The Affected Person Process

Introduction

Most of the exemptions under Ontario’s Freedom of Information and Protection of Privacy Act (“FIPPA”) and its Municipal Freedom of Information and Protection of Privacy Act (“MFIPPA”) are about protecting the interests of the institution, the government, or the public interest generally.  For example, the “Advice” exemption (FIPPA s. 13, MFIPPA s. 7) and the Solicitor-Client privilege exemption (FIPPA s.19, MFIPPA s.12) both uphold the ability of the government to seek advice from its employees and from outside sources on a confidential basis.  As another example, the “Defence” exemption (FIPPA s.16) allows institutions to refuse to disclose a record which may prejudice the defence of Canada or any allied state.  In all of these cases, it is the interests of the government and its institutions which are being protected, or the public interest itself, which the government is responsible for safeguarding.

However, there are two special exemptions where institutions are tasked with protecting the private interests of third parties:  The “third party information” exemption (FIPPA s.17, MFIPPA s.10) and the “personal privacy” exemption (FIPPA s.21, MFIPPA s.14).  These two exemptions recognize that institutions may have custody or control over information in which third parties have a legal interest.

To ensure that institutions are required to consider the legal rights of such third parties before making any disclosure decision regarding information to which either exemption applies, both FIPPA and MFIPPA establish the “affected person” process.  Institutions are required to follow the affected person process when contemplating the disclosure of information to which the third party information exemption or the personal privacy exemption may apply.

The affected person process is one of the most important and visible ways that FIPPA and MFIPPA balance the public’s right of access against the rights of individuals and organizations to prevent the disclosure of their personal and confidential information.  Other names for the process include the “notice to affected person” process, “third party notice” process, the “affected third party” process, and the “affected third person” process.

The affected person process is set out in section 28 of FIPPA and section 21 of MFIPPA.  The process officially begins with the notification of any third parties who may potentially be affected by the disclosure of information to which the third party information exemption or the personal privacy exemption may apply.  The notified persons are then given a chance to give their opinion on the potential disclosure of the information in the form of verbal or written representations.  The institution then reviews the representations received, and makes a determination regarding the disclosure of the relevant information, given notice of their decision to both the person who requested the information, and the affected persons.  The affected persons are then given an opportunity to appeal the disclosure decision before the institution actually discloses the requested documents.

A more detailed description of the process is as follows:

The Affected Person Process, step-by-step

1. Determine whether “third party information” or “personal privacy” exemptions may apply to the responsive records.

The affected person process does not begin until after the institution has received a valid Freedom Of Information (FOI) request, has searched for the documents responsive to the request, and has reviewed the responsive documents to consider what FIPPA/MFIPPA exemptions may apply to the documents.  As a preliminary step, as part its review of the documents, the institution must consider whether the “third party information” or the “personal privacy” exemptions may apply to the documents.  The threshold for determining whether the third party information exemption or the personal information exemption may apply to a record at this stage is very low, because at this point the institution is not making a final determination as to whether or not the information will be disclosed to the requestor; rather, the institution is merely identifying information within the records that may trigger the affected person consultation process.  At this stage, the institution must merely determine whether either exemption “might” apply, in which case, the institution should proceed with the next step of the Affected Person process.

2. Determine whether the relevant information is otherwise exempt from disclosure.

As another preliminary step, before proceeding to notify affected persons of the potential disclosure of information that might affect their interests, the institution should consider whether the information would be exempt from disclosure in any case.  For example, if certain records are already clearly exempt from disclosure under the mandatory “defence” exemption, then there is no need to consult affected persons in order to ask for their representations on whether the “third party information” exemption may also apply to such records.  Similarly, it may be obvious to an institution that the “personal privacy” exemption should apply to certain records without needing to consult the person to whom the information relates.  For example, an institution might receive a request for its employees’ home addresses from a requestor with no apparent justification for making this kind of request.  In this kind of situation, the institution may simply refuse to disclose the requested personal information without any need to consult its employees.

3. Notify the affected persons.

If the institution determines that the “third party information” or “personal privacy” exemptions might apply to records that may otherwise be subject to disclosure, then the institution is required to notify the affected persons of the potential disclosure.  Sending out this notification to affected persons is generally considered the official “start” of the affected person process, as the preliminary steps described earlier are taken merely to determine whether the affected person process is required.

Section 28(2) of FIPPA and 21(2) of MFIPPA set out the specific requirements for the notice sent to each affected person:

The notice shall contain,

(a) a statement that the head intends to release a record or part thereof that may affect the interests of the person;

(b) a description of the contents of the record or part thereof that relate to the person; and

(c) a statement that the person may, subject to subsection (5.1), within twenty days after the notice is given, make representations to the head as to why the record or part thereof should not be disclosed.

Note that the institution is merely required to “describe” the contents of the relevant records that may relate to the person.  Generally, the most straightforward way to describe the content to the affected person is to simply provide them with a full copy of the relevant record.  This approach has many advantages – it leaves a clear written record of exactly what documents relate to the affected person (assuming file copies of all FOI-related correspondence are retained by the institution), it gives the affected person the clearest description of the information that may be disclosed, and it forecloses the possibility of an affected person later taking issue with the institution’s description of the relevant documents.  (E.G., otherwise, an affected person could later claim that the description of the documents they were provided was inaccurate or incomplete.)

