Date: 20191009
Docket: T-1682-18
Citation: 2019 FC 1279
Ottawa, Ontario, October 9, 2019
PRESENT: Mr. Justice McHaffie
| BETWEEN:
|
| THE INFORMATION COMMISSIONER OF CANADA
|
| Applicant
|
| and
|
| THE MINISTER OF PUBLIC SAFETY AND EMERGENCY PREPAREDNESS
|
| Respondent
|
JUDGMENT AND REASONS
I.
Overview
[1]
Information that relates to an object rather than a person, such as the firearm serial numbers at issue in this case, is not by itself generally considered “personal information”
since it is not information about an identifiable individual. However, such information may still be personal information exempt from disclosure under the Access to Information Act, RSC 1985, c A-1 [ATIA] if there is a serious possibility that the information could be used to identify an individual, either on its own or when combined with other available information.
[2]
The assessment of whether information could be used to identify an individual is necessarily fact-driven and context-specific. The “other available information”
relevant to the inquiry will depend on the nature of the information being considered for release. It will include information that is generally publicly available. Depending on the circumstances, it may also include information available to only a segment of the public. However, it will not typically include information that is only in the hands of government, given the purposes of both the ATIA and the personal information exemption.
[3]
The evidence in this case does not establish a serious possibility that the release of the firearm serial numbers at issue will allow identification of an individual. To use the serial numbers to identify an individual would require either access to restricted government databases that already contain personal information, or a successful effort to trick either the government or the manufacturer into releasing personal information. The evidence does not establish a serious possibility of either occurring. The respondent has not met the onus of establishing that the firearm serial numbers are “personal information.”
No other grounds to exempt the information from disclosure under the ATIA were raised, and the serial numbers will therefore be ordered released to the requester in response to their ATIA request.
[4]
Had I concluded that the information was personal information exempt from disclosure, I would have remitted the matter back to the Royal Canadian Mounted Police to redetermine the exercise of discretion under subsection 19(2) of the ATIA, as the RCMP did not reasonably consider whether the public interest in disclosure would outweigh the invasion of privacy resulting from release.
II.
Facts
A.
The Request for Access to Information and Partial Release of Information
[5]
In 2014, the RCMP received the following request for access to records under the ATIA:
I am seeking all documentation regarding a Sig Sauer P226 serial number U 120 530 which was previously issued to RCMP ‘E’ Division Emergency Response Team.
I am also seeking a copy of the “disposal list” as well as a list of all the firearms that were sent back on warranty replacement around 1986.
[6]
A “Sig Sauer P226”
is a firearm, specifically a model of handgun manufactured by Sig Sauer, Inc. [Sig Sauer]. As with most other firearms, each Sig Sauer P226 bears a serial number, such as the “U 120 530”
referenced in the request. No two Sig Sauer P226 guns will bear the same serial number, although two or more firearms of different makes or models might, coincidentally, carry the same number, particularly if the manufacturer adopted a fairly simple numbering system. Taken together, the make, model and serial number represent a unique firearm.
[7]
In response to the ATIA request, the RCMP identified a 13-page chart that listed information regarding 468 Sig Sauer P226 firearms. With respect to each gun, the chart sets out the serial number, the model (“SIG SAUER 226”
in each case), the RCMP unit the firearm was initially issued to, the date of receipt, the disposition of the firearm (“Warranty Return”
in each case), and a column for comments (largely blank, but with the comment “Cracked frame”
in respect to some firearms, and the comment “Subject of ATIP”
for one firearm).
[8]
The RCMP determined that release of the firearm serial numbers would result in the disclosure of “personal information”
within the definition of section 3 of the Privacy Act, RSC 1985, c P-21, since disclosure of the serial numbers would result in disclosure of information about identifiable individuals. The RCMP therefore concluded that they had to refuse to disclose the serial numbers under subsection 19(1) of the ATIA.
[9]
The RCMP decided not to exercise the discretion available under subsection 19(2) of the ATIA to release the personal information. The RCMP noted that there had been no consent to disclose by those affected, that it would be unreasonable to attempt to obtain that consent, that the serial numbers were not already public, and that it was not in the public interest to disclose the serial numbers. The chart was therefore released to the requester with the serial numbers of the firearms redacted.
[10]
The requester advised the RCMP that the serial number of his own firearm had been redacted from the released document. In response, the RCMP released to the requester the serial number of their own firearm. However, the RCMP maintained the position that release of the other serial numbers would disclose personal information and refused to release the record with those numbers.
B.
The Information Commissioner’s Investigation and Recommendation
[11]
The requester filed a complaint with the Information Commissioner pursuant to paragraph 30(1)(a) of the ATIA. During the resulting investigation, the RCMP made representations expressing the view that the serial numbers were akin to a social insurance number and were thus personal information. The RCMP indicated that of the 468 serial numbers set out in the record, 398 (or 85%) were linked to an individual in the Canadian Firearms Information System (CFIS), with information including their name, date of birth and full address. The RCMP considered that the serial numbers could therefore be used to glean personal information from the CFIS database. The RCMP noted that they had consulted with Sig Sauer, presumably pursuant to section 27 of the ATIA, asking whether they had any objection to the release of the “comments”
column in the record, and received no objection from Sig Sauer.
