Loading...
HomeMy WebLinkAboutADM 050 Municipal Freedom of Information and Protection of Privacy Policy Policy Policy Title: Municipal Freedom of Information and Protection of Privacy Policy Policy Number ADM 050 Reference Municipal Freedom of Information and Protection of Privacy Act, 1990 Resolution #211/16 and #924/26 Date Originated (m/d/y) November 26, 2007 Date Revised (m/d/y) June 2009 October 2016 January 26, 2026 Pages 16 Approval: Chief Administrative Officer Point of Contact City Clerk Policy Objective The Corporation of the City of Pickering is committed to the security and privacy of Records under its Custody and Control and providing a right of access to information that is under the Control of the City in accordance with the principles of the Municipal Freedom of Information and Protection of Privacy Act, 1990 (Act). The Act establishes rules for municipalities to follow when providing access to information and protecting individual privacy. The Objectives of this policy are to: 1. Ensure fair and equitable access to corporate Records and that necessary exemptions from the right of access are limited and specific. 2. Identify staff roles and assign responsibility regarding the security and disclosure of Records. 3. Commit to protecting the privacy of individuals with respect to Personal Information held by the City and to provide individuals with the right of access to their own information. 4. Ensure open, accessible, and transparent government while protecting the privacy of individuals. 5. Establish guidelines for processing requests for information within the legislated timelines imposed by the Act. 6. Communicate offenses and liabilities as stated in the Act. Index 01 Definitions 02 Responsibilities 03 General Policy Title: Municipal Freedom of Information and Protection of Privacy Policy Page 2 of 16 Policy Number: ADM 050 04 Active Dissemination 05 Routine Disclosure 06 Freedom of Information Requests 07 Privacy Impact Assessment 08 Forms 09 Offences and Liabilities 10 Limitations 01 Definitions 01.01 Active Dissemination – means the proactive, periodic release or publication of Records and information to the public in the absence of an FOI Request. Unlike a response to an FOI Request, Active Dissemination involves the Institution releasing certain Records, such as meeting agendas, staff reports, or other Records, on a regular basis to promote transparency and accountability, often by posting them on the City’s website. 01.02 City – means The Corporation of the City of Pickering. 01.03 Control – means the power or authority to decide the use or disclosure of a Record. 01.04 Custody – means the storage, care, preservation, or securing of a Record for a legitimate business purpose. 01.05 FOI Coordinator – means, for the purposes of this Policy and related procedures, the Records, Privacy & Elections Coordinator (or designate). 01.06 FOI Representative – means the designated employee within each department who manages FOI Requests for Records within their department. 01.07 Freedom of Information Request (FOI Request) – means a request for access or a copy of a Record which is submitted in writing detailing the requested Record(s) and is dated and signed by the requester and accompanied by the legislated application fee. 01.08 Head – means for the purposes of the Act, the City Clerk, who has been delegated the powers by Council through By-law. 01.09 Information and Privacy Commissioner (“IPC”) – means the Information and Privacy Commissioner of Ontario who is appointed by the Lieutenant Governor in Council. The Commissioner is an officer of the Legislature and is independent of the government. The Commissioner hears appeals of decisions made by Policy Title: Municipal Freedom of Information and Protection of Privacy Policy Page 3 of 16 Policy Number: ADM 050 Heads of Institutions, issues binding orders, conducts privacy investigations, and has certain powers relating to the protection of personal privacy. 01.10 Institution – means for the purposes of this Policy and related procedures, The Corporation of the City of Pickering. 01.11 Law Enforcement Agency – means an agency which has the function of enforcing and regulating compliance with a law. 01.12 Personal Information – means recorded information about an identifiable individual (not a corporation, partnership or sole proprietorship) as defined in Section 2(1) of the Act, including information relating to: a) Race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual; b) Education, medical, psychiatric, psychological, criminal or employment history, or financial transactions the individual has been involved with; c) Any identifying number, symbol, address, telephone number, fingerprints or blood type of an individual; d) Personal opinions or views of the individual except if they relate to another individual, and views or opinions of another individual about the individual; e) Correspondence sent to the City which is implicitly or explicitly of a private or confidential nature and includes replies to the correspondence that would reveal the contents of the original correspondence; and, f) The individual’s name if it appears with any other Personal Information relating to the individual or where disclosure of the name would reveal other Personal Information about the individual. 01.13 Record – means any information, however recorded, whether in printed form, on film, by electronic means or otherwise as defined in the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) and documents the City’s business functions, activities, transactions, rights, obligations or responsibilities or records information that was created, received, distributed or maintained by the City, and is in compliance with legal obligations. 