PATRICK CAIN Applicant v. MINISTER OF HEALTH, 2023 FC 55

Date: 202301 13 25 Docket: T-645-20 T-641-20 T-637-20 Citation: 2023 FC 55 Ottawa, Ontario, January 13 25 , 2023 PRESENT: Mr. Justice Pentney Dockets: T-641-20, T-645-20 BETWEEN: PATRICK CAIN Applicant and MINISTER OF HEALTH Respondent and THE PRIVACY COMMISSIONER OF CANADA Intervener Docket: T-637-20 BETWEEN: MOLLY HAYES Applicant and MINISTER OF HEALTH Respondent and THE PRIVACY COMMISSIONER OF CANADA Intervener PUBLIC JUDGMENT AND REASONS (Amended Confidential Version issued on January 25, 2023) I.

Introduction [ 1 ] This case concerns a rather unusual question: was Health Canada justified in refusing to release some of the second and third characters of postal codes of individuals licensed to grow medical marijuana under the licensing regime that was in place before it was legalized, as well as the names of some of the cities where such licensed production occurred? [ 2 ] What this case is really about, however, is the balance between the fundamental right to personal privacy and an individual’s right to access information held by the government.

More particularly, the case raises the question of the appropriate analytical approach to measuring privacy risks in relation to the release of information from structured datasets that contain personal information. [ 3 ] The Respondent, Health Canada, released the first character of the relevant postal codes relating to licenses to grow medical marijuana (either for personal use or as a " “designated producer” " for someone else), but refused to release more information.

It takes the position that there is a serious possibility that this data, when combined with other information that is already available, could lead to the identification of specific individuals. [ 4 ] All parties to this proceeding agree that information that could identify a specific individual who has a medical marijuana license is personal information that is protected from disclosure.

The explanation for this is simple: individuals obtained licenses by providing medical information about their health condition to justify their use of medical marijuana, and information about one’s health is among the most deeply personal information imaginable. [ 5 ] The parties disagree, however, about whether the information in dispute, namely the second and third characters of some postal codes and the names of some cities, is personal information.

Health Canada refused to release this information because of the risk that it could be combined with other information already in the public domain to identify specific individuals. The Information Commissioner, on behalf of the Applicants, disputes this. [ 6 ] The parties also disagree about the degree of effort Health Canada is required to undertake in order to release information in a way that protects personal information. Health Canada says it should not be required to assess each of the hundreds of postal codes within the relevant datasets in order to determine whether any of them pose little or no risk.

The Information Commissioner disagrees, arguing that Health Canada has already created a computer code that can automate this process. [ 7 ] The Privacy Commissioner intervened in this case, but limited his submissions to the proper application of the legal tests to the type of structured datasets involved in this case, and the related question of the appropriate analytical framework to be applied in assessing the

privacy risks associated with the release of data from such datasets. [ 8 ] For the reasons that follow, the application is dismissed. I find that Health Canada was justified in refusing to release more information, because of the serious possibility that it could lead to a breach of privacy through the identification of an individual in the datasets. I also find that Health Canada was not required to undertake a more detailed analysis of the risks associated with releasing more information pursuant to its obligation to sever and release as much information as is reasonable. II.

Background [ 9 ] These consolidated applications were brought by the Information Commissioner on behalf of the named Applicants, David Patrick Cain and Molly Hayes, pursuant to subsection 41(1) of the Access to Information Act , RSC 1985, c A-1 [ ATIA ], challenging Health Canada’s refusal to disclose parts of the postal codes and, for Ms. Hayes’ request, the names of cities associated with licenses to grow medical marijuana. Before examining the procedural history of the access to information requests filed by Ms. Hayes and Mr.

Cain, I will begin with a brief explanation about Canadian postal codes, because they are integral to an understanding of the dispute before the Court. A. Postal Codes in Canada [ 10 ] Canadian postal codes contain six characters, divided into two groups of three. The first three characters are called a Forward Sortation Area (FSA), which identify major geographic divisions in an urban or rural location. The last three characters are called a Local Delivery Unit, which identify the smallest delivery zone within an FSA. [ 11 ] The first character of a postal code represents a postal district.

Quebec and Ontario, for example, are divided into three and five postal districts respectively. These provinces have one urban area with a population large enough to have a dedicated postal district represented by a letter ( " “H” " for the Montreal region and " “M” " for Toronto).

By way of contrast, although Nunavut and the Northwest Territories comprise a vast swath of Canada’s geography, their populations are so small that they share a single FSA. [ 12 ] The second character of an FSA identifies the area as either urban or rural, with a zero indicating a wide-area rural region and all other digits indicating urban areas. The third character of the FSA represents a specific rural region, an entire medium-sized city, or a

section of a major city. For example, the first three characters of the Federal Court’s Ottawa postal code (K1A) indicate that its mailing address is located in downtown Ottawa; the final three characters specify the location with a greater degree of precision. [ 13 ] In Canada, an FSA may refer to a densely populated urban location, or a sparsely populated rural area spread over a large territory. Statistics Canada has published a document entitled " “2016 Population and Dwelling Count by FSA” " which shows that in 2016 the majority of FSAs had populations above 10,000.

This document also reveals the wide disparity in population counts, ranging from zero inhabitants to 139,128. B. Molly Hayes’ Request (Court File Number: T-637-20) [ 14 ] In August 2017, Ms.

Hayes made an access to information request to Health Canada for the following information: List of addresses of all licensed personal production ACMPR grow operations in Canada that have been authorized by Health Canada to possess 244 or more indoor marijuana plants, and/or 95 or more outdoor plants, and/or 35,625 grams or more in storage at any time (emphasis in original). [ 15 ] The requested information was obtained by Health Canada under the regulatory regime for the possession and cultivation of medical marijuana that was in place at the time; namely, the Access to Cannabis for Medical Purposes Regulations , SOR/2016-230 [ ACMPR or the Regulations ].

Under this scheme, individuals could apply for licenses to grow their own medical marijuana, either at their place of residence or elsewhere, or they could designate someone else to grow it for them.

In order to obtain such a license, the individuals had to provide personal information about the location where cultivation would occur, as well as medical information justifying their use of medical marijuana. [ 16 ] There had been previous regulations that governed such matters, but this scheme has now been replaced by the Cannabis Act , SC 2018, c 16 and the Cannabis Regulations , SOR/2018-144 . [ 17 ] Health Canada responded to Ms. Hayes’ request on October 16, 2017.

The relevant record, created by the Controlled Substances and Cannabis Branch from a database it maintained, is a list of 575 addresses, including civic numbers, street names, city and province names, and postal codes. Health Canada’s Access to Information and Privacy (ATIP) Division found most of the information to be personal information and thus exempt from disclosure under

section 19 of the ATIA . The ATIP Division applied severance to the record and only disclosed the province names. [ 18 ] On October 31, 2017, Ms. Hayes registered a complaint with the Office of the Information Commissioner about the refusal to disclose the other information. The Information Commissioner agreed with Health Canada that the subsection 19(1) exemption for personal information applied to the civic numbers, street names, and the last three digits of postal codes, and therefore this information was not to be disclosed.

However, the Commissioner asked Health Canada to determine whether additional portions of the postal codes and the city names could be disclosed. Health Canada subsequently agreed to release the first character of the postal code but refused to release any other information, claiming it was " “personal information” " because it could lead to identification of the licensed individual when combined with other, previously released information. Health Canada also asserted that it was unreasonable to require it to analyze each FSA separately to determine the risk of re-identification.