[12]
The Information Commissioner concluded that the complaint was well-founded, as the RCMP had not established that the serial numbers constituted personal information within the meaning of section 3 of the Privacy Act. Pursuant to subsection 37(1) of the ATIA as it then read, the Information Commissioner reported these findings to the RCMP and recommended that the RCMP disclose the serial numbers of the firearms.
[13]
The RCMP considered the Information Commissioner’s recommendation, but decided not to adopt it, maintaining the view that the serial numbers were personal information associated with identifying information in the CFIS database, and noting the importance of a broad approach to the definition of “personal information.”
[14]
In light of the RCMP’s decision not to follow the recommendation, the Information Commissioner brought this application under paragraph 42(1)(a) of the ATIA as it then read. The Information Commissioner obtained the consent of the requester as required, and named the respondent as the Minister responsible for the RCMP. The Information Commissioner seeks an order directing the RCMP to disclose the unredacted record to the requester, including the serial numbers. In the alternative, the Information Commissioner asks that the matter be sent back to the RCMP for the re-exercise of the RCMP’s discretion under subsection 19(2) of the ATIA, on the basis that the RCMP has not reasonably exercised that discretion.
C.
Additional Evidence Filed by the RCMP on this Application
[15]
On this application, the RCMP filed an affidavit from Crystal Holub, the access officer responsible for handling the request, and an affidavit from Murray Smith, an RCMP employee with extensive experience with firearms including firearm serial numbers, who was presented as an expert to provide opinion evidence.
[16]
Ms. Holub’s affidavit describes the RCMP’s response to the access request, including the conclusion that the serial numbers were subject to exemption under subsection 19(1) of the ATIA as “personal information,”
and the RCMP’s exercise of its discretion under subsection 19(2).
[17]
Mr. Smith’s affidavit provides information regarding the nature and use of firearm serial numbers, the various government databases in which those serial numbers reside, and the potential for personal information to be released—either from those databases or from other sources—if the serial numbers at issue are disclosed.
III.
Issues
[18]
This application raises two primary issues:
Are the firearm serial numbers at issue “personal information”
within the meaning of section 3 of the Privacy Act and thus exempt from disclosure under subsection 19(1) of the ATIA?
If so, did the RCMP reasonably exercise the discretion set out in subsection 19(2) of the ATIA in refusing to disclose the information?
[19]
These two issues will be addressed after a review of the applicable statutory provisions of the ATIA and the Privacy Act, and the relevant analytical principles. The full provisions, as they stood at the time of the complaint and as currently amended, are set out in Appendices A and B respectively.
[20]
For the reasons given below, I conclude that the firearm serial numbers are not “personal information,”
but that if they had been, the RCMP did not reasonably exercise their discretion to assess whether the numbers should nonetheless be released.
IV.
The Legislative and Analytical Framework
A.
Preliminary Note: Amendments to the ATIA and the Privacy Act
[21]
On June 21, 2019, the ATIA was amended by An Act to amend the Access to Information Act and the Privacy Act and to make consequential amendments to other Acts, SC 2019, c 18 (Bill C-58). These amendments were made after the commencement of this application and after the parties filed their records, including memorandums of fact and law.
[22]
The amendments to the ATIA include changes relating to vexatious or bad faith requests and complaints, changes to the powers of the Information Commissioner including the introduction of a power to make orders to release records, and the addition of a new part of the ATIA regarding proactive publication of government information. The amendments to the Privacy Act include an amendment to the definition of “personal information,”
but not one that is relevant to this application.
[23]
None of the substantive provisions relevant to this application were materially amended. In particular, the purpose section of the ATIA (section 2) was amended, but those amendments are in keeping with the prior jurisprudence regarding the purpose of the right to access in the ATIA. Section 19 was also slightly amended, to replace the word “Act”
with the word “Part”
and to replace the words “personal information as defined in section 3 of the Privacy Act”
with simply the words “personal information.”
However, since the definition of “personal information”
that is now contained in section 3 of the ATIA reads “personal information has the same meaning as in section 3 of the Privacy Act,”
I take the amendment to be one of drafting and clarity, rather than any change in substance.
[24]
Had the amendments been in force at the time of the complaint, the matter might have taken a different route to come to this Court. In particular, the Information Commissioner might have ordered the RCMP to disclose the information after consulting with the Privacy Commissioner, and the RCMP could have then applied to this Court for review: ATIA, ss 36.1, 36.2, 37(1)(b), 41(2); SC 2019, c 18, s 45. The roles of applicant and respondent would then have been reversed on this application. However, the onus and the relevant substantive provisions are the same under the current and former versions of the ATIA and Privacy Act. The recent amendments therefore do not affect the analysis or the outcome of this application.
B.
Applicable Substantive Provisions
[25]
Both the right to privacy and the right of access to information in the possession of government are sufficiently important that the ATIA and the Privacy Act have each been described as “quasi-constitutional”
statutes: Canada (Information Commissioner) v Canada (Minister of National Defence), 2011 SCC 25 at para 40; H.J. Heinz Co. of Canada Ltd. v Canada (Attorney General), 2006 SCC 13 [Heinz] at para 28.