01.14 Routine Disclosure – means the routine, proactive, or automatic release of certain types of administrative and operational Records in response to an inquiry or request for access outside of the FOI Request process. Records containing sensitive Personal Information or information protected by exemptions under the Act are generally not available through Routine Disclosure and may require a FOI Request. 01.15 Third Party – means any person, group of persons, or an organization whose interest might be affected by the disclosure of a Record, other than the person, Policy Title: Municipal Freedom of Information and Protection of Privacy Policy Page 4 of 16 Policy Number: ADM 050 group of persons, or organization making a request for access. Where the Third Party is an individual, another person may act on their behalf if authorization is provided by the individual. 02 Responsibilities 02.01 Members of Council: a) approve and support this Policy; and, b) approve amendments to this Policy as needed and as recommended by staff. 02.02 Chief Administrative Officer: a) support this Policy; and, b) approve amendments to this Policy for Council’s consideration. 02.03 Head: a) maintain a thorough knowledge of this Policy and the principles of the Act; b) ensure the FOI Coordinator and all FOI Representatives are appropriately abiding by the principles of the Act; c) ensure that reasonable measures respecting the Records in the Custody or under the Control of the Institution are developed, documented, and put in place to preserve the Records in accordance with any recordkeeping or Records retention requirements, rules or policies that apply to the City; d) administer the privacy protection provisions of the Act; and, e) represent the City during IPC appeals and defend decisions made in compliance with the Act. 02.04 City Solicitor: a) maintain a thorough knowledge of this Policy and related procedures; b) represent the City during IPC appeals and defend decisions made in compliance with the Act, if/when required; and, c) provide legal advice to the FOI Coordinator and the Head respecting disclosure decisions, as required. 02.05 Director/Division Head: a) understand this Policy and the principles of the Act; Policy Title: Municipal Freedom of Information and Protection of Privacy Policy Page 5 of 16 Policy Number: ADM 050 b) appoint a minimum of one FOI Representative to perform roles and responsibilities as defined in Section 02.07 of this Policy; c) ensure proper notice is given to the public prior to the collection of any Personal Information; and, d) ensure that all Personal Information is managed in accordance with this Policy and principles of the Act. 02.06 FOI Coordinator: a) maintain a thorough knowledge of this Policy and related procedures; b) receive FOI Requests and coordinate those requests with FOI Representatives to comply with legislated time requirements; c) communicate with requesters to clarify requests, issue notices, and respond to inquiries; d) communicate with the Information and Privacy Commissioner’s Office to respond to inquiries and seek clarification and direction regarding appeals; e) seek legal advice from the City Solicitor respecting disclosure decisions and appeals, as required; f) make recommendations regarding the disclosure of Records to the Head; g) determine or waive fees in accordance with the Act; h) conduct training on privacy and access to Records; and, i) develop and maintain procedures related to this Policy as required. 02.07 FOI Representative: a) maintain thorough knowledge of this Policy and Records request processes; b) compile all Records within their area of responsibility relative to the scope of the request, submit preliminary disclosure recommendations, if necessary, and provide a fee estimate to the FOI Coordinator; c) coordinate requests with staff, Members of Council, and the FOI Coordinator to comply with legislated time requirements; d) participate in training on privacy and access to Records processes; e) meet as required with the FOI Coordinator and other FOI Representatives to discuss matters related to this Policy; Policy Title: Municipal Freedom of Information and Protection of Privacy Policy Page 6 of 16 Policy Number: ADM 050 f) provide guidance to staff within their area of responsibility to ensure use and disclosure of Records complies with guidelines and procedures outlined in this Policy and related procedures; and, g) review all FOI Requests pertaining to their department with the Director prior to responding to the FOI Coordinator. 02.08 All City Staff: a) be familiar with this Policy; b) have a sound knowledge of Records within their scope of responsibility, which qualify for Routine Disclosure; c) make recommendations to their FOI Representative regarding Routine Disclosure; d) immediately forward all FOI Requests for Records to the FOI Coordinator; e) protect Personal Information to which they have access to or Custody of; and, f) minimize the collection of Personal Information to only that which is necessary. 03 General 03.01 Every person, organization, and corporation has the right to request Records under the Custody and Control of the City in accordance with the Act. The City is not obligated to create a Record in response to a request, and the City has no right to question the purpose for the request. 03.02 The Act provides that information available to the public before the Act came into force must continue to be available, except Personal Information. Routine Disclosure and informal requests should continue to be processed outside the parameters of this Policy, as needed. 