Under Ontario’s Freedom of Information and Protection of Privacy Act (FIPPA) and its municipal equivalent, the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), requestors can submit an access request for any records held by a provincial or municipal institution. However, FIPPA and MFIPPA draw numerous distinctions between “general records” access requests, where the requestor is seeking records that may be of general interest to the public, and “personal information” access requests, where the requestor is seeking records which contain his or her own personal information.
Today’s article is intended to provide an overview of the similarities and differences between general records requests and access to personal information requests to help institutions who may find themselves frequently processing both kinds of requests and having to switch back and forth between one set of rules and another.
General records requests and access to personal information requests have quite a lot in common:
Both general records requests and access to personal information requests must be accompanied by a $5.00 application fee. (Note there is no application fee for correction requests.)
Other Validity Requirements
Both general records requests and access to personal information requests must:
- Be in writing
- Be legible
- Be clearly made under the Act (FIPPA or MFIPPA)
- Describe the request in sufficient detail to enable an experienced employee of the institution, upon a reasonable effort, to identify the record(s)
For more details on the requirements of a valid access request, see this previous article.
Both general and personal information requests are subject to the same basic 30-day deadline.
Interim Fee Estimates
If the fees to process the request are expected to be over $100.00, the institution may issue an interim fee estimate and fee deposit request regardless of whether the request is for general records or personal information. (However, as detailed below, some of the fees which are applicable to general records requests cannot be charged for personal information requests.)
Institutions may issue a time extention for both general records requests and for personal information requests.
Clarification and Narrowing
If an access request is unclear, the institution has an obligation under FIPPA s. 24(2) and MFIPPA s. 17(2) to work with the requestor to help them formulate a request that is clear, regardless of whether the request is for general records or personal information. Similarly, the institution may suggest narrowing for either type of request, even when the original request is clear.
For further details on clarification and narrowing, see this previous article.
Forwarding and Transferring
Both general records requests and personal information requests may be forwarded and transferred to other institutions. (Although I would raise the question of whether it might be appropriate in certain circumstances to check with the requestor before forwarding their request for personal information to another institution.)
Index of Records
An index of records is recommended for all requests, whether for personal information or general records. More information on creating an index of records can be found in this previous article.
Affected Person Process
The affected person process is applicable to both general records requests as well as personal information requests. Affected persons may be asked for their position on the disclosure of potentially confidential information (also known as “third party information” under FIPPA s.17 and MFIPPA s.10) as well as on the disclosure of their personal information.
That said, the affected person process is perhaps used less frequently with respect to the personal information of third parties, as there is a presumption that the disclosure of many different kinds of personal information would be an invasion of privacy (in which case there may be no need to consult the person to whom the information relates). For more details, see the FOI Manual, Chapter 5, Section 16 “Personal Privacy”.
Both general records requests and personal information requests require a decision letter to be issued describing what exemptions were applied (if any) and the fees payable, and preferably including an index of records as well.
The Requestor’s Use of the Disclosure
Once records have been disclosed to the requestor, it’s generally understood that the requestor may do what they please with the records. If the records contain the personal information of the requestor, it’s up to the requestor to decide whether to keep the disclosure confidential or to share it with a larger audience.
Although similar in most regards, there are a number of important differences to keep in mind when processing an access to personal information request as compared to a general records request:
Proof of Identification
Members of the public all have the right to access general records held by the institution, so for general records requests, the identity of the requestor is usually of no significance. In contrast, individuals have a special right to access their own personal information. This means for personal information requests, it is important to verify that the requestor is who they claim to be. See this previous article for more details.
Proof of Consent
FIPPA s.21(1)(a) and MFIPPA s.14(1)(a) expressly allow individuals to request access to their own personal information through a third party, such as a lawyer, or even a friend or family member. However, the institution is not permitted to disclose personal information to such third party unless written consent has first been provided. See this previous article for more details.
