89 ] In the present case, neither the reasons nor the record provides any indication as to why or how the RCMP reached its conclusion regarding public interest.

The RCMP pointed to two aspects of the record as providing a reasonable basis for the exercise of discretion. I disagree that either provides any explanation as to why the RCMP exercised the discretion as it did. [ 90 ] First, the RCMP pointed to Mr. Smith’s opinion that in light of " “the impact on individuals, the effect on law enforcement, and the current practice of non-disclosure of the serial number information, that it is not good public policy, or in the public interest, to disclose serial numbers of firearms.” " However, as counsel accepted during argument, Mr.

Smith was presented as an independent expert and not as a witness to attest to the RCMP’s reasons for the exercise of the discretion. There is no evidence that the issues considered by Mr. Smith were considered by the access officer. In any event, Mr. Smith’s evidence does not address the issue raised in subparagraph 8(1) ( m )(

i) of the Privacy Act , namely whether the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure. [ 91 ] Second, during oral argument counsel suggested that the RCMP’s letter to the Information Commissioner showed that in exercising discretion under paragraph 19(2)( c ), the RCMP considered that there was no consent to release from the individuals and that the information was not otherwise public. However, these are simply the circumstances in which discretion may be exercised under paragraphs 19(2)(

a) or ( b ). Paragraph 19(2)(

c) is set out in the ATIA as a separate basis for the exercise of discretion. Even if these were the reasons given for exercise of discretion under paragraph 19(2)(

c) and not—as it appears—the RCMP’s conclusions with respect to paragraphs 19(2)(

a) and ( b ), it would be insufficient and unreasonable to simply conclude that the discretion under paragraph 19(2)(

c) should not be exercised because the circumstances of paragraphs 19(2)(

a) and (

b) are not met. [ 92 ] I hasten to point out that the explanation given for a decision on the exercise of discretion under paragraph 19(2)(

c) of the ATIA and subparagraph 8(2) ( m )(

i) of the Privacy Act need not be extensive or detailed. Similarly, an explanation need not be given for every paragraph in subsection 8(2) where, as here, it is perfectly clear that most of the exceptions can have no application at all. However, exercise of the discretion requires a sufficiently " “transparent and intelligible” " explanation of why it is considered that the public interest in disclosure does or does not clearly outweigh the relevant invasion of privacy. The RCMP did not meet that standard. VI.

Conclusion [ 93 ] The only ground raised for refusing release of the firearm serial numbers was that the numbers were " “personal information.” " I conclude that the serial numbers are not " “personal information” " within the definition of

section 3 the Privacy Act . Having found that the refusal to disclose is not authorized by subsection 19(1) of the ATIA , and in accordance with

section 49 of the ATIA , the firearm serial numbers shall be ordered released to the requester. Neither party requested costs, and no costs are ordered. JUDGMENT IN T-1682-18

THIS COURT’S JUDGMENT is that 1 . The record identified by the Royal Canadian Mounted Police as responsive to the request for access made under the Access to Information Act shall be released to the requester without redaction of the Sig Sauer P226 firearm serial numbers. 2 .

There is no order as to costs. “Nicholas McHaffie” Judge APPENDIX A Statutory Provisions as They Read at the Time of the Complaint Access to Information Act , RSC 1985, c A-1 " Purpose " " Objet " " 2 (1) " " The purpose of this Act is to extend the present laws of Canada to provide a right of access to information in records under the control of a government institution in accordance with the principles that government information should be available to the public, that necessary exceptions to the right of access should be limited and specific and that decisions on the disclosure of government information should be reviewed independently of government.

" " 2 (1) " " La présente loi a pour objet d’élargir l’accès aux documents de l’administration fédérale en consacrant le principe du droit du public à leur communication, les exceptions indispensables à ce droit étant précises et limitées et les décisions quant à la communication étant susceptibles de recours indépendants du pouvoir exécutif.

" " Complementary procedures " " Étoffement des modalités d’accès " " (2) " " This Act is intended to complement and not replace existing procedures for access to government information and is not intended to limit in any way access to the type of government information that is normally available to the general public. " " (2) " " La présente loi vise à compléter les modalités d’accès aux documents de l’administration fédérale; elle ne vise pas à restreindre l’accès aux renseignements que les institutions fédérales mettent normalement à la disposition du grand public.