03.03 The Act outlines categories of Records to which the Act does not apply. Categories of Records that are excluded from disclosure under the Act include: a) proceedings or anticipated proceedings before a court, tribunal, or other entity relating to labour relations or to the employment of a person by the Institution; b) negotiations or anticipated negotiations relating to labour relations or to the employment of a person by the Institution between the Institution and a person, bargaining agent, or party to a proceeding or an anticipated proceeding; and, Policy Title: Municipal Freedom of Information and Protection of Privacy Policy Page 7 of 16 Policy Number: ADM 050 c) meetings, consultations, discussions, or communications about labour relations or employment-related matters in which the Institution has an interest. 03.04 Requesters’ identities are protected and are only disclosed when there is a clear need to facilitate an access to Records request or as required by legislation. 03.05 Access decisions in response to requesters exercising their right to access City Records will be made in a consistent manner in accordance with the Act regardless of the requesters’ identity. 03.06 Staff have a duty to ensure every reasonable effort is made to assist requesters, by providing complete, accurate, and timely responses to their requests using the appropriate access to Records process. 03.07 In accordance with the Act, it is an offence to willfully alter, conceal, destroy/delete, or cause any person to do so, with the intention of denying access to a Record or information contained in a Record. 04 Active Dissemination 04.01 Active Dissemination is the release of certain Records by the City to the public in the absence of a FOI Request. Examples of this might include meeting agendas, staff reports and minutes, public notices, and audit reports, which could be published online. 04.02 When determining the types of Records that qualify for Active Dissemination, staff shall consider the following: a) look for trends in the type of Records requested on a regular basis to determine what general Records are frequently requested and could be made available for Active Dissemination; b) review any class of Record that is released regularly, without exemption; c) determine Records that must be made available because of a statutory requirement; d) determine whether a Record is subject to Active Dissemination based on the nature of the Record and not on the identity of the requester or proposed use of the Record; and, e) when unsure if a Record can be considered for Active Dissemination, staff shall contact the FOI Coordinator to determine if Active Dissemination would be appropriate. Policy Title: Municipal Freedom of Information and Protection of Privacy Policy Page 8 of 16 Policy Number: ADM 050 05 Routine Disclosure 05.01 Where possible, requests should be handled through an informal access process. Regardless of where or how a request is submitted, staff should direct the requester to the area of responsibility respecting the requested information unless it is determined that the requested Records may contain Personal Information or other exemptions under the Act. The employee is to open dialogue with the requester to discuss the nature of the request and the type of Records at issue with a view to determine whether the matter should be handled informally through Routine Disclosure or by means of a FOI Request. 05.02 Routine Disclosure refers to the routine release of certain categories of administrative and operational Records to the public upon request. 05.03 Routine Disclosure processes are established and maintained by the department who has Custody and/or Control of the Records. When considering the disclosure of a new category of Records through Routine Disclosure, the FOI Representative for the department should consult the FOI Coordinator to ensure that the Records do not require a FOI Request. 05.04 Employees are encouraged to use caution when responding to Routine Disclosure requests to ensure that no personal or confidential information is shared. Any questions about disclosure should be directed to the FOI Coordinator. 05.05 Records may be disclosed to the public directly by the department responsible upon receipt of a Routine Disclosure request in accordance with this Policy and any applicable legislation. 05.06 The following provisions may apply to requests for Routine Disclosure: a) Routine Disclosure requests should be directed to the responsible Department; b) Personal Information may only be disclosed to the party to whom the information pertains unless authorized by policy, by-law, or legislation; c) If an individual requests Records pertaining to themselves or their property, staff shall confirm their identity through government-issued photo identification. Staff may also release information to an authorized agent provided they have written authorization from the individual to which the information pertains, along with a copy of the individual’s identification and their own identification; d) A fee may be charged for the reproduction, search, and processing of Records released under Routine Disclosure. Any such fees would be contained in the department’s fee schedule under the City’s General Municipal Fees and Charges By-law; and, Policy Title: Municipal Freedom of Information and Protection of Privacy Policy Page 9 of 16 Policy Number: ADM 050 e) Departments should strive to review and update their Routine Disclosure practices at least once a year to ensure compliance with current legislation, evolving privacy standards, and best practices for transparency and accountability. 