[26]
Sections 2 and 4 of the ATIA set out the general principle that the public has a right to access information in records that are under the control of government. As previously stated in the jurisprudence and now express in the amended subsection 2(1) of the ATIA, this general principle enhances accountability and transparency in government and promotes an open and democratic society: see, e.g., Merck Frosst Canada Ltd v Canada (Health), 2012 SCC 3 [Merck Frosst] at paras 1, 21-22.
[27]
The general principle of access to information under the control of government is expressly limited by “necessary exceptions to the right of access”
that are set out in the ATIA, which exceptions “should be limited and specific”
: ATIA, s 2; Merck Frosst at para 21. The exceptions to the right of access in the ATIA take the form of either discretionary exemptions (information that a government institution “may”
refuse to disclose) or mandatory exemptions (information that a government institution “shall”
refuse to disclose).
[28]
Subsection 19(1) of the ATIA sets out a mandatory exemption to the general principle of access in the case of records that contain “personal information,”
a term that is defined in the ATIA with reference to section 3 of the Privacy Act. Subject to a discretion set out in subsection 19(2), discussed further below, a government institution must refuse release of records that contain “personal information.”
[29]
Section 3 of the Privacy Act defines “personal information”
through a general definition; a non-exhaustive and non-restrictive list of examples that do not restrict the generality of the general definition (subsections 3(a) to (i)); and a list of exceptions (subsections 3(j) to (m)). The general definition is broadly drafted: “personal information means information about an identifiable individual that is recorded in any form…”
[Emphasis added.] Section 2 of the Privacy Act sets out that the purpose of the statute is to “protect the privacy of individuals with respect to personal information about themselves held by a government institution and [to] provide individuals with a right of access to that information.”
[30]
In Dagg v Canada (Minister of Finance), [1997] 2 S.C.R. 403 [Dagg], the Supreme Court of Canada considered both the scope of “personal information”
in the Privacy Act and the interplay between the Privacy Act and the ATIA. Justice La Forest wrote in dissent, but spoke for the Court on the approach to interpreting the two statutes. He underscored that the Privacy Act and the ATIA must be interpreted in parallel given their overlapping subject matter and legislative history. Since both statutes contain an express exemption of personal information from disclosure, privacy rights must be recognized as “paramount”
over access to the extent that information falls within the definition of “personal information,”
as Justice La Forest explained at paragraph 48:
Both statutes regulate the disclosure of personal information to third parties. Section 4(1) of the Access to Information Act states that the right to government information is “[s]ubject to this Act”. Section 19(1) of the Act prohibits the disclosure of a record that contains personal information “as defined in section 3 of the Privacy Act”. Section 8 of the Privacy Act contains a parallel prohibition, forbidding the non-consensual release of personal information except in certain specified circumstances. Personal information is thus specifically exempted from the general rule of disclosure. Both statutes recognize that, in so far as it is encompassed by the definition of “personal information” in s. 3 of the Privacy Act, privacy is paramount over access. [Emphasis added.]
[31]
Justice La Forest noted that the protection of privacy was a “fundamental value in modern, democratic states”
and that the definition of “personal information”
in section 3 of the Privacy Act is “undeniably expansive”
and “deliberately broad”
: Dagg at paras 65, 68-69. Its intent is to capture “any information about a specific person, subject only to specific exceptions”
: Dagg at para 69 [Emphasis in original.]
[32]
As noted above, the examples that are set out in subsections (a) to (i) of the definition of “personal information”
in section 3 of the Privacy Act do not restrict the generality of the general definition. Justice La Forest confirmed that they are merely examples of the type of subject matter encompassed by the general definition, such that “if a government record is captured by those opening words, it does not matter that it does not fall within any of the specific examples”
: Dagg at para 68.
[33]
The recognition in Dagg of the supremacy of privacy over access and the broad definition of personal information has been consistently reaffirmed over the decades since Dagg by the Supreme Court of Canada and the Federal Courts: Heinz at paras 61, 71; Husky Oil Operations Limited v Canada-Newfoundland and Labrador Offshore Petroleum Board, 2018 FCA 10 [Husky Oil] at paras 25, 55.
[34]
The general definition of “personal information”
requires that information must be “about an identifiable individual.”
The importance of privacy rights is such that the courts have recognized that even if information may not on its face reveal anything personal, it will be “about”
an identifiable individual and exempt from disclosure if there is a serious possibility that the individual could be identified through the release of the information. In Canada (Information Commissioner) v Canada (Canadian Transportation Accident Investigation and Safety Board), 2006 FCA 157, leave to appeal to SCC refused, 2007 CanLII 11607 [NavCanada], Justice Desjardins wrote the following at paragraph 43:
These two words, “about” and “concernant”, shed little light on the precise nature of the information which relates to the individual, except to say that information recorded in any form is relevant if it is “about” an individual and if it permits or leads to the possible identification of the individual. There is judicial authority holding that an “identifiable” individual is considered to be someone whom it is reasonable to expect can be identified from the information in issue when combined with information from sources otherwise available … [Emphasis added; citations omitted.]