This is discussed in further detail below. [ 19 ] The Information Commissioner agreed with Health Canada that disclosing city names or complete FSAs for locations with a small

population created a risk of identification, but she was not convinced that such a risk arose from the disclosure of city names or FSAs for more populous areas. She also disagreed with Health Canada’s assertion that it was not reasonable to ask it to analyze each FSA to determine which could be disclosed. C. Mr. Cain’s Request (Court File Numbers: T-641-20 and T-645-20) [ 20 ] In October 2017, Mr.

Cain requested access to: A document in a sortable format, such as .txt, .cvs, or .xls, showing the first three characters of the postal codes of personal or designated producers of medical cannabis, or alternatively totals by the first three characters of the postal code, with personal and designated growers broken out from each other.

A document in a sortable format, such as .txt, .cvs, or .xls, showing the first three characters of the postal codes of registered users of medical marijuana, or alternatively totals by the first three characters of the postal code. [ 21 ] In response to the first request, the Controlled Substances and Cannabis Branch created two spreadsheets of information related to personal and designated cannabis producers for medical purposes, listing FSAs and corresponding numbers of registered personal producers (11,100) and registered designated producers (673), respectively. [ 22 ] On the second request, the Branch noted that the term " “registered user” " was not defined under the scheme.

Instead, it created a spreadsheet including the province and FSA for 11,843 individuals, who were licensed to cultivate medical marijuana or had designated someone else to do so on their behalf. [ 23 ] Health Canada’s ATIP unit examined these records, and disclosed the first character of approximately 11,773 FSAs on the first request, and the first character of approximately 11,842 FSAs for the second. As it had done with the Hayes complaint, Health Canada refused to disclose the second and third characters of the FSAs pursuant to subsection 19(1) of the ATIA . Mr.

Cain complained about the incomplete disclosure to the Information Commissioner. [ 24 ] On May 7, 2020, following an investigation of Mr. Cain’s complaint, the Information Commissioner accepted that disclosure of FSAs with small populations would create a serious possibility of identification of individual producers and users, but was not convinced this was the case for most FSAs because their populations were larger.

The Information Commissioner found that Health Canada’s blanket refusal to release more information was not justified, because the risk of re-identification of the designated persons did not meet the legal test, and Health Canada’s refusal to undertake the necessary analysis was not justified. D.

Health Canada’s Final Decisions [ 25 ] On January 20, 2020, Health Canada responded to the Information Commissioner’s reports on the complaints, indicating it did not intend to implement the Information Commissioner’s recommendations to disclose the FSAs and cities. [ 26 ] Health Canada maintained its position that the FSAs and cities were personal information that it was obliged to exempt from disclosure under subsection 19(1) of the ATIA , and explained that it would not release the information under any of the discretionary exceptions listed in subsection 19(2).

It stated that the release of the second and third characters of the FSAs and/or the names of the cities, when combined with other available information (including details disclosed pursuant to previous access requests) would create a serious possibility that individuals could be identified. Health Canada asserted that because of this risk, the information fell within the definition of " “personal information” " and was therefore exempt from disclosure. [ 27 ] The Information Commissioner, acting pursuant to paragraph 42 (

a) of the ATIA , launched applications for judicial review of the Health Canada final decisions. By order of the Court dated August 27, 2020, the matters were consolidated. [ 28 ] The Privacy Commissioner was granted leave to intervene in the proceeding, and was granted access to the confidential information that had been filed. The Privacy Commissioner was permitted to file a memorandum of fact and law and to make oral submissions; the other parties were granted a right of reply to both. E. Issues and Standard of Review [ 29 ] Two main issues arise in this case: 1 .

Is the Minister authorized to refuse disclosure of the records at issue pursuant to subsection 19(1) of the ATIA , because they constitute personal information? 2 . Did the Minister correctly refuse to further sever the records pursuant to

section 25 of the ATIA ? [ 30 ] The parties largely agree on the issues and the law applicable to these cases, other than one question relating to the standard of review. The primary debate between the parties, and the intervener’s main focus concerns the application of the legal principles to the particular situation before the Court, including the proper analytical approach to assessing the risk of releasing information from structured datasets such as the medical marijuana licensing records held by Health Canada. [ 31 ] On the standard of review for the first issue, the law is clear. Pursuant to

section 44.1 of the ATIA , reviews under

section 41 are heard de novo , as a new proceeding. This has been described as " “stepping into the shoes of the Minister” " to determine whether the refusal to disclose is authorized under the law ( Suncor Energy Inc. v Canada-Newfoundland and Labrador Offshore Petroleum Board , 2021 FC 138 [ Suncor Energy ] at para 68 ). In reality, this means that the Court " “is to reach its own conclusion as to whether the information at issue is exempt from disclosure under subsection 19(1), i.e., it must determine whether the mandatory exemption has been

applied correctly” " ( Canada (Information Commissioner) v Canada (Public Safety and Emergency Preparedness) , 2019 FC 1279 [ Public Safety ] at para 40 ). The burden is on Health Canada to establish that it was authorized to refuse to disclose the information. The parties agree on these points. [ 32 ] As regards the second issue, however, the parties diverge.

Prior case law has found that a Minister’s exercise of discretion pursuant to subsection 19(2) is subject to review on the reasonableness standard (see, for example, 3430901 Canada Inc. v Canada (Minister of Industry) , 2001 FCA 254 , [2002] 1 FC 421 [ Telezone ]; Public Safety at para 41 ). The Respondent submits that the same approach should be followed to reviewing its decision not to sever any of the records pursuant to

section 25 of the ATIA , citing Attaran v Canada (National Defence ), 2011 FC 664 [ Attaran ] at paras 18-19 . [ 33 ] The Information Commissioner disagrees with this position, asserting that under

section 25 of the ATIA , severance is mandatory and it should therefore be treated as part of the de novo review power under

section 44.1. On this view, the Minister is not authorized to refuse to disclose parts of the record that can reasonably be severed, and therefore the Court should reach its own conclusion on whether

section 25 was properly applied to the records. The Information Commissioner submits that Attaran should not be followed because it has been overtaken by more recent case law. [ 34 ] It does not appear that this specific question has been addressed in any cases since Attaran . The main question on this issue is the degree of effort required to meet the obligation under

section 25 ; flowing from that is the question of whether Health Canada’s refusal to sever and release more information from the records is in accordance with the standard that the law requires. [ 35 ] Two things are not in dispute: (

i) parts of the records that are responsive to the requests contain personal information; and (ii) Health Canada has exercised its authority under

section 25 to partially sever the records, by releasing the first character of the relevant postal codes. The argument in this case focuses on whether Health Canada is required to undertake a more rigorous review, and whether more information should be disclosed. [ 36 ] Based on this, it is clear that at least part of the records in question contain personal information (e.g. the specific home addresses of licensed users, or the full FSAs for areas with a very small population), and thus Health Canada was authorized to refuse to disclose this portion of the record. No one questions that.

The only argument relates to whether more information should have been disclosed.

On this point, the debate is about whether conducting the sort of " “mosaic analysis” " (or linking analysis) that would be required to assess the specific risks associated with releasing the names of some cities, and the second and/or third letters of each FSA, goes beyond what the statute requires of a government institution. [ 37 ] In some respects, the facts in Attaran are similar to this case insofar as the records contained some personal information, the government institution had released portions of the requested documents, and the debate concerned whether the government institution’s refusal to release more of the details was justified.

