GLEN CARTER Applicant v. PRIVACY COMMISSIONER OF CANADA, 2019 FC 783

Date: 20190605 Docket: T-1955-17 Citation: 2019 FC 783 Ottawa, Ontario, June 5, 2019 PRESENT: The Honourable Mr. Justice Zinn BETWEEN: GLEN CARTER Applicant and PRIVACY COMMISSIONER OF CANADA Respondent JUDGMENT AND REASONS [ 1 ] Mr. Carter brings this application to review a decision of the Privacy Commissioner of Canada [the Commissioner] pursuant to

section 41 of the Privacy Act , RSC 1985, c P-21 , and Rule 18.1 of the Federal Courts Act , RSC 1985 c F-7 . [ 2 ] The Commissioner notes at paragraph 29 of his memorandum, and I agree, that while Mr. Carter references Rule 18.1 of the Federal Courts Act , his " “affidavit evidence, arguments, and relief sought are oriented towards a review under

section 41 of the Privacy Act .” " That

section reads as follows: Any individual who has been refused access to personal information requested under subsection 12(1) may, if a complaint has been made to the Privacy Commissioner in respect of the refusal, apply to the Court for a review of the matter within forty-five days after the time the results of an investigation of the complaint by the Privacy Commissioner are reported to the complainant under subsection 35(2) or within such further time as the Court may, either before or after the expiration of those forty-five days, fix or allow. [ 3 ] Nothing material hangs on addressing the matter only under

section 41 of the Privacy Act , as it provides jurisdiction to this Court to review a decision of the Commissioner. [ 4 ] The decision Mr. Carter seeks to be reviewed is a decision of the Commissioner made by email dated July 10, 2017, and later clarified by email dated July 26, 2017 [collectively the Decision]. [ 5 ] The parties agreed that this application would be dealt with in writing based on the extensive records each provided.

The facts set out are based upon affidavit and documentary evidence in those records. [ 6 ] The events leading to the Decision must be set out in some detail, in order to understand the Decision and Mr. Carter’s position in this application. The specific request made by Mr. Carter in 2017, leading to the Decision, was not the first access request he made under the Privacy Act . [ 7 ] On September 5, 2014, Mr. Carter made a request [the 2014 Access Request] to the Office of the Privacy Commissioner [ OPC ] for access to the following personal information pursuant to

section 12 of the Privacy Act : 1. A possible order issued by the Foreign Intelligence Surveillance Court (FISC) to the OPC relating to a demand for collecting personal information about me (Glen Carter). 2. Personal information about me (Glen Carter) that would have been disclosed to a third party (including federal, provincial or municipal governments). 3. Any set of instructions sent to the OPC regarding my personal information. 4. Access to any communication received by the OPC from a third party regarding my federal court application T-1523-08. 5.

Any personal information the OPC would have collected from third parties (including federal, provincial or municipal governments). 6. All personal information contained within complaints I have filed with the OPC . [ 8 ] The OPC responded to the 2014 Access Request by letter dated October 17, 2014, disclosing 347 pages of records, but withholding some information pursuant to the exemptions set out in

section 26 (information about another individual) and

section 22.1 (information obtained by the Commissioner in the course of an investigation) of the Privacy Act . [ 9 ] On November 13, 2014, Mr. Carter made a complaint to the Privacy Commissioner Ad Hoc, seeking a review of the OPC ’s processing of his 2014 Access Request and the exemptions applied in the response. After review, the Privacy Commissioner Ad Hoc found that the complaint was not well-founded.

[ 10 ] Mr. Carter took no further action relating to the 2014 Access Request. [ 11 ] In January, 2017, Mr. Carter made a request [the 2017 Access Request] to the OPC for access to the following personal information pursuant to

section 12 of the Privacy Act : 1. Access to an administrative decision that was secretly taken against me in a closed matter proceeding in 1994 or thereabouts, and contained in documents that I sought to access of OPC in 2015. 2. Access to a list of those parties (Natural persons, Government Departments, Law Enforcement Agencies and Voluntary Organisation) with whom this decision was shared. 3.

Access to all intelligence information featured in the aforementioned documents and relating to actions that were secretly carried out against me. [ 12 ] Uncertain what " “administrative decision” " was referenced in the request, the OPC engaged in a series of email exchanges with Mr. Carter. He, in an email dated March 15, 2017, identified the following file numbers relating to OPC investigations: 7100-03552, 7100- 03537, 7100-03050, and 6100-010427.

He indicated that for each, he was seeking " “full access for all Case Management records” " created by the OPC under subsection 22.1(2) of the Privacy Act , and further requested that " “a review be conducted on the CSIS Exempt Bank: SIS PPU 045.” " [ 13 ] OPC attests that when it compared the file numbers Mr. Carter provided against those in the 2014 Access Request, it was able to confirm that Mr. Carter had previously been given access to his personal information now requested when OPC responded to the 2014 Access Request. This was relayed to Mr.