" " Right to access to records " " Droit d’accès " " 4 (1) " " Subject to this Act, but notwithstanding any other Act of Parliament, every person who is " " 4 (1) " "

Sous réserve des autres dispositions de la présente loi mais nonobstant toute autre loi fédérale, ont droit à l’accès aux documents relevant d’une institution fédérale et peuvent se les faire communiquer sur demande : " " (

a) a Canadian citizen, or " "

a) les citoyens canadiens; " " (

b) a permanent resident within the meaning of subsection 2(1) of the Immigration and Refugee Protection Act , " "

b) les résidents permanents au sens du paragraphe 2(1) de la

Loi sur l’immigration et la protection des réfugiés . " " has a right to and shall, on request, be given access to any record under the control of a government institution. " " [BLANK] " " […] " " […] " " Personal information " " Renseignements personnels " " 19 (1) " " Subject to subsection (2), the head of a government institution shall refuse to disclose any record requested under this Act that contains personal information as defined in

section 3 of the Privacy Act . " " 19 (1) " "

Sous réserve du paragraphe (2), le responsable d’une institution fédérale est tenu de refuser la communication de documents contenant les renseignements personnels visés à l’

article 3 de la

Loi sur la protection des renseignements personnels . " " Where disclosure authorized " " Cas où la divulgation est autorisée "

" (2) " " The head of a government institution may disclose any record requested under this Act that contains personal information if " " (2) " " Le responsable d’une institution fédérale peut donner communication de documents contenant des renseignements personnels dans les cas où : " " (

a) the individual to whom it relates consents to the disclosure; " "

a) l’individu qu’ils concernent y consent; " " (

b) the information is publicly available; or " "

b) le public y a accès; " " (

c) the disclosure is in accordance with

section 8 of the Privacy Act . " "

c) la communication est conforme à l’

article 8 de la

Loi sur la protection des renseignements personnels . " " Receipt and investigation of complaints " " Réception des plaintes et enquêtes " " 30 (1) " " Subject to this Act, the Information Commissioner shall receive and investigate complaints " " 30 (1) " "

Sous réserve des autres dispositions de la présente loi, le Commissaire à l’information reçoit les plaintes et fait enquête sur les plaintes : " " (

a) from persons who have been refused access to a record requested under this Act or a part thereof; " "

a) déposées par des personnes qui se sont vu refuser la communication totale ou partielle d’un document qu’elles ont demandé en vertu de la présente loi; " " […] " " […] " " (

f) in respect of any other matter relating to requesting or obtaining access to records under this Act. " "

f) portant sur toute autre question relative à la demande ou à l’obtention de documents en vertu de la présente loi. " " […] " " […] " " Notice of intention to investigate " " Avis d’enquête " " 32 " " Before commencing an investigation of a complaint under this Act, the Information Commissioner shall notify the head of the government institution concerned of the intention to carry out the investigation and shall inform the head of the institution of the substance of the complaint.

" " 32 " " Le Commissaire à l’information, avant de procéder aux enquêtes prévues par la présente loi, avise le responsable de l’institution fédérale concernée de son intention d’enquêter et lui fait connaître l’objet de la plainte.

" " Findings and recommendations of Information Commissioner " " Conclusions et recommandations du Commissaire à l’information " " 37 (1) " " If, on investigating a complaint in respect of a record under this Act, the Information Commissioner finds that the complaint is well- founded, the Commissioner shall provide the head of the government institution that has control of the record with a report containing " " 37 (1) " " Dans les cas où il conclut au bien-fondé d’une plainte portant sur un document, le Commissaire à l’information adresse au responsable de l’institution fédérale de qui relève le document un rapport où : " " (

a) the findings of the investigation and any recommendations that the Commissioner considers appropriate; and " "

a) il présente les conclusions de son enquête ainsi que les recommandations qu’il juge indiquées; " " (

b) where appropriate, a request that, within a time specified in the report, notice be given to the Commissioner of any action taken or proposed to be taken to implement the recommendations contained in the report or reasons why no such action has been or is proposed to be taken. " "

b) il demande, s’il le juge à propos, au responsable de lui donner avis, dans un délai déterminé, soit des mesures prises ou envisagées pour la mise en oeuvre de ses recommandations, soit des motifs invoqués pour ne pas y donner suite. " " Report to complainant and third parties " " Compte rendu au plaignant "