Justice Barnes’ analysis on this point is worth citing in full: [18] I accept that the issue of “whether severability has been duly considered” is to be assessed on the standard of correctness: see 3430901 Canada Inc. v. Canada (Minister of Industry) , 2001 FCA 254 , [2002] 1 FC 421 at para 39 [ Telezone ]. I do not agree, though, that the application of that obligation to the evidence is to be judged on that same basis. In my view, deciding whether photographs are severable is an exercise which requires the application of some professional judgment, and thus the standard of reasonableness applies.

Notwithstanding the Court’s obligation to pay deference to the decision-maker’s approach to redaction, I am satisfied that the reasonableness standard is sufficiently robust to deal with situations of clearly unwarranted overreaching by the government. [19]

Section 49 of the ATIA deals with the judicial review of withholding decisions made, inter alia , under s 19 of that Act. In Canada (Information Commissioner) v Canada (Commissioner of the Royal Canadian Mounted Police) , 2003 SCC 8 , [2003] 1 SCR 66, the Supreme Court of Canada carried out a detailed standard of review analysis in connection with this provision and held that the determination of what was or was not “personal information” under s 19 of the ATIA should be reviewed for correctness and that the burden of the proof on that point rests with the government.

Once it is determined that the decision-maker has correctly exercised that authority, the Court held that the de novo review power is “exhausted”. I take that to mean that in the subsequent assessment of a possible redaction of a record authorized by s 25 of the ATIA or in the balancing of privacy rights against the public interest authorized by ss 8(2)(m)(

i) of the Privacy Act , the decision- maker’s discretion is reviewable on the standard of reasonableness: see Attaran v Canada , 2009 FC 339 , 342 FTR 82 at paras 28-32 and Telezone , above, at para 47 .

It follows that the Respondent’s decisions not to redact the detainee photographs and to refuse the release the photographs on public interest grounds are reviewable on the basis of reasonableness. [ 38 ] On this approach, the inexorable consequence of the fact that the Respondent was authorized to refuse to disclose at least part of the records in question, and that it specifically considered which parts of the record could be severed, is that the de novo review power is exhausted and the question of whether more information should be disclosed must be reviewed on the standard of reasonableness. [ 39 ] The key question is whether the ruling in Attaran has been affected by the Supreme Court of Canada’s decision in Merck Frosst Canada Ltd. v Canada (Health) , 2012 SCC 3 [ Merck Frosst ]. [ 40 ] In Merck Frosst , the Supreme Court of Canada set out the key principles that govern the application of

section 25 : [237] The heart of the s. 25 exercise is determining when material subject to the disclosure obligation “can reasonably be severed” from exempt material. In my view, this involves both a semantic and a cost-benefit analysis. The semantic analysis is concerned with whether what is left after excising exempted material has any meaning. If it does not, then the severance is not reasonable. As the Federal Court of Appeal put it in Blank v.

Canada (Minister of the Environment) , 2007 FCA 289 , 368 N.R. 279, at para. 7 , “those parts which are not exempt continue to be subject to disclosure if disclosure is meaningful”. The cost-benefit analysis considers whether the effort of redaction by the government institution is justified by the benefits of severing and disclosing the remaining information. Even where the severed text is not completely devoid of meaning, severance will be reasonable only if disclosure of the unexcised portions of the record would reasonably fulfill the purposes

of the Act. Where severance leaves only “[d]isconnected snippets of releasable information”, disclosure of that type ofinformation does not fulfill the purpose of the Act and severance is not reasonable: Canada (Information Commissioner) v.Canada (Solicitor General), (FC), [1988] 3 F.C. 551 (T.D.), at pp. 558-59; SNC-Lavalin Inc., at para. 48.As Jerome A.C.J. put it in Montana Band of Indians v. Canada (Minister of Indian and Northern Affairs), (FC), [1989] 1 F.C. 143 (T.D.): To attempt to comply with

section 25 would result in the release of an entirely blacked-out document with, atmost, two or three lines showing. Without the context of the rest of the statement, such information would beworthless. The effort such severance would require on the part of the Department is not reasonablyproportionate to the quality of access it would provide. [Emphasis added; pp. 160-61.] [238] That said, one must not lose sight of the purpose of s. 25.

It aims to facilitate access to the most informationreasonably possible while giving effect to the limited and specific exemptions set out in the Act: Ontario (Public Safety andSecurity), at para. 67. [41] The Court found that the role of a reviewing judge is to "“consider whether the institutional head had properly applied s. 25.”"(Merck Frosst at para 232). [42] In light of Merck Frosst, I am persuaded that the question of how much effort is required to meet the

section 25 severance obligationshould be treated as part of the de novo review, rather than as a discretionary decision. The text of the provision and its place in thescheme of the ATIA support that view. In my view, the discussion of the standard of review in Attaran has been overtaken by theSupreme Court of Canada’s decision in Merck Frosst, which is binding on me. Following its guidance, I will examine the Respondent’sdecision on severance de novo, to determine whether it properly applied

section 25. [43] This approach is also consistent with the nature of the review as required under the Act. Subsection 48(1) sets out the burden ofproof in proceedings under

section 41, which involves establishing either that the head of the government institution "“is authorized torefuse to disclose a record…or a part of such a record…”" [emphasis added], and this is mirrored by

section 49, which sets out thepowers of the Court. Under the

interpretation of

section 25 adopted in Dagg v Canada (Minister of Finance), (SCC),[1997] 2 SCR 403 [Dagg] and Merck Frosst, the government institution is not "“authorized”" to refuse to disclose a part of a record thatcan reasonably be severed under

section 25. [44] To be clear, I understand this to entail a two-step process. First, a reviewing court must determine whether the governmentinstitution fulfilled its obligation to consider severance under

section 25. If not, the reviewing court must do that, in the context of its denovo review. This has been done by the court in many previous cases, and in some of these, the court ordered that portions of records bedisclosed as required under

section 25 (see, for example, Concord Premium Meats Ltd. v Canada (Food Inspection Agency), 2020 FC1166 [Concord]). [45] The second step involves assessing de novo whether it is reasonable to disclose only a portion of the record. The analysis of thisquestion turns on a number of considerations set out in the case law.

The guiding principle has been described in a pithy way byAssociate Chief Justice Jerome: "“Disconnected snippets of releasable information taken from an otherwise exempt passage are notreasonably severable”" (Canada (Information Commissioner) v Canada (Solicitor General), (FC), [1988] 3 FC 551(TD) at page 559, cited with approval in Merck Frosst at para 237). [46] As discussed below, the crux of the issue in this case concerns the second step because the Respondent claims that requiring it toundertake a more detailed analysis of the risks of re-identification goes beyond what is reasonable as contemplated by

section 25. III. Analysis [47] The parties acknowledge that this is a matter of first impression because none of the prior cases have dealt with the precise questionsraised here. Before discussing the specific issues raised by this case, it will be helpful to set out the legal framework that applies. A. The Legal Framework [48] The key elements of the legal framework that governs this proceeding were summarized by Justice McHaffie in Public Safety atparas 25-37, and it is not necessary to repeat them in detail.

The points most relevant to this case include the following: Both access to information and the protection of privacy have been recognized as fundamental rights. The ATIA and the PrivacyAct have been described as quasi-constitutional by virtue of the rights they seek to protect: Canada (Information Commissioner) vCanada (Minister of National Defence), 2011 SCC 25 at para 40; H.J.