[35]
Relying on NavCanada, Justice Gibson of this Court in Gordon v Canada (Health), 2008 FC 258 [Gordon] at paragraph 34 adopted the following test proposed by the Privacy Commissioner to determine when information is about an identifiable individual: “Information will be about an identifiable individual where there is a serious possibility that an individual could be identified through the use of that information, alone or in combination with other available information”
[Emphasis added.] The parties were agreed on this statement of the law as set out in Gordon.
[36]
Although personal information is subject to a mandatory exemption from release in subsection 19(1) of the ATIA, it may still be released as a discretionary matter in certain cases. Subsection 19(2) provides that personal information may disclose a record that contains personal information in one of three circumstances: (a) where the individual to whom it relates consents; (b) where the information is publicly available; or (c) where the disclosure is in accordance with section 8 of the Privacy Act. This further cross-reference to the Privacy Act again highlights the interlocking nature of the two statutes.
[37]
Subsection 8(1) of the Privacy Act sets out a general prohibition on disclosure of personal information without consent, mirroring the mandatory exemption from release in subsection 19(1) of the ATIA. Subsection 8(2) then sets out a series of 13 exceptions in which personal information may be disclosed, some of which are narrow (e.g., paragraph 8(2)(c): for the purpose of complying with a subpoena or disclosure obligations), and some of which are broader (notably subparagraph 8(2)(m)(i): for any purpose where in the opinion of the head of the institution, the “public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure”
). The combined operation of the provisions is such that where one or more of the exceptions in subsection 8(2) of the Privacy Act applies, subsection 19(2) of the ATIA permits the personal information to be released as a discretionary matter.
C.
Applicable Procedural Provisions and Standard of Review
[38]
As noted, this application was commenced before the recent amendments to the ATIA came into force. The application was brought under the former paragraph 42(1)(a) of the ATIA, which permitted the Information Commissioner to apply to this Court for review where a government institution declined to follow a recommendation to disclose information, if the requester has consented, as they did in this case. Such a review is effectively conducted de novo (Merck Frosst at para 53), a standard confirmed in the recent amendments: ATIA, s 44.1.
[39]
The former section 48 of the ATIA provided that on an application under section 42, the burden of establishing that the government institution is authorized to refuse disclosure is on the government institution. Thus, as the parties agreed, the RCMP had the burden in this case to establish that the serial numbers at issue are “personal information”
exempt from disclosure, even though the Information Commissioner is the applicant. Again, the amendments to the ATIA do not change this onus: ATIA, s 48(1).
[40]
The parties are also in agreement as to the applicable standards of review. This Court is to reach its own conclusion as to whether the information at issue is exempt from disclosure under subsection 19(1), i.e., it must determine whether the mandatory exemption has been applied correctly: Canada (Information Commissioner) v Canada (Commissioner of the Royal Canadian Mounted Police), 2003 SCC 8 at para 19; Merck Frosst at para 53. With respect to the exercise of discretion under subsection 19(2), however, the reasonableness standard applies: Canada (Information Commissioner) v Canada (Prime Minister), 2019 FCA 95 at para 31.
[41]
If the Court finds that a refusal to disclose under section 19 is not authorized by the ATIA, the Court shall order the disclosure of the record, subject to such conditions as the Court deems appropriate, or shall make such other order as the Court deems appropriate: ATIA, s 49.
[42]
While the parties were in overall agreement with the foregoing principles, they disagreed with certain aspects regarding their application, both in principle and in their application to the information at issue. These disagreements are addressed in the analysis below.
V.
Analysis
A.
The serial numbers at issue are not “personal information”
(1)
Numbers assigned to objects and numbers assigned to individuals
[43]
The firearm serial numbers at issue are not inherently personal, in that on their face they neither identify an individual nor reveal any information about an identifiable individual. The numbers are assigned to and associated with a particular firearm, and will remain with that firearm regardless of who may own or possess the firearm or who may be associated with the firearm in a given database or registry. In this way, the serial numbers are primarily information “about an object,”
rather than “about an identifiable individual.”
[44]
This was the conclusion of the Alberta Court of Appeal in Leon’s Furniture Limited v Alberta (Information and Privacy Commissioner), 2011 ABCA 94 [Leon’s]. A central issue in that case was whether driver’s licence numbers and vehicle licence plate numbers were “personal information”
under Alberta’s Personal Information Protection Act, SA 2003, c P-6.5 [PIPA]. The Alberta statute uses a definition of personal information that is the same as the general definition in the Privacy Act, namely “information about an identifiable individual”
: PIPA, s 1(1)(k). While the PIPA definition does not set out a list of examples and exceptions like the Privacy Act, examples are provided in the definition of “personal information”
in subsection 1(n) of Alberta’s Freedom of Information and Protection of Privacy Act, RSA 2000, c F-25, which has purposes equivalent to aspects of the ATIA and the Privacy Act.
[45]
At paragraph 49 of Leon’s, Justice Slatter for the majority concluded that while driver’s licence numbers were personal information, vehicle licence plate numbers were not:
The adjudicator’s conclusion that the driver’s licence number is “personal information” is reasonable, because it (like a social insurance number or a passport number) is uniquely related to an individual. With access to the proper database, the unique driver’s licence number can be used to identify a particular person: Gordon […] at paras. 32-4. But a vehicle licence is a different thing. It is linked to a vehicle, not a person. The fact that the vehicle is owned by somebody does not make the licence plate number information about that individual. It is “about” the vehicle. The same reasoning would apply to vehicle information (serial or VIN) numbers of vehicles. Likewise a street address identifies a property, not a person, even though someone may well live in the property. The licence plate number may well be connected to a database that contains other personal information, but that is not determinative. The appellant had no access to that database, and did not insist that the customer provide access to it. [Emphasis added; citation abbreviated.]