" (2) " " The Information Commissioner shall, after investigating a complaint under this Act, report to the complainant and any third party that was entitled under subsection 35(2) to make and that made representations to the Commissioner in respect of the complaint the results of the investigation, but where a notice has been requested under paragraph (1)(

b) no report shall be made under this subsection until the expiration of the time within which the notice is to be given to the Commissioner. " " (2) " " Le Commissaire à l’information rend compte des conclusions de son enquête au plaignant et aux tiers qui pouvaient, en vertu du paragraphe 35(2), lui présenter des observations et qui les ont présentées; toutefois, dans les cas prévus à l’alinéa (1)b), le Commissaire à l’information ne peut faire son compte rendu qu’après l’expiration du délai imparti au responsable de l’institution fédérale.

" " Matter to be included in report to complainant " " Éléments à inclure dans le compte rendu " " (3) " " Where a notice has been requested under paragraph (1)(

b) but no such notice is received by the Commissioner within the time specified therefor or the action described in the notice is, in the opinion of the Commissioner, inadequate or inappropriate or will not be taken in a reasonable time, the Commissioner shall so advise the complainant in his report under subsection (2) and may include in the report such comments on the matter as he thinks fit.

" " (3) " " Le Commissaire à l’information mentionne également dans son compte rendu au plaignant, s’il y a lieu, le fait que, dans les cas prévus à l’alinéa (1)b), il n’a pas reçu d’avis dans le délai imparti ou que les mesures indiquées dans l’avis sont, selon lui, insuffisantes, inadaptées ou non susceptibles d’être prises en temps utile. Il peut en outre y inclure tous commentaires qu’il estime utiles.

" " Access to be given " " Communication accordée " " (4) " " Where, pursuant to a request under paragraph (1)(b), the head of a government institution gives notice to the Information Commissioner that access to a record or a part thereof will be given to a complainant, the head of the institution shall give the complainant access to the record or part thereof " " (4) " " Dans les cas où il fait suite à la demande formulée par le Commissaire à l’information en vertu de l’alinéa

(1) b) en avisant le Commissaire qu’il donnera communication totale ou partielle d’un document, le responsable d’une institution fédérale est tenu de donner cette communication au plaignant : " " (

a) forthwith on giving the notice if no notice is given to a third party under paragraph 29(1)(

b) in the matter; or " "

a) immédiatement, dans les cas où il n’y a pas de tiers à qui donner l’avis prévu à l’alinéa 29(1)b); " " (

b) forthwith on completion of twenty days after notice is given to a third party under paragraph 29(1)(b), if that notice is given, unless a review of the matter is requested under

section 44. " "

b) dès l’expiration des vingt jours suivant l’avis prévu à l’alinéa 29(1)b), dans les autres cas, sauf si un recours en révision a été exercé en vertu de l’article 44.

" " Right of review " " Recours en révision " " (5) " " Where, following the investigation of a complaint relating to a refusal to give access to a record requested under this Act or a part thereof, the head of a government institution does not give notice to the Information Commissioner that access to the record will be given, the Information Commissioner shall inform the complainant that the complainant has the right to apply to the Court for a review of the matter investigated.

" " (5) " " Dans les cas où, l’enquête terminée, le responsable de l’institution fédérale concernée n’avise pas le Commissaire à l’information que communication du document ou de la

partie en cause sera donnée au plaignant, le Commissaire à l’information informe celui-ci de l’existence d’un droit de recours en révision devant la Cour.

" " Review by Federal Court " Révision par la Cour fédérale " " " 41 " " Any person who has been refused access to a record requested under this Act or a part thereof may, if a complaint has been made to the Information Commissioner in respect of the refusal, apply to the Court for a review of the matter within forty-five days after the time the results of an investigation of the complaint by the Information Commissioner are reported to the complainant under subsection 37(2) or within such further time as the Court may, either before or after the expiration of those forty-five days, fix or allow.