Carter by email dated March 15, 2017, together with an offer to resend the records disclosed in response to the 2014 Access Request. [ 14 ] Mr. Carter was further informed that it was not the responsibility of OPC to locate records that may be held in data bases by other institutions (i.e. CSIS) and that it considered the request closed with this response. [ 15 ] Mr. Carter responded by email dated March 15, 2017, that he was interested in, and entitled to see, any " “notes, emails[,] communications and letters that were entered into OPC ’s Case Management System” " for the files he had identified.

He renewed his request that OPC conduct a review of the exempt data bank referenced in his request. [ 16 ] OPC responded again on March 16, 2017, that all requested records had previously been produced to him and that it was not responsible for reviewing exempt data banks. Again, he was informed that he could move his complaint to the Privacy Commissioner Ad Hoc, which Mr. Carter did. As before, the Privacy Commissioner Ad Hoc concluded that the complaint was not well-founded. [ 17 ] On March 28, 2017, Mr.

Carter filed three complaints with the OPC against the Department of National Defence, the Canadian Security Intelligence Service, and Immigration, Refugees and Citizenship Canada. OPC concluded that these complaints related to matters it had investigated in response to complaints Mr. Carter had filed in 2007. In its view, Mr. Carter was seeking a review of exemptions these departments had applied to deny him access to certain information in 2007, to see if those exemptions still applied in 2017. [ 18 ] On July 10, 2017, OPC informed Mr. Carter that it would not be accepting his complaints for investigation.

It noted that no review was possible as all records associated with these earlier investigations had been destroyed in accordance with the retention periods for Privacy Act investigation files. He was further advised that he would have to file new requests to access his personal information from these institutions to determine if the exemptions still applied. [ 19 ] In response by email dated July 10, 2017, OPC reiterated that its investigation files relating to his 2007 Privacy Act complaints had been destroyed in accordance with its retention policy.

That policy provides that OPC investigation files are retained for 5 years following the last administrative action conducted under the Privacy Act , and 10 years under the P ersonal Information Protection and Electronic Documents Act, SC 2000, c 5 . [ 20 ] In the course of these proceedings, Mr. Carter moved, pursuant to Rule 317 of the Federal Courts Rules , for an order compelling the OPC to provide certain documents " “once a factual determination has been made… that the Commissioner did not have reasonable grounds to refuse to disclose this personal information.” " That motion was dismissed.

A motion ordering the Court Administrator to prepare the applicant’s record in this proceeding was granted. [ 21 ] The sole issue in this application is this Court’s review of the Commissioner’s Decision pursuant to

section 41 of the Privacy Act . [ 22 ] OPC has filed an affidavit in which its Director of the Access to Information and Privacy [ATIP] division attests that OPC ’s retention policy provides that its files are maintained for five years following the last administrative action. She attests that in accordance with that policy: I understand that records relating to investigation files 7100-03552, 7100-03537, and 7100-03050 no longer exist. However, the ATIP division has a copy of records from the above-noted investigation files that were processed in response to the Applicant’s 2014 access request.

The OPC has already provided the Applicant with access to all of these records in the 2014 release package, with a limited amount of information redacted in accordance with exemptions under the Privacy Act . [ 23 ] No department can provide access to documents no longer in existence. There has been no cross-examination of this affiant, and nothing provided to support that these documents are available.

The only issue then is whether the exemptions claimed by OPC on the still extant documents are reasonable. [ 24 ] Pursuant to a March 13, 2018 Order by Prothonotary Aylen, an affidavit was filed under seal attaching the exempted information. That information was redacted in the filed materials and unreadable. The Court requested, and obtained from OPC , the unredacted

version in order to make an informed assessment of the reasonableness of the claimed exemptions. [ 25 ] The exemptions are claimed pursuant to sections 22.1 and 26 of the Privacy Act , which read as follows: 22.1

(1) The Privacy Commissioner shall refuse to disclose any personal information requested under this Act that was obtained or created by the Commissioner or on the Commissioner’s behalf in the course of an investigation conducted by, or under the authority of, the Commissioner.