[46]
Justice Conrad in dissent agreed with the conclusion of the majority regarding driver’s licence numbers, but would also have upheld the adjudicator’s conclusion that licence plate numbers were “personal information.”
While recognizing that the question was “not as clear”
as for a driver’s licence number, Justice Conrad noted that as with a driver’s licence number, a licence plate number “when searched in the appropriate database, also produces information about the owner”
: Leon’s at para 119.
[47]
Both sets of reasons in Leon’s recognized that numbers that are assigned to an object are qualitatively different from those that are assigned to an individual. A number that is assigned to an individual, such as a social insurance number, health insurance number or passport number, is inherently “personal”
and is recognized as “personal information”
by the example in subsection 3(c) of the Privacy Act: “any identifying number, symbol or other particular assigned to the individual.”
[Emphasis added.] Such information is exempt from disclosure under section 19(1) of the ATIA, without the need to establish that it could be used to obtain further personal information.
[48]
A number that is assigned to an object does not have this feature of being inherently personal. The serial numbers at issue are of this nature: they are assigned to a particular firearm rather than to an individual, they do not on their face reveal personal information, and they do not fall within subsection 3(c) of the Privacy Act. However, this does not end the inquiry. As set out in Dagg, the question remains whether the serial numbers fall within the general definition of “personal information”
by being “about an identifiable individual.”
In such a case, as the RCMP submits, the information would be about both the object and the individual.
(2)
The test for assessing whether information is “about”
an identifiable person
[49]
Even facially impersonal information may be “personal information”
if it is associated with an identifiable individual in a manner or context that reveals personal information. Thus, for example, this Court in Gordon found that the “province”
field in the Canadian Adverse Drug Reactions Information System (CADRIS) was personal information, since it could be used together with released CADRIS information and other public information such as obituaries to greatly increase the ability to identify particular individuals. In the present case, if the firearm serial numbers could be linked with identifiable individuals, this would reveal that those individuals were gun owners, which the parties agreed is “personal information.”
[50]
As set out above, the Court in Gordon phrased the relevant question as being whether there is a “serious possibility that an individual could be identified through the use of that information, alone or in combination with other available information.”
In NavCanada, the Federal Court of Appeal described an identifiable individual as “someone whom it is reasonable to expect can be identified from the information in issue when combined with information from sources otherwise available.”
[51]
The parties expressed disagreement with respect to three aspects of these tests: the nature of the “serious possibility”
and “reasonable to expect”
standards; the scope of “available information”
to be considered for purposes of the assessment; and the Information Commissioner’s reliance on NavCanada.
(a)
“serious possibility”
/“reasonable to expect”
[52]
The Information Commissioner submitted that the “serious possibility”
and “reasonable to expect”
standards were substantially the same. They submitted that “reasonable to expect”
was equivalent to the “could reasonably be expected”
language in paragraph 20(1)(c) of the ATIA, which was interpreted in Merck Frosst as an “expectation for which real and substantial grounds exist when looked at objectively”
: Merck Frosst at para 204. The Minister disputed the applicability of Merck Frosst, noting that it addressed a statutory test for establishing harm, and that the section 19 exemption is a class exemption and not an injury-based one.
[53]
I agree that standards and approaches applicable to section 20 of the ATIA are not necessarily applicable to section 19, given the different nature of the interests at stake in the two sections. At the same time, however, the “serious possibility”
of Gordon and the “reasonable to expect”
of NavCanada both appear to convey effectively the same standard: a possibility that is greater than speculation or a “mere possibility,”
but does not need to reach the level of “more likely than not”
(i.e., need not be “probable”
on a balance of probabilities). Applying such a standard recognizes the importance of access to information by not exempting information from disclosure on the basis of mere speculative possibilities, while respecting the importance of privacy rights and the inherently prospective nature of the analysis by not requiring an unduly high degree of proof that personal information will be released.
[54]
Beyond this, it seems unnecessary, and may even be impossible, to try to further subdivide or parse the requisite degree of likelihood that an individual could be identified. For ease of reference, and since both parties accepted the formulation of Gordon, I will use the “serious possibility”
language to express the applicable standard described above.
(b)
“available information”
[55]
The parties have a more substantial disagreement regarding what should be considered “available information”
for assessing whether the information at issue, in combination with other available information, could identify an individual. Is it only information that is available to the general public? Does it include more narrowly available information? Or could it even include information that is only in the hands of the government or the requester?