" 41 La personne qui s’est vu refuser communication totale ou partielle d’un document demandé en vertu de la présente loi et qui a déposé ou fait déposer une plainte à ce sujet devant le Commissaire à l’information peut, dans un délai de quarante-cinq jours suivant le compte rendu du Commissaire prévu au paragraphe 37(2), exercer un recours en révision de la décision de refus devant la Cour. La Cour peut, avant ou après l’expiration du délai, le proroger ou en autoriser la prorogation. " "

" Information Commissioner may apply or appear " " Exercice du recours par le Commissaire, etc. " " 42 (1) " " The Information Commissioner may " " 42 (1) " " Le Commissaire à l’information a qualité pour : " " (

a) apply to the Court, within the time limits prescribed by

section 41, for a review of any refusal to disclose a record requested under this Act or a part thereof in respect of which an investigation has been carried out by the Information Commissioner, if the Commissioner has the consent of the person who requested access to the record; " "

a) exercer lui-même, à l’issue de son enquête et dans les délais prévus à l’article 41, le recours en révision pour refus de communication totale ou partielle d’un document, avec le consentement de la personne qui avait demandé le document; " " (

b) appear before the Court on behalf of any person who has applied for a review under

section 41; or " "

b) comparaître devant la Cour au nom de la personne qui a exercé un recours devant la Cour en vertu de l’article 41; " " (

c) with leave of the Court, appear as a party to any review applied for under

section 41 or 44. " "

c) comparaître, avec l’autorisation de la Cour, comme

partie à une instance engagée en vertu des articles 41 ou 44. " " […] " " […] " " Burden of proof " " Charge de la preuve " " 48 " " In any proceedings before the Court arising from an application under

section 41 or 42, the burden of establishing that the head of a government institution is authorized to refuse to disclose a record requested under this Act or a part thereof shall be on the government institution concerned. " " 48 " " Dans les procédures découlant des recours prévus aux articles 41 ou 42, la charge d’établir le bien-fondé du refus de communication totale ou partielle d’un document incombe à l’institution fédérale concernée.

" " Order of Court where no authorization to refuse disclosure found " " Ordonnance de la Cour dans les cas où le refus n’est pas autorisé " " 49 " " Where the head of a government institution refuses to disclose a record requested under this Act or a part thereof on the basis of a provision of this Act not referred to in

section 50, the Court shall, if it determines that the head of the institution is not authorized to refuse to disclose the record or part thereof, order the head of the institution to disclose the record or part thereof, subject to such conditions as the Court deems appropriate, to the person who requested access to the record, or shall make such other order as the Court deems appropriate.

" " 49 " " La Cour, dans les cas où elle conclut au bon droit de la personne qui a exercé un recours en révision d’une décision de refus de communication totale ou partielle d’un document fondée sur des dispositions de la présente loi autres que celles mentionnées à l’article 50, ordonne, aux conditions qu’elle juge indiquées, au responsable de l’institution fédérale dont relève le document en litige d’en donner à cette personne communication totale ou partielle; la Cour rend une autre ordonnance si elle l’estime indiqué.

" Privacy Act , RSC 1985, c P-21 " Purpose " " Objet " " 2 The purpose of this Act is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information. " " 2 " " La présente loi a pour objet de compléter la législation canadienne en matière de protection des renseignements personnels relevant des institutions fédérales et de droit d’accès des individus aux renseignements personnels qui les concernent. " "

Definitions " " Définitions " " 3 In this Act " " 3 " " Les définitions qui suivent s’appliquent à la présente loi. " " […] " " […] " " personal information means information about an identifiable individual that is recorded in any form including, without restricting the generality of the foregoing, " " renseignements personnels " " Les renseignements, quels que soient leur forme et leur support, concernant un individu identifiable, notamment : " " (

a) information relating to the race, national or ethnic origin, colour, religion, age or marital status of the individual, " "

a) les renseignements relatifs à sa race, à son origine nationale ou ethnique, à sa couleur, à sa religion, à son âge ou à sa situation de famille; "