Heinz of Canada Ltd. v Canada (Attorney General), 2006SCC 13 [Heinz] at para 28; The ATIA sets out the general principle that the public has the right to access information in records that are under the control ofgovernment, which enhances accountability and transparency in government and promotes an open and democratic society: MerckFrosst at paras 1, 21-22; The protection of privacy is also a fundamental value, enshrined in the Canadian Charter of Rights and Freedoms (for example,the guarantee against unreasonable search and seizure in

section 8) as well as the Privacy Act. The Privacy Act protects "“personalinformation”" from release, which is defined in a non-exhaustive and non-restrictive manner. The general definition states:"“personal information means information about an identifiable individual that is recorded in any form”" (emphasis added); The ATIA and the Privacy Act must be interpreted in parallel, and since both statutes contain an express exemption of personalinformation from disclosure, privacy rights must be recognized as "“paramount”" over access to information to the extent that the

information falls within the definition of " “personal information” " : see Dagg at para 48 ; Heinz at para 28 ; The definition of " “personal information” " in

section 3 of the Privacy Act is " “undeniably expansive” " and " “deliberately broad” " ; its intention is to capture " “any information about a specific person subject only to specific exceptions” " ( Dagg at paras 65, 68- 69 ); Subsection 19(1) of the ATIA sets out a mandatory exemption from the right to access for personal information, as defined in

section 3 of the Privacy Act : " Personal information " " Renseignements personnels " " 19

(1) Subject to subsection (2), the head of a government institution shall refuse to disclose any record requested under this Part that contains personal information. " " 19

(1) Sous réserve du paragraphe (2), le responsable d’une institution fédérale est tenu de refuser la communication de documents contenant des renseignements personnels. " " " " Personal information obtained in confidence " " Renseignements personnels obtenus à

titre confidentiel " " " " 19

(1) Subject to subsection (2), the head of a government institution shall refuse to disclose any personal information requested under subsection 12(1) that was obtained in confidence from " " (

a) the government of a foreign state or an institution thereof; " " (

b) an international organization of states or an institution thereof; " " (

c) the government of a province or an institution thereof; " " (

d) a municipal or regional government established by or pursuant to

an Act of the legislature of a province or an institution of such a government; " " (

e) the council, as defined in the Westbank First Nation Self- Government Agreement given effect by the Westbank First Nation Self-Government Act; " " (

f) the council of a participating First Nation as defined in subsection 2(1) of the First Nations Jurisdiction over Education in British Columbia Act; or " " (

g) a First Nation Government or the Anishinabek Nation Government, as defined in

section 2 of the Anishinabek Nation Governance Agreement Act, or an Anishinaabe Institution, within the meaning of

section 1.1 of the Agreement, as defined in

section 2 of that Act. " " 19

(1) Sous réserve du paragraphe (2), le responsable d’une institution fédérale est tenu de refuser la communication des renseignements personnels demandés en vertu du paragraphe 12(1) qui ont été obtenus à

titre confidentiel : " "

a) des gouvernements des États étrangers ou de leurs organismes; " "

b) des organisations internationales d’États ou de leurs organismes; " "

c) des gouvernements provinciaux ou de leurs organismes; " "

d) des administrations municipales ou régionales constituées en vertu de lois provinciales ou de leurs organismes; " "

e) du conseil, au sens de l’Accord d’autonomie gouvernementale de la première nation de Westbank mis en vigueur par la

Loi sur l’autonomie gouvernementale de la première nation de Westbank; " "

f) du conseil de la première nation participante, au sens du paragraphe 2(1) de la

Loi sur la compétence des premières nations en matière d’éducation en Colombie-Britannique; " "

g) du gouvernement de la première nation ou du gouvernement de la Nation des Anishinabes, au sens de l’article 2 de la

Loi sur l’accord en matière de gouvernance conclu avec la Nation des Anishinabes, ou d’une institution anishinabe, au sens de l’article 1.1 de l’accord, au sens de l’article 2 de cette loi.

" The test to determine when information is about a particular individual was stated by Justice Gibson in Gordon v Canada (Health) , 2008 FC 258 [ Gordon ], at paragraph 34 : “Information will be about an identifiable individual where there is a serious possibility that an individual could be identified through the use of that information, alone or in combination with other available information .” (emphasis added) In Public Safety , Justice McHaffie defined a " “serious possibility” " as: …a possibility that is greater than speculation or a ‘mere possibility,’ but does not need to reach the level of ‘more likely than not’ (i.e., need not be ‘probable on the balance of probabilities).

Applying such a standard recognizes the importance of access to information by not exempting information from disclosure on the basis of mere speculative possibilities, while respecting the importance of privacy rights and the inherently prospective nature of the analysis by not requiring an unduly high degree of proof that personal information will be released (para 53). [ 49 ] The parties do not dispute that this is the applicable legal framework.

They disagree regarding its application to the facts of the case, to which we now turn. [ 50 ] At this stage, a reminder is in order regarding the specific requests in issue, and what remains in dispute. The Hayes request seeks the addresses of all licensed personal production relating to relatively large quantities of marijuana (244 or more indoor plants, and/or 95 or more outdoor plants, and/or 35,625 grams in storage).

The Cain request seeks a document in sortable format showing the FSAs of personal or designated producers, as well as similar information about " “registered users” " – which Health Canada interpreted as meaning either a personal or designated producer. [ 51 ] As to what remains in dispute, the Information Commissioner accepts that certain portions of the records in issue should not be

disclosed because they contain personal information; this includes the full addresses, as well as some FSAs that refer to locales with small populations. Health Canada agreed to disclose the first character of the FSAs contained in the records.

Therefore, neither of these points is in issue. [ 52 ] However, the Information Commissioner does not accept Health Canada’s assertion that the second and third characters for other FSAs, as well as city names, should be protected from disclosure because there is a serious possibility that such data, when combined with other available information, could result in the identification of individuals. [ 53 ] In addition, the Information Commissioner does not accept Health Canada’s claim that it would be unreasonable to ask it to review each FSA, to determine the risk associated with the release of the second and third characters.

This point is discussed below, in connection with the second issue. [ 54 ] The dispute at the centre of this case is about whether the second and third characters of FSAs with larger populations as well as city names, are protected from disclosure because there is a " “serious possibility” " that this data can be linked with other information to identify specific individuals. Related to this is the proper approach to assessing the risks regarding what are referred to as " “structured data sets” " and the methodology to assess such risks.

The parties and the intervener made submissions on this question, which I discuss below. B. Is the Minister authorized to refuse to disclose the records at issue pursuant to subsection 19(1) of the ATIA, because they constitute personal information? [ 55 ] The onus lies on Health Canada to establish that it was authorized to refuse disclosure of the records, and thus it is appropriate to begin with their position, even though they are technically the Respondent in this proceeding. This will be followed by a

summary of the Applicants’ position and a discussion of the Intervener’s submissions.

(1) Health Canada’s Case [ 56 ] Health Canada argues that it has met the Gordon test by demonstrating that there is a serious possibility that releasing the disputed information could result in the identification of individuals, because it could be combined with other available information. Its evidence included two affidavits and an expert report. These are described in some detail below, because they constitute the bulk of the evidence before the Court on this de novo review. (

a) The Garrah Affidavit [ 57 ] Health Canada submitted an affidavit of Joanne Garrah, the Acting Director of the Licensing and Medical Access Directorate within the Controlled Substances and Cannabis Branch.

She describes the evolution of the regulatory regime for medical cannabis, the type of information that an individual must provide to obtain a license, as well as the information Health Canada publishes on its website on this subject. [ 58 ] It is not necessary to review the history of the regulation of medical marijuana in detail; the relevant aspects of the regulatory regime in place at the time of the ATIP requests in this case have been described above. [ 59 ] The affidavit sets out the information a person had to submit in order to obtain a registration for cannabis for their own medical purposes, including: their name, address, date of birth, and gender; their full address, telephone number, and email address; the full address of the site where the cannabis production would occur; whether it would be cultivated indoors or outdoors (and if the latter; that the location was not near a school, playground, or other place frequented by persons under 18 years of age); and whether the person would cultivate it themselves or designate someone else to do so.