[56]
The issue arises since the RCMP asserts that access to the serial numbers could lead to disclosure of personal information in several different ways. First, the RCMP argues that if the serial numbers were released, the owners of the firearms could each identify themselves by linking their own firearm serial number to the information disclosed. Second, the RCMP argues that the serial numbers could be linked to personal information contained in one of four government databases, namely the CFIS database, the Canadian Police Information Centre (CPIC) database, the Canadian Firearms Registry On-line (CFRO) database, and the Public Agents Firearms database. Third, the RCMP argues that the serial numbers could be linked to personal information in the hands of private businesses, such as firearms manufacturers or shooting clubs. In the RCMP’s submission, for information to fall outside the exemption in subsection 19(1), it should not be seriously possible for anyone to identify an individual, including the government institution itself or the very person to whom the information relates.
[57]
The Information Commissioner, on the other hand, suggested that information should only be considered “available information”
if it is publicly available, relying on passages in Gordon that refer to disclosure “in conjunction with other publicly available information.”
The Information Commissioner accepted that the information need not be easily available, but suggested that it must be available to an “informed and knowledgeable member of the public.”
[58]
In my view, the appropriate approach to “available information”
lies between the Minister’s position and that of the Information Commissioner.
[59]
I agree with the Information Commissioner that information that is kept confidential in the hands of the government institution cannot be considered “available”
for purposes of the analysis. Information requested under the ATIA is by definition already held by a government institution. The purpose of section 19(1) of the ATIA is to avoid disclosing personal information to requesters, not to avoid “disclosing”
it to the government institution that already has it.
[60]
If information were to be considered personal information simply because the government institution could itself use it to identify an individual, this would effectively capture (and exempt from disclosure) a wide variety of impersonal information. Indeed, in the present case, any and all of the information in the chart at issue could be considered “personal information”
on the RCMP’s approach since the RCMP—being in possession of the unredacted chart and having access to the databases—could use it to identify an individual. The same is true of a variety of documents that are commonly released with personal information such as names and addresses removed; the government institution itself would remain able to “identify”
the individuals whose names have been removed simply by referring to the original document.
[61]
Similarly, the fact that an individual may be able to identify themselves from released information does not make that information “personal information.”
The goal of the Privacy Act and subsection 19(1) of the ATIA is to prevent the undue disclosure of one’s personal information to others, not to oneself. Indeed, the Privacy Act expressly provides individuals with a right of access to personal information about themselves in the hands of a government institution: Privacy Act at ss 2, 12. That an individual might know that it is their name that is redacted from a document, for example, does not make the remainder of the document personal information.
[62]
On the other hand, limiting the approach to “available information”
to information that is available to the public at large, even an “informed and knowledgeable member of the public”
as proposed by the Information Commissioner, risks an inappropriate disclosure of personal information and undermines the “paramount”
status of privacy rights. The importance of privacy rights is such that unauthorized release of personal information should be avoided, even if only some members of the public could draw the connections that would link the information to an identifiable individual.
[63]
An example will help illustrate the concern. An employer will often have information regarding its employees that is not available to the general public. Information in a released record might allow the employer to use their special knowledge to identify an employee even if an “informed and knowledgeable member of the public”
could not. The result could be the disclosure of personal information to the employer—health information, financial status, union activities, or other personal information—that they are not already privy to, contrary to the objectives of the ATIA and the Privacy Act. Thus even information not available to an informed and knowledgeable member of the general public may potentially be used to identify an individual and result in the inappropriate release of personal information.
[64]
At the same time, if the record to be released would only repeat information already known to the employer (e.g., if they already possess an unredacted copy of the record in question), then the employer’s ability to “identify”
the individual from the information may not mean that personal information would be disclosed by releasing the record.
[65]
That “available information”
may go beyond what is in the hands of an “informed and knowledgeable member of the public”
is consistent with both Gordon and NavCanada. Justice Gibson in Gordon did conclude that the “province”
field at issue in that case could be used in conjunction with other “publicly available information”
to identify individuals. However, Justice Gibson does not appear to have intended to limit the analysis to information available to the public at large. At paragraphs 33-34 of his reasons, he referred to the relevant available information as “including”
publicly available sources, and adopted the Privacy Commissioner’s formulation, which does not include the “publicly available”
qualifier:
Thus, information recorded in any form is information “about” a particular individual if it “permits” or “leads” to the possible identification of the individual, whether alone or when combined with information from sources “otherwise available” including sources publicly available.
Counsel for the Privacy Commissioner, the Intervener, urged the adoption of the following test in determining when information is about an identifiable individual:
Information will be about an identifiable individual where there is a serious possibility that an individual could be identified through the use of that information, alone or in combination with other available information.
I am satisfied that the foregoing is an appropriate statement of the applicable text. [Emphasis added.]
[66]
Similarly, in NavCanada, the Court of Appeal adopted the “reasonable to expect”
formulation referring simply to “sources otherwise available”
without requiring that it be publicly available: NavCanada at para 43. In doing so, the Court of Appeal cited Ontario (Attorney General) v Pascoe, 2001 CanLII 32755 (ONSCDC), aff’d 2002 CanLII 30891 (ONCA) [Pascoe]. There, the Ontario Divisional Court noted that a person might be identifiable from a record “where he or she could be identified by those familiar with the particular circumstances or events contained in the record.”
[Emphasis added]: Pascoe at para 15. The Divisional Court thus recognized that the information may be held by a smaller subset of the public and still be considered “available”
in assessing whether an individual may be identified as the result of information being released.