(2) However, the Commissioner shall not refuse under subsection (1) to disclose any personal information that was created by the Commissioner or on the Commissioner’s behalf in the course of an investigation conducted by, or under the authority of, the Commissioner once the investigation and all related proceedings, if any, are finally concluded. 26 The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) about an individual other than the individual who made the request, and shall refuse to disclose such information where the disclosure is prohibited under

section 8. The relevant part of

section 8 is subsection 1, which provides " “Personal information under the control of a government institution shall not, without the consent of the individual to whom it relates, be disclosed by the institution except in accordance with this section.” " [ 26 ] Ms. Lessard, in her sealed affidavit, attests the following at paragraph 3: Attached as Exhibit “A” to my confidential affidavit are pages from the 2014 Release Package showing the Withheld Information and the relevant

section of the Privacy Act under which the OPC withheld it from disclosure. [ 27 ] Exhibit A to that affidavit is comprised of 6 documents, as follows: 1 . Access Investigation Report re file 7100-03537 dated September 6, 2008 (2 pages); 2 . Access Investigation Report re file 7100-03537 dated June 19, 2008 (2 pages); 3 . OPC Early Resolution Report, PIPEDA Checklist re file 6100-010427 dated November 30, 2011 (2 pages); 4 . Letter and envelope dated March 27, 2013 from PIPEDA to the Chief Privacy Officer, Royal Bank of Canada re the withdrawal by Mr.

Carter of his complaint against the Royal Bank of Canada on March 27, 2013 (2 pages); 5 . Investigation Plan re PIPEDA-030001 Glen Carter v. Royal Bank of Canada, dated February 15, 2013 (2 pages); and 6 . Documented Events Report Regarding File Number PIPEDA-030001 (4 pages). [ 28 ] I will discuss the redacted information in each. In so doing, I will provide a very general description of the redacted information. [ 29 ] The first two documents, the Access Investigation Reports, redacted the same information, pursuant to

section 22.1 of the Privacy Act , as information OPC obtained in the course of its investigation. The non-disclosure requirement in

section 22.1 is mandatory in the case of information obtained in the course of the investigation; the OPC " “shall” " refuse the disclosure. [ 30 ] The redacted two sentences, describe information obtained from the Department of National Defence relating to its search for records relating to the request and its unsuccessful attempt to contact Mr. Carter. I am satisfied that this information reasonably falls within the scope of

section 22.1(1) of the Privacy Act and not within the exception described in 22.1(2) of the Privacy Act because it was obtained from the Department of National Defence, and as a result the OPC is not permitted to disclose it to Mr. Carter. [ 31 ] The third document, the Early Resolution Report, while included in Exhibit A, has no redacted information indicated. OPC says that it is no longer seeking to exempt any portion of this document from disclosure and has released it to Mr. Carter. [ 32 ] The fourth document, being a letter and envelope to the Chief Privacy Officer of the Royal Bank of Canada, has redacted that person’s name pursuant to

section 26 of the Privacy Act . The redacted information, being personal information of someone other than Mr. Carter, cannot be disclosed " “without the consent of the individual to whom it relates” " as stipulated in subsection 8(1) of the Privacy Act . There being no evidence of consent, the refusal by OPC to disclose this information to Mr. Carter is reasonable and upheld. [ 33 ] The OPC has redacted the name and phone number of the person at the Royal Bank of Canada who was responding on behalf of the Royal Bank of Canada from the fifth document, the Investigation Plan.

As above, the redacted information, being personal information of someone other than Mr. Carter, cannot be disclosed " “without the consent of the individual to whom it relates” " as stipulated in subsection 8(1) of the Privacy Act . There being no evidence of consent, the refusal by OPC to disclose this information to Mr. Carter is reasonable and upheld. [ 34 ] Redacted information on the sixth document, the Documented Events Report, is of two categories.

The first category of redacted information is exactly that referenced in paragraph 31 and for the reasons stated therein, I find it cannot be disclosed by OPC to Mr. Carter. [ 35 ] The second category of redacted information is information obtained from the Royal Bank of Canada relating to how it conducted the search of its records relating to the request. I am satisfied that this information reasonably falls within the scope of

section 22.1(1) of the Privacy Act and not within the exception described in 22.1(2) of the Privacy Act because it was obtained from the Royal Bank of Canada, and as a result the OPC is not permitted to disclose it to Mr. Carter. The decision of the OPC is upheld. [ 36 ] The Commissioner has indicated that he is not seeking costs in this application, and therefore none will be ordered.

JUDGMENT in T-1955-17 THIS COURT’S JUDGMENT is that this application is dismissed, without costs. "Russel W. Zinn" Judge FEDERAL COURT SOLICITORS OF RECORD DOCKET: T-1955-17 STYLE OF CAUSE: GLEN CARTER v PRIVACY COMMISSIONER OF CANADA MOTION DEALT WITH IN WRITING, WITHOUT APPEARANCE OF THE PARTIES, AT OTTAWA, ONTARIO JUDGMENT AND REASONS: ZINN J. DATED: JUNE 5, 2019 WRITTEN SUBMISSIONS BY : Glen Carter For The Applicant (ON HIS OWN BEHALF) Jennifer Seligy Kate Wilson For The Respondent SOLICITORS OF RECORD : - Nil - SELF-REPRESENTED Applicant Office of the Privacy Commissioner of Canada Gatineau (Québec) For The Respondent