In addition, the person had to obtain a document from a medical practitioner specifying the amount of cannabis prescribed for daily use. [ 60 ] The registration form included a privacy notice, which explained that: (

i) the Privacy Act governs the use of the personal information that was being provided; (ii) the information " “may be shared with law enforcement entities to confirm your lawful possession and production of cannabis…” " ; and (iii) " “[i]n limited and specific situations, your personal information may be disclosed without your consent in accordance with subsection 8(2) of the Privacy Act ” " , and set out the person’s rights under that legislation. [ 61 ] The affidavit also describes the types of information Health Canada collected and published on its website, including: monthly updates on the amount of cannabis sold for medical purposes; the number of personal or designated production registrations by province; the number of applications processed each month; and information for health care practitioners on medical cannabis. (

b) The MacAndrew-Donnelly Affidavit [ 62 ] Health Canada also submitted an affidavit of Cassie MacAndrew-Donnelly, the team leader at the ATIP unit of Health Canada who has been involved in all ATIP requests regarding medical cannabis licenses since 2010. She has also been involved in all ATIP requests concerning FSAs and medical cannabis since Health Canada started receiving them in 2011. [ 63 ] The affidavit reviews the processing history of the three ATIP requests underlying this case and then describes the other information that is available, which underpins Health Canada’s rationale for refusing disclosure.

The affidavit refers to three other sources of information: data that Health Canada publishes on its website concerning medical cannabis; other sources of publicly available data about populations including the 2016 Census Data and the Statistics Canada report " “Population and Dwelling Count by FSA” " ; as well as other publicly available information including data released in response to numerous prior ATIP requests about medical cannabis registrations.

[ 64 ] The ATIP requests and releases described in the affidavit cover a period from April 2012 to January 2020 (i.e. subsequent to the dates of the Hayes/Cain requests, a point discussed below). The affidavit indicates that a wide range of requests have been made, some of which seek national data while others focus on specific cities. Several early requests seek information by FSA, such as the April 2012 request, where the FSA for communities with a population of 6,200 or more was released. That cut-off was chosen because it corresponded to the average population of an FSA at that time.

That release included the type of license, medical condition (with rare conditions removed), dosage, and the issue date of the license. A 2014 release provided the year of birth, dosage, sex, medical condition (rare conditions removed), and province (city removed) of individuals with a medical marijuana license.

In November 2015, a release provided information for FSAs of communities with a population of 60,000 or more, and it also included medical condition (with rare conditions removed), dosage, province, type of license, and issue year. [ 65 ] The affiant explains the concern about the " “mosaic effect” " created by such an accumulation of releases: Health Canada ATIP is concerned that the current files under complaint, as well as the new ones that came in following these, show that requesters are trying to gather more and more bits of information over time in order to paint an even broader picture on the profile of medical cannabis licensees in Canada using the data points that have already been released.

There has been a history of efforts to collect, link and publish information relating to licensees for medical cannabis. The link between all of these files could allow one to identify an individual if they were to release more than the first digit of the FSA. [ 66 ] An example of this " “history of efforts” " is the interactive map of Canada that was made available on the internet, showing FSAs where medical marijuana applications were made between 2001 and 2007.

The affiant indicates that " “(t)he map used a colour gradient which showed that the darker the area, the more medical marijuana licenses are granted there.” " She goes on to describe the results of her exploration of the interactive features on the map. For example, when she clicked on a city name, a map of that city appeared divided by FSA, and when she clicked on a particular FSA, the number of medical marijuana licenses applied for in that location appeared, along with the patients’ medical condition(

s) associated with that license. An Edmonton Journal

article about the interactive map provided a link to a database that allowed users to search by medical condition, postal code, doctor’s specialty, daily dosage, and allowed storage of marijuana. [ 67 ] The affidavit also explains the evolution in Health Canada’s approach to ATIP releases relating to medical marijuana licenses, and its growing concerns about the risk of re-identification: At the time of the first medical cannabis ATIA request (A-2011-000945), Health Canada ATIP had established that the average FSA population in Canada was approximately 6200.

It was decided that any community with less than 6200 would be protected as it represented a risk of identification, in conjunction with the other personal details being released. This request generated the interactive map described above. By the time of the second request in 2014 (A-2014-000167) Health Canada ATIP was exercising their duty to assist and releasing as much information as possible without risking a privacy breach, while taking into account the first release under A-2011-00945.

The information available in the public domain pertaining to the profiles of the licensees and the mosaic effect was not a risk at the time. By the time of the third request in 2015 (A-2015-000332), Health Canada ATIP began to recognize that more and more information was beginning to exist in the public domain pertaining to medical cannabis licensees.

With the layering of information being requested, including licenses by FSA, and considering the other information that was already released such as gender, medical condition, age, and dosage, it became apparent that linkages could be made, especially if you happened to live in that FSA. A decision was made to protect the FSAs of communities under 60,000 in population (instead of the previous 6200) as the risk of identifying an individual within smaller communities in conjunction with the other disclosed information was too high.

It was also at this time that a requester in a 2015 request pointed Health Canada towards the ‘interactive map a colleague had created with the data received [through an earlier access request]’ as an example of the type of information they wanted.

This was when Health Canada ATIP became very concerned with the amount of information being disclosed and what could be achieved with it over time. [ 68 ] Part of Health Canada’s concern can be traced to the size of some FSAs: The Statistics Canada 2016 Population and Dwelling Count by FSA Tables reveal that 25 geographical areas (as represented by the FSA) have populations of less than 100 people, while 20 geographical areas have a population of 25 people or less. For example, the FSA for geographical area E2R has […] 5 private dwellings and a population of 10 people.

The FSA for geographical area GIA has 1 private dwelling and a population of 1. [ 69 ] In one particular FSA in |||||||||||||||||||| , the number of registered users is the same as the number of personal producers, with no designated producers in that location. This means that anyone known to be producing cannabis with a licence is producing it for their own use for a medical condition.

This location is home to a |||||||||||||||||||||||||| , which the affiant states increases the likelihood that a particular individual licensed to grow medical marijuana could be identified. [ 70 ] Similarly, a previous ATIP release shows there is one person with a license for a daily limit over 100g – this person has a license for personal production and is authorized to possess large quantities. The release also indicates that the individual is male, born in 1984, and has severe arthritis.

The affiant states that releasing the three characters of the FSA would narrow the specific locale where this person lives, increasing the likelihood that the person can be identified. [ 71 ] Finally, the affidavit describes Health Canada’s rationale for not severing some of the information. This is described in more detail in the second part of the decision.

(

c) The Expert’s Report [ 72 ] Health Canada retained an expert, Dr. Khaled El Emam, who filed a report entitled " “Privacy Risk Assessment for Data Releases about Registered Users and Producers of Cannabis in Canada.” " The Executive

Summary explains that the purpose of the report is to: …define a framework for evaluating the re-identification risk in data about registered users and producers of cannabis.

This framework defines the scope of what risks should be [assessed and] the necessary assumptions, as well as a methodology that should be followed to assess these risks. [ 73 ] The expert states that the " “actual risk of re-identification is a function of the assumptions that one is willing to make about possible adversaries [meaning those who might seek to use the data] and their knowledge…” " The report considers two assumptions: a " “permissive” " one in which the adversary does not know who is in the dataset, and a " “conservative” " one in which the adversary knows who is in the dataset or that a specific individual is in the dataset.