[67]
As will be clear from the illustrative example given above and the facts in Gordon, NavCanada and Pascoe, the assessment of whether there is a serious possibility that an individual could be identified—by someone other than the government institution or the individual themselves—will of necessity be dependent on the particular facts, including the type of information at issue, the context in which it appears in the records at issue, and the nature of the other information that is available. The ultimate question is and should remain focused on whether release of the record will result in the disclosure of personal information, either directly or through the serious possibility that an individual could be identified.
[68]
I note for clarity that subsection 8(2) of the Privacy Act contains provisions regarding the disclosure of information from one government entity to another. Those provisions do not arise in this matter and nothing in the foregoing should be taken as affecting that question.
(c)
Relevance of the “concept of privacy”
[69]
The RCMP submitted that the Information Commissioner’s reliance on NavCanada reflected an overly narrow approach to the concept of “personal information”
by requiring that information touch on “concepts of intimacy, identity, dignity and integrity of the individual”
: NavCanada at paras 52-54. The RCMP argued that the broader approach reflected in Canada (Minister of Health) v Janssen-Ortho Inc., 2007 FCA 252 [Janssen-Ortho] is to be preferred.
[70]
There has been suggestion that these two cases from the Federal Court of Appeal represent different approaches to personal information that have to be resolved. In recent companion cases, Suncor Energy Inc v Canada-Newfoundland and Labrador Offshore Petroleum Board, 2018 FCA 11 [Suncor] and Husky Oil, the Federal Court of Appeal was invited to resolve the “apparent contradiction”
between NavCanada and Janssen-Ortho: Suncor at para 16; Husky Oil at paras 33, 59. While Justice de Montigny addressed this question, noting that in his view “these two decisions are not necessarily inconsistent,”
the majority of the Court felt it unnecessary to do so: Husky Oil at paras 33-46 per de Montigny JA, paras 56, 59-60 per Gauthier JA.
[71]
In the present case, the issue does not arise and the approaches in the two cases need not be addressed at length for two reasons. First, the Information Commissioner relies on NavCanada not for its discussion of the concept of privacy, but for its conclusion that an identifiable individual is one whom it is “reasonable to expect can be identified from the information in issue when combined with information from sources otherwise available.”
As noted above, that test is effectively the same as the test in Gordon, which relied on NavCanada and which the RCMP accepts. Second, the parties did not dispute—and the Court agrees—that whether an individual is a firearm owner constitutes personal information, regardless of whether it is viewed through the lens of NavCanada or Janssen-Ortho. To the extent that there is a difference in approach reflected in NavCanada and Janssen-Ortho, it does not affect the assessment in the current case.
(3)
There is no serious possibility that the firearm serial numbers could be used to identify an individual
[72]
As set out above, the RCMP argues that if the serial numbers were released, individuals could be identified as owners of the firearms by (i) the individuals themselves recognizing their own firearm serial number; (ii) the government institution using information contained in the CFIS, CPIC, CFRO or Public Agents Firearms databases; or (iii) a third party, using the serial number(s) to obtain information from one of these databases or from a private business, such as firearms manufacturers or shooting clubs.
[73]
I have explained above why I reject the RCMP’s contention that the serial numbers are “personal information”
based on an individual’s ability to identify their own serial number. Similarly, I have explained why the government’s own ability to access one of the identified databases and correlate the serial number with a name does not make the serial number personal information.
[74]
The RCMP’s expert, Mr. Smith, confirmed that the identified databases are government data banks, and that there are security measures in effect regarding access to them. Those with access to the database already have access to the serial number, the name and all other personal information contained in the database. Release of the serial number would therefore add nothing to their ability to access both the serial number and the personal information in the database. Mr. Smith, perhaps not surprisingly, did not give evidence suggesting that unauthorized individuals would have any serious possibility of accessing the restricted firearms databases, or that their ability to do so would be increased by having the serial numbers. Such information cannot be considered “available information”
for purposes of assessing whether an individual could be identified as the result of release of the serial numbers.
[75]
Mr. Smith did give evidence that there is a website associated with the CPIC database that allows the public to input a serial number to determine whether a firearm has been reported stolen. He suggested that with this information and other publicly available information, such as news reports of crime events, this could allow the serial number to be linked to a particular individual. While this evidence comes closer to the type of evidence at issue in Gordon, it is insufficient to go beyond mere speculation. There was no evidence filed that any of the Sig Sauer firearms in question were stolen or would be identified on the public website—Mr. Smith did not conduct such searches—or that even if they were, how crime reports could be used to link the serial number to a particular individual. This is in contrast to the evidence provided in Gordon, which showed that information from the CADRIS database had in fact been used to identify individuals, and that the disclosure of the “province”
field increased the possibility of that occurring: Gordon at paras 35-43.
[76]
Mr. Smith also asserted that having the serial numbers could permit someone to obtain personal information from private businesses, namely the manufacturer or a gun club. This could be done in one of two ways. First, some manufacturers will provide what is termed a “factory letter,”
based on the make, model and serial number of the firearm. The factory letter sets out when the firearm was manufactured and sold, and to whom it was first sold (which could be an individual, a business or a government entity). Regardless of whether such information might be obtained in certain cases, the evidence was that Sig Sauer does not provide factory letters, so it can have no bearing on whether the serial numbers at issue are personal information.