However, providing affected persons with full copies of the relevant records may not always be possible.  In some cases, information belonging to multiple parties may appear on the same document.  Often, this problem can be solved by providing each affected person with a redacted version of the relevant documents, where only the information relating to that specific affected person is visible.  However, if the affected person’s information is so intertwined with other information in the document as to make it inseparable, then simply providing a description of the document rather than providing a copy of the document itself may be the institution’s only viable option.

4. Notify the requestor of the delay.

The affected person process itself generally takes 30 days to complete: 20 days of reaching out to affected persons and seeking representations, followed by 10 days of reviewing representations and then preparing and sending out a decision letter.

If there are fewer than 30 days left “on the clock” before the decision letter is due, initiating the affected person process has the effect of extending the decision letter deadline to 30 days after the initial affected person notices are sent out.   FIPPA and MFIPPA consider this to be a permissible delay in order to run the process effectively.

To communicate the new deadline to the requestor and to explain why the deadline has been extended, the institution is required to send the requestor a “Notice of Delay”, which should be sent to the requestor at the same time that the initial affected person notices described above are sent.

The Notice of Delay should inform the requestor that one or more affected third parties is being given an opportunity to make representations concerning certain requested records whose disclosure may affect their interests, and that the institution will decide whether or not to disclose the relevant records within 10 days of the expiry of the period for making such representations.

5. Wait 20 days for representations.

The institution must now wait for any potential representations to arrive from the notified affected persons regarding why the relevant records (or parts thereof) should not be disclosed.  The affected persons are permitted up to 20 days to submit such representations.

It is a good practice to follow up with affected persons by phone to ensure they received the notice and to ask whether they plan to submit any representations.  Some affected persons may be willing to provide brief representations over the phone, which can be helpful.  Affected person representations vary widely, from a simple phone communication stating “we don’t care if the records are disclosed” all the way to complicated, multi-page legal memorandums setting out the affected person’s position on disclosure.

6. Issue a disclosure decision to the requestor

After the 20 days have elapsed, the institution has 10 days to consider any representations received and issue a decision letter to the requestor.  It should be noted at this point that while affected person representations can be helpful and illuminating, the institution is under no obligation to agree with the representations provided.  The responsibility for making the disclosure decision lies with the institution, not the affected third person.

7. Notify all affected persons of the disclosure decision(s) made

At the same time the institution issues its decision letter to the requestor, the institution is expected to issue a “Notice to Disclose Information” or a “Notice to Withhold Information” to each affected person, even those who did not submit any representations.  Among other things, this notice informs the affected person of their right to appeal the institution’s decision to the Information and Privacy Commissioner of Ontario (“IPCO”).

8. Wait 30 days to give affected persons the opportunity to appeal

Generally, an institution will send out the requested documents either with the decision letter itself, or shortly thereafter, as soon as any remaining fees owed by the requestor have been received.  However, if the institution has sent out notifications under the affected person process, then the institution is expected to wait 30 days after sending out the decision letter and the notices of disclosure to the affected persons before disclosing the requested documents to the requestor.  This 30-day period is intended to give each affected person the opportunity to appeal the disclosure decision to the IPCO.  The IPCO will contact the institution promptly if an appeal is received from an affected person and direct the institution not to disclose any documents until further instructions are received from IPCO.

Note that in practice, institutions may wish to wait slightly longer than 30 days before sending out the requested documents, as affected persons may not file an appeal with IPCO until the final day of the 30 day period, and then it may take a few days for IPCO to receive and process the appeal, resulting in a call from IPCO a few days after the end of the 30 day period.  An institution is also free to call IPCO after the 30 days have passed to check whether any appeal has been filed before sending documents out.

9. Disclose the records

After the waiting period described above, assuming the requestor has paid all fees owing and no notification of an appeal has been received from the IPCO, then the institution should disclose the requested documents to the requestor (subject to any exemptions).

Conclusion

I hope today’s article has helped you better understand the affected person process.  Are there any FOI related topics you would like to see covered in a future article?  I would love to hear from you!  Feel free to comment below, or alternatively, you can always contact me directly via the contact page of this blog.

If you’d like to stay engaged with updates and see pre-release previews and demos of the FOI Assist software, please follow the FOI Assist blog.  To subscribe, simply enter your email address at the bottom of the page then click the follow button.

Links to Resources:

Ontario:

Freedom of Information and Protection of Privacy Act (FIPPA) https://www.ontario.ca/laws/statute/90f31

Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) https://www.ontario.ca/laws/statute/90m56

Freedom of Information and Protection of Privacy Manual https://www.ontario.ca/document/freedom-information-and-protection-privacy-manual/

Information and Privacy Commissioner of Ontario https://www.ipc.on.ca/

Related articles:

1. The FOI Request Process Poster
2. An Introduction to Freedom Of Information
3. Stop the Clock!  How different actions affect the deadline