05.07 Examples of Records and information that may not be released through Routine Disclosure include, but are not limited to: a) Requests for Personal Information for the purpose of any type of research or analysis. Such requests shall be forwarded to Legislative Services for processing and response in accordance with the Act; b) Records containing Personal Information that are being requested by a Law Enforcement Agency in Canada to aid in an investigation or where a law enforcement proceeding is likely to result. All such requests must be made in writing to the City Clerk or designate; and, c) Records containing Third Party information. All such requests should be forwarded to Legislative Services for processing and response in accordance with the Act. 06 Freedom of Information Requests 06.01 Once an FOI Request has been submitted to the City, the FOI Coordinator contacts the necessary Directors, FOI Representatives, and other applicable staff to arrange for collection of Records pursuant to the scope of the request. Along with the requested Records, the FOI Representative will provide the FOI Coordinator with an estimate of the time required to search for the Records and any privacy or security concerns they may have relating to the disclosure of the Records. 06.02 If an individual requests Records pertaining to themselves or their property through an FOI Request, the FOI Coordinator shall confirm their identity through government-issued photo identification. The FOI Coordinator may also release Records to an authorized agent provided they have written authorization from the individual requesting their own information, a copy of the individual’s identification, and a copy of their own identification. 06.03 The FOI Coordinator is responsible for determining disclosure in consultation with the Head. Under the Act, there are two types of exemptions that must be considered when assessing whether a Record is to be disclosed: a) Mandatory Exemptions under the Act that require the Institution to refuse disclosure of the Record; and, b) Discretionary exemptions under the Act that require an Institution to apply discretion and good judgment when determining whether to disclose the Record. Policy Title: Municipal Freedom of Information and Protection of Privacy Policy Page 10 of 16 Policy Number: ADM 050 06.04 Although the above-two types of exemptions provide direction as to what must or may be considered when assessing whether to disclose Records, there are times when the above exemptions do not apply: a) there is a compelling public interest that outweighs the purpose of the exemption; or b) there is a grave environmental, health or safety hazard, regardless of whether a FOI Request for information has been made. 06.05 Where the original request does not sufficiently describe the Record(s) being sought, the FOI Coordinator shall inform the requester and offer assistance in reformulating the request. 06.06 The FOI Coordinator shall issue a Notice of Decision and any other required Notices under the Act to the requester within the timelines prescribed by the Act. 06.07 In accordance with the Regulations under the Act, the FOI Coordinator in coordination with the FOI Representative shall estimate the processing, searching and copying fees, based on the scope and nature of the request. 06.08 The Act dictates that the Notice of Decision must be issued to the requester within 30 days of receipt of a completed FOI Request. If an FOI Request is deemed incomplete or too vague and must be clarified, the 30 days starts after clarification is received and the legislated application fee has been paid. 06.09 The Act provides that the Head may extend the thirty-day time limit in the following circumstances: a) the request is for a large number of Records or staff will have to search through a large number of Records and to do so would unreasonably interfere with the operations of the City; or, b) consultations with people outside of the Institution are necessary before responding and cannot reasonably be completed within the 30-day time limit. 06.10 Extensions are not permitted in the following circumstances: a) the number of requests being processed at any given time; b) staff vacation; or, c) the expense of producing a Record where the expense is caused by the size, number or physical location of the Records. 06.11 A Third Party is a party whose interests may be affected by disclosure of the Records at issue. The purpose of this mandatory exemption under the Act is to protect certain confidential information that Third Parties, such as businesses or other organizations, provide to government Institutions, where specific harms can reasonably be expected to result from its disclosure. In these Policy Title: Municipal Freedom of Information and Protection of Privacy Policy Page 11 of 16 Policy Number: ADM 050 circumstances, the Third Party identified in the Record must be notified of the City's intention to release the Records. This notification will allow the Third Party the opportunity to make representations on the proposed disclosure. If the Third Party disapproves of the City's final decision, they have the right to appeal to the IPC. During the appeal process, the City's response period to the Requestor is put on hold. 06.12 Within the time limits specified in the Act, the requester must be notified in writing of the City's decision. The City's response, based on the mandatory and discretionary exemptions stated in the Act, will be: a) access granted in whole; b) access denied in whole or in part (with the applicable exemption section of the Act stated); c) no Records exist; or d) that the Head refuses to confirm or deny the existence of a Record (Note: this can only be used for specific types of Records under the Act). 06.13 In most cases, the requester will obtain access to a copy of the Records through an electronic file transfer. Originals may be accessed and reviewed by the requester in situations where there is a large volume of Records, or at the request of the requester. When access to original Records is granted, the requester must be supervised by a municipal employee while they review the Records. 