" (

b) information relating to the education or the medical, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved, " "

b) les renseignements relatifs à son éducation, à son dossier médical, à son casier judiciaire, à ses antécédents professionnels ou à des opérations financières auxquelles il a participé; " " (

c) any identifying number, symbol or other particular assigned to the individual, " "

c) tout numéro ou symbole, ou toute autre indication identificatrice, qui lui est propre; " " (

d) the address, fingerprints or blood type of the individual, " "

d) son adresse, ses empreintes digitales ou son groupe sanguin; " " (

e) the personal opinions or views of the individual except where they are about another individual or about a proposal for a grant, an award or a prize to be made to another individual by a government institution or a part of a government institution specified in the regulations, " "

e) ses opinions ou ses idées personnelles, à l’exclusion de celles qui portent sur un autre individu ou sur une proposition de subvention, de récompense ou de prix à octroyer à un autre individu par une institution fédérale, ou subdivision de celle-ci visée par règlement; " " (

f) correspondence sent to a government institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to such correspondence that would reveal the contents of the original correspondence, " "

f) toute correspondance de nature, implicitement ou explicitement, privée ou confidentielle envoyée par lui à une institution fédérale, ainsi que les réponses de l’institution dans la mesure où elles révèlent le contenu de la correspondance de l’expéditeur; " " (

g) the views or opinions of another individual about the individual, " "

g) les idées ou opinions d’autrui sur lui; " " (

h) the views or opinions of another individual about a proposal for a grant, an award or a prize to be made to the individual by an institution or a part of an institution referred to in paragraph (e), but excluding the name of the other individual where it appears with the views or opinions of the other individual, and " "

h) les idées ou opinions d’un autre individu qui portent sur une proposition de subvention, de récompense ou de prix à lui octroyer par une institution, ou subdivision de celle-ci, visée à l’alinéa e), à l’exclusion du nom de cet autre individu si ce nom est mentionné avec les idées ou opinions; " " (

i) the name of the individual where it appears with other personal information relating to the individual or where the disclosure of the name itself would reveal information about the individual, " "

i) son nom lorsque celui-ci est mentionné avec d’autres renseignements personnels le concernant ou lorsque la seule divulgation du nom révélerait des renseignements à son sujet; " " but, for the purposes of sections 7 , 8 and 26 and

section 19 of the Access to Information Act , does not include " " toutefois, il demeure entendu que, pour l’application des articles 7, 8 et 26, et de l’

article 19 de la

Loi sur l’accès à l’information , les renseignements personnels ne comprennent pas les renseignements concernant : " " (

j) information about an individual who is or was an officer or employee of a government institution that relates to the position or functions of the individual including, " "

j) un cadre ou employé, actuel ou ancien, d’une institution fédérale et portant sur son poste ou ses fonctions, notamment : " " (

i) the fact that the individual is or was an officer or employee of the government institution, " " (

i) le fait même qu’il est ou a été employé par l’institution, " " (ii) the title, business address and telephone number of the individual, " " (ii) son

titre et les adresse et numéro de téléphone de son lieu de travail, " " (iii) the classification, salary range and responsibilities of the position held by the individual, " " (iii) la classification, l’éventail des salaires et les attributions de son poste, " " (iv) the name of the individual on a document prepared by the individual in the course of employment, and " " (iv) son nom lorsque celui-ci figure sur un document qu’il a établi au cours de son emploi, " " (

v) the personal opinions or views of the individual given in the course of employment, " " (

v) les idées et opinions personnelles qu’il a exprimées au cours de son emploi; " " (

k) information about an individual who is or was performing services under contract for a government institution that relates to the services performed, including the terms of the contract, the name of the individual and the opinions or views of the individual given in the course of the performance of those services, " "

k) un individu qui, au

titre d’un contrat, assure ou a assuré la prestation de services à une institution fédérale et portant sur la nature de la prestation, notamment les conditions du contrat, le nom de l’individu ainsi que les idées et opinions personnelles qu’il a exprimées au cours de la prestation; " " (

l) information relating to any discretionary benefit of a financial nat

[…]