For general records requests, institutions are allowed to charge for:
- time spent manually searching for a record
- time spent preparing the record for disclosure
- computer and other costs incurred in locating, retrieving, processing and copying a record
- shipping costs
- photocopies and computer printouts
- records provided on CD-ROMs
- other costs incurred in responding to a request, as may be set by regulation
However, for personal information requests, the institution is not permitted to charge the first two types of fees:
- time spent manually searching for a record
- time spent preparing the record for disclosure
For more information on what fees can be charged to a requestor and how much can be charged, I highly recommend the Ontario Information and Privacy Commissioner’s Office (IPCO) publication Fees, Fee Estimates and Fee Waivers (June 2018).
Most exemptions that apply to general records requests also apply to access to personal information requests.
The FOI Manual provides the following list of exemptions that apply to both general records requests and personal information requests:
- Draft by-laws and closed municipal meetings;
- Cabinet records;
- Advice to government/Advice or recommendations;
- Law enforcement;
- Civil Remedies Act;
- Prohibiting Profiting from Recounting Crimes Act;
- Relations with other governments;
- Relations with Aboriginal communities;
- Third party information;
- Economic and other interests
- Solicitor-client privilege;
- Danger to safety or health; and
- Information soon to be published.
Perhaps the most important difference is that FIPPA s.21 / MFIPPA s.14 (“Personal Privacy”) does not apply to personal information requests, and FIPPA s. 49(b) / MFIPPA s. 38(b) (“Personal Information of Other Individuals”) does not apply to general records requests. Therefore, institutions should not cite FIPPA s.21 / MFIPPA s.14 when responding to a request for an individual’s own personal information; cite FIPPA s. 49(b) / MFIPPA s. 38(b) instead.
A more detailed explaination of the “Personal Privacy” and “Personal Information of Other Individuals” exemptions will be the subject of an upcoming article. In the meantime, it’s fair to think of FIPPA s. 49(b) / MFIPPA s. 38(b) as roughly equivalent to FIPPA s.21 / MFIPPA s.14, but for personal information requests.
Deeming a Request Abandoned
According to IPCO:
For general records the request can be considered abandoned if the requester does not respond to correspondence that is necessary to complete the request (for example, a notice of fee estimate), within 30 days of the date you sent the communication. The head of your institution may extend this time limit, and this practice is encouraged.
For personal information requests, the policy is to allow up to 365 days (one year) before considering the request abandoned.IPCO Year-End Statistical Report Workbook and Completion Guide (November 2015), Section 7.5
Appeal Fees / Letter Templates
The fee for a requestor to appeal a decision for a general records request is $25.00, whereas for a personal information request, the appeal fee is only $10.00. Although this does not affect the institution’s processing of the file, it is important that the institution relate this information correctly when informing the requestor of their appeal rights, such as in interim fee estimates, time extensions and decision letters.
Generally, there are few differences in the letters required for general records requests and access to personal information requests, but minor details (such as this one) may vary.
The Institution’s Use of the Disclosure
To better serve the interests of the public, institutions may decide to publicly disclose records that are the results of a general records access request, such as by publishing such records on their website. In contrast, the results of personal information requests do not automatically become public information.
The IPCO’s Year-End Statistical Report draws an express distinction between general records requests and requests to access personal information. Every request must be categorized as one or the other before its statistics can be included in the year-end submission. Of course, requestors themselves are not always aware of this distinction and it is common for a single request to cover both general records as well as the requestor’s own personal information.
For example, a requestor might ask for all emails sent by a particular employee during a specified time period. Some of those emails might be general records, while others may include the personal information of the requestor. Such a request cannot be said to be entirely a request for personal information or for general records.
One potential solution to this dilemma is to split the request into two for processing purposes: one request for personal information and another for general records. This can help the institution ensure that search and preparation fees are not charged with respect to the personal information part of the request, that only applicable exemptions are invoked, and of course, that the requests are appropriately recorded in the year-end statistical report to IPCO.
For more information on splitting requests, see this previous article.
I hope you will find this article a handy reference the next time you are trying to remember the differences between general records requests and access to personal information requests.
The FOI Assist software can help you process both general records requests and access to personal information requests in full compliance with both FIPPA and MFIPPA. If you have any questions about the FOI Assist software, or if you would like to see the FOI Assist software in action, please contact me to arrange a call or videoconference.