After explaining some foundational elements of how such risk assessments work, the expert then applies his methodology to the two Cain releases to show the risks associated with the release of the three characters in the FSA. This part of the report is discussed in the Analysis

section below. [ 74 ] At the outset, two points from the Report should be emphasized. First, the expert uses the term " “adversary” " in a somewhat unusual way; it does not refer to an opponent or enemy (as the term is generally understood), but rather simply refers to someone who may seek to use the data that is released, whatever their motivation.

The expert explains that " “adversary” " is the term generally used in the literature on this subject, and he uses it to avoid the potential confusion of introducing new terminology (see, for example: Information and Privacy Commissioner of Ontario, De-identification Guidelines for Structured Data , June 2016, at p. 2). I will use it in the same manner and for the same purpose in these reasons. [ 75 ] Second, the expert underlines that any information from the datasets that is released will effectively become public because no further controls can be imposed on it once it is released.

The clearest example of this is the interactive map described earlier: once the dataset underlying that map was released, individuals were free to share it, link it, and to make it public, and there was no practical way for Health Canada to stop or limit this. [ 76 ] Turning to the background elements set out in the report, the expert offers a description of some foundational concepts that are used in the model he employs.

A brief discussion of some of these will be helpful to an understanding of the parties’ submissions and the analysis that follows. [ 77 ] The starting point for the expert is that " “(w)hen data is released pursuant to an access to information request, the appropriate risk model to use is maximum risk… Following this model, we would estimate the risk for each record in a dataset and then assign the highest risk value of a record to the whole dataset.

Therefore, the dataset risk is equal to the highest-risk record in the dataset.” " The reason for this is that once the dataset is released, no further controls can be put on the use of the data to manage any associated privacy risks. [ 78 ] The expert’s methodology relies on several key concepts, which are summarized below: Represented population refers to the subset of the total population that can realistically be in the dataset; in this case, the starting point is the population of each FSA within the datasets.

The size of this group also depends on whether we assume the adversary knows someone who is in the dataset or not; Quasi-identifiers are the variables in the dataset that the adversary might know, e.g. age, sex, medical condition, postal code, or FSA; Learning something new – the risk of disclosure only pertains to information that would add to the adversary’s existing knowledge; if the relevant information is already known to the adversary, even though it may technically be categorized as personal information, the risk of releasing that particular data is not meaningful; Equivalence class refers to the size of the group with the same values on the quasi-identifiers.

If the adversary knows who is in the dataset, the equivalence class size can be computed from within the dataset. If the adversary does not know who is in the dataset, then the equivalence class size must be computed from the relevant population: e.g. the number of males living in a particular FSA.

The probability of disclosure is assessed by combining all of the relevant quasi-identifiers, because that is how an adversary is likely to use the data; and Threshold for Identity disclosure refers to " “(t)he threshold that can be used to evaluate whether the risk of identity disclosure is acceptably small [and] is based on the size of the equivalence class.” " For public data releases, the typical threshold used for determining if the group size is too small is 11, so that if a group count is lower than 11, the risk of identification is deemed to be too high.

Other thresholds can be used, but 11 is the standard used by Health Canada for public release of clinical trial data. [ 79 ] The final point worth noting here is that the expert’s methodology proceeded on the assumption that, in light of the data that had been released in previous ATIP requests, the relevant quasi-identifiers for the releases in issue in this case are year of birth or age range and sex, plus FSA and city. [ 80 ] The expert’s report then applies these concepts to the dataset for the Cain request, and concludes that whereas there are a number of FSAs that are high risk if either three or two characters of the FSA are released, there are no high risk FSAs if only the first character is released.

The other parties question some of the expert’s conclusions, and so this part of the report will be discussed in more detail below. This is sufficient to set the stage for a review of Health Canada’s arguments. (

d) Health Canada’s Submissions

[ 81 ] Health Canada argues that it has met the Gordon test because the evidence shows there is a serious possibility of identification when more characters from the FSA and the names of the relevant cities are combined with other available information.

It submits that focusing solely on population size, as the Information Commissioner urges, is overly simplistic and ignores the real risks that exist due to the availability of other information and the obvious motivation of some requesters to combine this data. [ 82 ] The Respondent’s position is based on the idea of the " “mosaic effect” " – that data can be combined to reveal more than each single piece considered alone might show.

It points to previously released data relating to medical cannabis licenses, including medical conditions, dosage, type and issue date of the license, year of birth, and gender of the licensed individual.

Health Canada also relies on other ATIP requests that had been received subsequent to the Cain/Hayes requests as a further indication of the expanding nature of the elements of information that could be combined to identify someone. [ 83 ] As for motivation, Health Canada contends that the pattern of requests combined with the creation of the interactive map demonstrates a concerted effort to collect, link, and publish information relating to medical cannabis licenses.

It underlines that users could search the site connected to the map by medical condition, postal code, doctor’s specialty, daily dosage, or allowable quantities for storage. [ 84 ] Regarding the second and third characters of FSAs, Health Canada points to the publicly available Statistics Canada report that shows some FSAs have tiny populations, in communities where residents likely know each other. The Respondent cites one particular example from the evidence: one FSA has the same number of personal producers and registered users, and no designated producer.

Health Canada argues that releasing further data on this FSA would allow anyone in that area who knows that someone has a license to confirm that this person is growing marijuana for their own personal use to treat a medical condition. It could also be linked to other available data to reveal other personal information. [ 85 ] Health Canada also points to the visual and olfactory (smell) factors associated with cannabis production, which can be combined with other evidence to identify particular individuals. It points to a newspaper

article regarding complaints from neighbours about the smell emanating from a house where marijuana was allegedly being grown under a medical license. [ 86 ] Based on all of this, Health Canada asserts that it cannot safely rely on population size alone as a means of dealing with the risk of identification of licensed individuals.

In this regard, the facts of this case are similar to Gordon , where the Court found that combining the public information with the further information in the released data created a serious possibility of revealing personal information. [ 87 ] Health Canada relies on the findings in the expert report, in particular the risks that arise under the " “conservative assumption” " that a person seeking to identify someone knows that the person is in the dataset.

The analysis in the expert’s report shows that the re- identification risk increases as more FSA characters are disclosed, and it further increases if age and gender are included. Given the highly personal nature of the information in question, and its obligation to protect that data, Health Canada argues that its refusal to release more information is justified.

(2) The Applicants’ Submissions [ 88 ] The Information Commissioner argues that Health Canada has failed to meet its burden of demonstrating that the refusal to release more information was authorized by subsection 19(1) of the ATIA . She submits that the evidence points to a " “mere” " possibility, not a serious possibility of identification. [ 89 ] The Information Commissioner asserts that population is the key variable, as demonstrated by Health Canada’s previous use of population cut-offs to determine whether to release records.

She argues that the use of this factor has been endorsed by the Supreme Court of Canada in a case where the Ontario Information and Privacy Commissioner ordered the disclosure of the number of registered sex offenders for all Ontario FSAs: Ontario (Community Safety and Correctional Services) v Ontario (Information and Privacy Commissioner) , 2014 SCC 31 [ Community Safety ]. [ 90 ] The Commissioner submits that the evidence relied on by Health Canada is speculative and insufficient to demonstrate a serious possibility of re-identification.

The only evidence about the nine prior ATIA releases relied on as core elements of the information that could be linked is the general description in the MacAndrew-Donnelly affidavit. While this comes closer to meeting the test, the Information Commissioner argues it nevertheless falls short. The affidavit provides only four pages from one release made in 2014, but this one example is an outlier given the size of the FSA in question.