06.14 Any requester who is dissatisfied with the City's decision to withhold Records or to release Records only in part, or any Third Party who is dissatisfied with the City's decision to release Records that they felt should not be released, may appeal to the IPC. The notice to appeal must be filed with the IPC’s Office within thirty days of the date of the City's decision. 06.15 The FOI Coordinator is responsible for receiving all appeal notices from the IPC’s Office and preparing written representations for submission to the IPC, in consultation with the Head and the City Solicitor, as required. The Head will represent the City by defending its decisions through written submissions to the IPC and will participate in any mediation processes, working in coordination with the FOI Coordinator and the City Solicitor, as required. 06.16 An Order issued by the IPC is binding on all parties to the appeal. An order is not subject to appeal; however, it may be subject to request for reconsideration or a judicial review. The order itself will specify new time periods within which any further action must be taken by either or both parties involved. The FOI Coordinator will take the necessary actions as specified in the order. Policy Title: Municipal Freedom of Information and Protection of Privacy Policy Page 12 of 16 Policy Number: ADM 050 07 Privacy Impact Assessment 07.01 A PIA is used to assess compliance with the Act and aims to identify and address the privacy impacts of proposed projects or activities of the Institution. 07.02 Before staff implement a project or undertake an activity that involves the collection of Personal Information, they shall consult with the Head, who will determine whether a PIA is required. Staff may be required to conduct a preliminary assessment to assist the Head in making such determination. A PIA may be required where the Head determines: a) the collection is at a large scale; b) the Personal Information is deemed sensitive; or, c) the collection, use, or disclosure of the Personal Information impacts decision making. 07.03 Where the Head determines a PIA is required, the FOI Coordinator shall conduct a PIA, in consultation with the Head and appropriate staff, prior to the implementation of the project or activity. 07.04 Once the PIA has been completed, it shall be reviewed and/or approved by the Head. If recommendations are made by the Head to implement controls related to the protection of Personal Information or for compliance with legislation, those recommendations shall be adopted by staff prior to continuing with the activity or project. 08 Forms 08.01 All forms created by or for the City to collect Personal Information and used for City activities are subject to the Act. 08.02 At the point of creation, forms shall be created in accordance with City policies and procedures, and shall be reviewed by the FOI Coordinator to ensure compliance with the Act. 08.03 Forms that include the collection of Personal Information shall include the following clause: "Personal Information contained on this form is collected pursuant to the Municipal Freedom of Information and Protection of Privacy Act, and will be used for the purpose of [insert specific purpose]. Questions about this collection should be directed to the City Clerk, One The Esplanade, Pickering, ON L1V 6K7, 905.420.4611." Policy Title: Municipal Freedom of Information and Protection of Privacy Policy Page 13 of 16 Policy Number: ADM 050 09 Offenses and Liabilities 09.01 Section 48 of the Act outlines offences that can lead to prosecution. The section states that no person shall: a) wilfully disclose Personal Information in contravention of this Act; b) wilfully maintain a Personal Information bank that contravenes this Act; c) make a request under this Act for access to or correction of Personal Information under false pretences; c.1) alter, conceal or destroy a Record, or cause any other person to do so, with the intention of denying a right under this Act to access the Record or the information contained in the Record; d) wilfully obstruct the Commissioner in the performance of his or her functions under this Act; e) wilfully make a false statement to mislead or attempt to mislead the Commissioner in the performance of his or her functions under this Act; or f) wilfully fail to comply with an order of the Commissioner. 09.02 Fines of up to $5,000.00 may be imposed if a contravention of Section 48 has been found. 09.03 Section 49(2) of the Act provides that no action or other proceeding lies against the Head or another person acting under the direction of the Head for damages resulting from the disclosure or non-disclosure in good faith of a Record or any part of a Record under the Act, or from failure to give notice required under the Act if reasonable care is taken to give the required notice. 10 Limitations 10.01 Records destroyed in accordance with the City’s Records Retention By-law. The City is not required to re-create or restore Records that have been appropriately destroyed under the authority of the City’s Records Retention By-law. 10.02 The City is not required to provide information verbally discussed but not recorded, or create information that does not otherwise exist in a Record. Please refer to all associated Procedures and Standard Operating Procedures, if applicable, for detailed processes regarding this Policy. Policy Title: Municipal Freedom of Information and Protection of Privacy Policy Page 14 of 16 Policy Number: ADM 050 Appendices Appendix 1 Application for Access/Correction to Records Form Appendix 2 Fee Schedule Policy Title: Municipal Freedom of Information and Protection of Privacy Policy Page 15 of 16 Policy Number: ADM 050 Appendix 1 Policy Title: Municipal Freedom of Information and Protection of Privacy Policy Page 16 of 16 Policy Number: ADM 050 Appendix 2