Without access to the information disclosed in response to these previous requests – copies of which are in Health Canada’s possession – the Applicants contend that the record is inadequate. [ 91 ] On the expert’s report, the Information Commissioner makes two key observations: first, Health Canada did not ask the expert to actually conduct any specific linking to demonstrate what was possible, and second, the report shows that the risks of re-identification are not serious for many of the FSAs.

Further problems arise using the expert’s methodology because the datasets produced in response to the Cain request are incomplete (they do not include individuals licensed under a prior scheme, the Medical Marijuana Access Regulations , SOR/2001-277). In addition, the datasets are outdated, and the Information Commissioner points out that the evidence shows that many more people are now able to grow marijuana for personal use.

Therefore, the risk of releasing the information is diminished because it would be even more difficult to link any particular location to a prior license for medical marijuana. [ 92 ] The Applicants also assert that Health Canada cannot rely on statements about information disclosed on its website because the website pages are not in evidence, nor can it rely on visual or olfactory indicators because it has failed to take into account the number of illegal grow operations in Canada.

In addition, the sight or smell at a particular place may not link the cultivation to a specific person because individuals can be licensed to grow at another location and can designate someone else to do it for them. It may also be an illegal grow-operation, although Health Canada has failed to produce any evidence about the prevalence of this. Similarly, the Information Commissioner challenges Health Canada’s reliance on subsequent ATIA requests, because the records relating to these were not already in the public domain.

If Health Canada can demonstrate a serious possibility of re-identification in relation to one or more of these later releases, it could justify a refusal at some point in the future.

[ 93 ] The bottom line for the Information Commissioner is that Health Canada was required to provide evidence showing actual linkages, and its failure to do that means that it has not met its burden of establishing a serious possibility of re-identification.

(3) The Intervener’s Position [ 94 ] The Privacy Commissioner did not take a position on the facts, but rather focused his submissions on the factors for assessing whether releasing the full FSA meets the serious possibility test, and if so, to what extent

section 25 of the ATIA required redactions or other techniques to allow disclosure of more information (discussed in the next part). [ 95 ] While underlining the importance of the broad definition of personal information that has been confirmed by the jurisprudence, the Privacy Commissioner acknowledges that " “(a)dvancements in technology combined with the proliferation of public or quasi-public data sources magnify the potential for re-identification of datasets unless sufficient precautions are taken” " (Intervener’s Factum, para 14). [ 96 ] The Privacy Commissioner contends that the specific issue is novel, and prior cases are of limited assistance.

In particular, the Supreme Court of Canada’s decision in Community Safety should be approached with caution because the underlying facts and evidentiary record were materially different from the present proceeding.

In particular, in that case the evidence related to risk of re- identification was limited to newspaper articles and generic scholarly research, and there is no indication that expert evidence about equivalence classes or information about previous ATIP releases was before the Court. [ 97 ] Turning to the expert report, the Privacy Commissioner supports the use of equivalence classes as a measure of the risk of re- identification for the type of dataset in this case: " “Among other things, it provides an objective, transparent and logical framework for analysis based on the concept of risk and accords with generally accepted practices for assessing re-identifications risks” " (Intervener’s Factum, para 21).

While an equivalence class analysis may not be required in every case, the Privacy Commissioner asserts, " “it is particularly useful for structured datasets dealing with sensitive information, especially where there may be a motivation to re-identify individuals” " (Intervener’s Factum, para 22).

While the risk of re-identification will never be eliminated, the Privacy Commissioner’s position is that the equivalence class analysis combined with a " “motivated intruder” " test is an appropriate methodology for assessing the magnitude of the risk to determine whether the serious possibility test has been met. [ 98 ] The Privacy Commissioner also supported the use of other " “quasi-identifiers” " as relevant variables in assessing the risks associated with the mosaic effect.

The number of quasi-identifiers depends on both the type of available information and its relevance to the type of mosaic that is of concern. The basic idea is that the more information the adversary has, the greater the risk of re- identification.

Therefore, an increase in the number of variables to be considered leads to a corresponding rise in the chances that an unacceptably small combination of values among them can result in the re-identification of a specific individual. [ 99 ] The Privacy Commissioner submits that the persuasiveness of this evidence depends on the extent to which the relevant data can be linked.

Thus, for example, if the relevant population has changed significantly over time, or if the datasets include different, non- comparable variables, the possibility of linkage by connecting earlier data to more recent information is diminished. [ 100 ] Concerning the question of " “response knowledge” " (i.e. whether the adversary knows that an individual is in the dataset), the Privacy Commissioner submits that this assumption only holds if there is " “a plausible scenario that would allow for one or more adversaries to infer that a person is in the dataset” " (Intervener’s Factum, para 38).

This could include a " “nosy neighbour” " relying on personal observation and other available information. The analysis should also take into account multiple adversaries because once the data is public there is no restriction on its further distribution. However, the plausibility of such an assumption declines if there are too many confounding variables such that it would not be reasonable to infer that identification is reasonably possible. IV.

Discussion [ 101 ] Although the specific issue raised by this case has not been addressed before, the general principles that orient the analysis are well established and worth repeating. [ 102 ] First, access to information is a foundational right, essential to the health of our democracy and to improving the quality of public administration in Canada, which in turn sustains the public’s trust in government institutions.

There are many legitimate reasons for inquiring about how the administration of the medical marijuana licensing regime operates, and greater public awareness of such matters must be presumed to be a good thing. [ 103 ] Second, the protection of privacy is also a hallowed value; the right to privacy is given constitutional and legislative protection because of its importance to individual dignity. The protection of personal information is an essential element of individual dignity, and core to that is the right of individuals to choose whether, when, and how to share information about themselves with others.

There are many legitimate reasons why a person may not wish others to know that they are using medical marijuana because of a medical condition, and Health Canada was rightly concerned about protecting the information it held about such matters. [ 104 ] Third, the " “serious possibility” " test set out in Gordon is still the governing authority that all parties submit should guide the analysis.

This is because Gordon recognizes that information that is not inherently personal may be combined with other available data to create a serious risk, whereby the mosaic created by such efforts could lead to the identification of a specific individual. I agree that this is the applicable test here. [ 105 ] Applying these principles to the facts of this case brings us to the crux of the matter.

Has Health Canada demonstrated that disclosing the second and third characters of the relevant FSAs, and/or the names of the cities, creates a serious possibility of re- identification? [ 106 ] A number of considerations lead me to conclude that Health Canada has met its onus.

[ 107 ] First, it seems to me that the type of personal information in question is a central concern for this type of analysis. Government agencies hold all sorts of information about individuals, and while all information that qualifies as " “personal” " under the statutory definition merits protection, it must be acknowledged that the disclosure of some particularly sensitive types of personal information can be expected to have particularly devastating consequences. Information about an individual’s medical condition(

s) must rank very high on any such list: it is among the most intimate information any of us possess, and the decision of whether or when to share it, and how much to disclose, can be a gut-wrenching choice, with significant consequences for the individual, their family, and friends. [ 108 ] Flowing from this, the risks of disclosure of such intimate information must be reduced as much as is feasible.

This is not to suggest that Health Canada or any other government entity can guarantee that such information will never be disclosed; the law does not seek a type of certainty that can never realistically be obtained. However, this approach supports Health Canada’s assertion that it took an appropriately restrained approach to disclosure, and it is pertinent to a consideration of the expert’s report, discussed below. On this point, it should be emphasized that Health Canada was under an obligation to try to prevent the disclosure of every individual’s personal information.

Even though it held thousands of records, the obligation was towards each individual. [ 109 ] Next, I find that the existence of the interactive map, and Health Canada’s legitimate concerns about what had been done with the information released in prior releases are important considerations in assessing whether disclosing the information requested by the Applicants created a serious risk of re-identification. It may not always be essential to provide concrete examples of the motivation that some individuals may have to connect information or the feasibility of such efforts.

However, the existence of evidence demonstrating that connections among disparate pieces of relevant information have previously been made and that the results have been made available to the public is a relevant consideration in applying the serious possibility test.

The information previously released must be assumed to still be available, even if the website is no longer accessible online. [ 110 ] Although I accept that Health Canada’s reliance on past disclosures was legitimate and appropriate, I am not persuaded that Health Canada’s reference to the subsequent ATIP requests was a legitimate consideration, because there is no evidence about what, if any, further information was disclosed pursuant to those requests during the intervening period.

It is worth unpacking this point. [ 111 ] As noted earlier, the MacAndrew-Donnelly affidavit summarized information that had already been disclosed at the time the Cain/Hayes requests were made.

In my view, this was a relevant and appropriate consideration in assessing the mosaic effect, because that information was already in the public domain. [ 112 ] However, the affidavit also refers to subsequent requests made after the Cain/Hayes requests, and the record is not clear whether any other information was disclosed in response to these requests, either prior to Health Canada’s final refusal, or between then and the time of the hearing of this matter.

Absent that evidence, I agree with the submissions of both the Information and Privacy Commissioners that the impact of any future disclosure was merely hypothetical at the time of Health Canada’s refusal, and it remains so for the purposes of my de novo review. The fact that a more complete mosaic may be created by future releases is both true and irrelevant, because Health Canada has an ongoing obligation to assess the risks, and if at some future point it concludes that the accumulation of information released created a serious risk, it could refuse to disclose the information that tipped the balance.

A future potential risk that can be mitigated by decisions that are within Health Canada’s control cannot be invoked to justify the refusal in issue here. [ 113 ] Turning to Health Canada’s evidence, while I agree in principle with the Information Commissioner’s submission that Health Canada could and should have filed more information to demonstrate the contents of the prior releases, I am persuaded that the details set out in the MacAndrew-Donnelly affidavit (leaving aside the references to the subsequent releases) are sufficient to demonstrate the type of information that could form the building blocks of the mosaic of information about specific individuals licensed to produce medical marijuana.

On this point, it is important to note that the affiant was personally involved in all of the prior ATIP requests, and so was able to describe the information in the records that were released in great detail. [ 114 ] The affidavit shows the progressive release of more information about medical marijuana licenses, as well as details about the individuals who received them, including medical conditions, year of birth, gender, type of license issued, and dosage.

Two main issues were raised about this information. [ 115 ] First, the Information Commissioner questioned whether the data was comparable across the various releases, because if there are substantial differences between the various datasets, the risk of an accurate linkage would be reduced or eliminated. Related to this is the question of the completeness of the data, because it is acknowledged that some of the relevant data sought in the Cain requests was contained in a separate database and was therefore not included.

The key point here is that the prior database contained much more data than the one used to respond to the Cain request. [ 116 ] Second, the Information Commissioner argued that the data assembled in response to the two requests was no longer accurate given the passage of time, and in particular the significant increase in the number of Canadians who can grow marijuana after legalization.

It argued that on the de novo review, the Court was required to take into account developments subsequent to the time of the original Health Canada refusals, and this included the evidence that many more people are now growing marijuana for personal use. This diminished the chance that knowledge that someone was cultivating marijuana would create a significant risk of identifying licensed medical producers. [ 117 ] Two main questions emerge from the submissions on this point. First, is the data comparable?

While it would have been preferable to have evidence, from either one or more of Health Canada’s affiants or the expert, in my view a reasonable inference can be drawn from the evidence that is in the record. The records all relate to the medical marijuana licensing regime, and the evidence is clear that Health Canada has required individuals to provide medical evidence of a health condition to justify their need to use medical marijuana under all of the different regulatory regimes.

It is reasonable to infer from this that medical conditions that warranted a license under a prior regime would likely justify its continuance under the next one, and so on. It is also reasonable to infer that the vast majority of individuals who were motivated to seek a license under a previous regime would likely be interested in continuing it, to the extent new requirements were put in place under subsequent regimes. This is particularly the case because the Hayes request sought information relating to large quantities, which is a sub-set of the larger group of licensed individuals and designated producers.

An individual would need medical evidence to justify a license to grow such a quantity of medical marijuana, which in turn makes it more likely that they

would seek to continue to obtain the necessary authorization. I am satisfied that in the particular circumstances of this case, taking a practical view of the matter, the evidence shows that the datasets are likely broadly comparable. [ 118 ] On this point, it is important to add that even if the datasets are not entirely comparable, it is reasonable to infer that there is a significant degree of continuity in the licensed population that is included in them. The key point is not that the data is statistically comparable for the purposes of scientific or social science research.

Rather, the question is whether there is a significant possibility that this data can be combined to identify particular individuals. From the privacy perspective, I am persuaded that the datasets are sufficiently comparable to serve as a foundation for assessing the risk that a mosaic of information could be assembled. [ 119 ] I am also satisfied that even though the dataset produced in response to the Cain request was not complete, the evidence does not demonstrate that the absence of the data about users licensed under the prior regime would significantly reduce the risk of re- identification.

For the reasons set out in the previous paragraphs, it is likely that many, if not most, of those licensed under the previous regulations are included in the ACMPR data that is relevant here. I also note that during the course of the investigation, the Information Commissioner accepted Health Canada’s explanation for not including the previous data in its response to the Cain request.

Once again, the fact that the datasets may not be exactly comparable might be a problem for a statistician or social scientist, but it is not an impediment to a motivated user seeking to identify a person who was licensed for personal production or a designated producer under the medical marijuana licensing regime. [ 120 ] Second, what is the relevant timeframe for the Court conducting the de novo review? Am I to assess the information that was public at the time of Health Canada’s refusal, or should subsequent events be taken into account?

This is particularly salient in this case, because of the time that has passed since the original requests and because in the interim period the legalization of marijuana has changed the underlying factual matrix. The access requests were made in August and October 2017; Health Canada’s final refusal to disclose was dated January 20, 2020; and the case was heard in February 2022.

During that time-frame the number of individuals who cultivated small amounts of cannabis for personal use continued to increase, as did the number of individuals registered with Health Canada for personal and designated cultivation (as of June 2020, the latter category included 33,614 individuals).

Both facts are pertinent to the assessment that the risk of disclosure today would pose, but they may not have been representative of the risk as of the date of Health Canada’s refusal. [ 121 ] In my view, in undertaking the de novo review mandated by the ATIA , I am required to take into account more recent developments insofar as they are pertinent to the task at hand; namely, assessing whether the disclosure of further information from the records creates a serious possibility of disclosure of personal information about a specific individual.

In Concord , I found that the passage of time was a relevant consideration in assessing the risk of a disclosure, albeit in a completely different context (at paras 82-85).

I remain of that view. [ 122 ] In the same way that Health Canada was required to take into account any relevant developments between the date the access requests were filed and the time of its final decision (e.g. whether any other information had become public), I find that a court conducting a de novo review of a refusal to disclose a record should take into account any relevant changes between the date of the refusal and the time of the hearing of the matter.

Failure to do so would artificially freeze time for no purpose, and would be inconsistent with the de novo nature of the independent review a court is mandated to undertake. The assessment must be a practical one, taking into account all relevant evidence as of the date of the court hearing. [ 123 ] For example, if Health Canada produced evidence at the hearing of information releases

[…]