[77]
Second, Mr. Smith suggested that the serial number could be used to fraudulently obtain personal information from Sig Sauer, such as a name and address associated with a warranty registration. While this might be possible in theory, Mr. Smith provided no evidence regarding how Sig Sauer responds to requests for information, or how likely it would be that Sig Sauer would have or could be convinced to release that information. In the absence of further evidence, the suggestion that an individual could use the serial numbers to trick Sig Sauer into releasing personal information remains in the realm of speculation or “mere possibility.”
I am not satisfied that the evidence shows that this is a serious possibility.
[78]
Similarly, there is no evidence beyond speculation about the ability to use the serial numbers to obtain information from gun clubs. Mr. Smith indicated that the extent to which gun clubs collect personal information regarding members or visitors varies depending on the club. In any event, to the extent that a gun club obtains personal information, its use and protection of that information would be subject to privacy legislation, provincially or under the Personal Information Protection and Electronic Documents Act, SC 2000, c 5. Again, there was no evidence beyond mere speculation that would satisfy the RCMP’s onus to demonstrate that there is a serious possibility that an individual with access to the serial numbers could use it to convince a gun club or other business to circumvent their privacy obligations.
[79]
Finally, I note that Mr. Smith gave evidence that some firearms are sufficiently rare that only one is present in Canada, such that the make and model may alone be enough to uniquely identify the firearm and link it to an individual. Accepting that this may be so, it is not the case with the Sig Sauer P226 firearms that are at issue in this case.
[80]
I therefore conclude that there is no serious possibility that the Sig Sauer firearm serial numbers at issue could be used, alone or in combination with other available information, to identify an individual. The serial numbers are not “personal information”
within the meaning of section 3 of the Privacy Act and are not exempt from disclosure under subsection 19(1) of the ATIA.
[81]
While Mr. Smith gave brief evidence, which he described as “additional considerations,”
regarding the potential for use of serial numbers in other manners that might have a negative impact on law enforcement, this evidence was scant, and no claim was made by the RCMP that the serial numbers were exempt from disclosure pursuant to section 16 of the ATIA. As no other basis for redaction was asserted by the RCMP, the serial numbers at issue will be ordered released to the requester.
B.
The RCMP did not reasonably exercise its discretion under subsection 19(2) of the ATIA
[82]
Having determined that the information was personal information exempt from disclosure under subsection 19(1) of the ATIA, the RCMP concluded that it should not exercise its discretion under subsection 19(2) to nevertheless release the information. As set out above, subsection 19(2) permits the head of a government institution to release the information as a discretionary matter where (a) the individual to whom it relates consents to the disclosure, (b) the information is publicly available, or (c) the disclosure is in accordance with section 8 of the Privacy Act.
[83]
As I have found that the information in question is not personal information, subsection 19(2) does not come into play. Had I concluded otherwise, I would have found that the matter should be sent back to the RCMP for redetermination, as there is no indication that the RCMP gave substantive consideration to the release of the information in the public interest.
[84]
In their letter of submission to the Information Commissioner in the course of the investigation, the RCMP stated the following regarding the exercise of discretion under subsection 19(2):
As required during the course of our review, due consideration was given to the exercise of discretion as outlined in subsection 19(2) of the Act. It was established during the course of the exercise that there was no existence of consent and no likelihood of consent from individual gun owners could be obtained and would be [sic] unreasonable to attempt consent for release. The information ultimately withheld under 19(1) in this instance had not been previously made public. Finally, the test governing a disclosure in the public interest could not be met.
[85]
Similarly, on this application, Ms. Holub provided the following evidence regarding the exercise of discretion:
The RCMP also considered the potential exercise of discretion under subsection 19(2) of the ATIA. In making the determination that discretion should not be exercised to disclose the serial numbers, the following factors were considered: (a) no consent to disclosure existed from the individual firearm owners, obtaining their consent was unlikely and attempting to obtain their consent would be unreasonable; (b) the serial numbers have not been made public; and (c) it was not in the public interest to disclose the serial numbers.
[86]
The foregoing evidence confirms that paragraphs 19(2)(a) and (b) of the ATIA are not applicable, since there was no consent to release from those affected, and the serial numbers are not already public. However, with respect to paragraph 19(2)(c), the RCMP’s analysis appears to be limited to bald statements that “the test governing a disclosure in the public interest could not be met”
and “it was not in the public interest to disclose the serial numbers.”
While these statements indicate that the RCMP is aware of and has at least turned its mind to subparagraph 8(2)(m)(i) of the Privacy Act, they contain no statement of the grounds for the conclusion reached.
[87]
Where a decision-maker has provided no grounds at all for having exercised their discretion, a reviewing court is effectively prevented from assessing whether the decision is a reasonable one. As the Federal Court of Appeal noted in Leahy v Canada (Citizenship and Immigration), 2012 FCA 227 at para 121:
If the reasons for decision are non-existent, opaque or otherwise indiscernible, and if the record before the administrative decision-maker does not shed light on the reasons why the administrative decision-maker decided or could have decided in the way it did, the requirement that administrative decisions be transparent and intelligible is not met... [Citations omitted.]
[88]
Similarly, Justice Simon Noël of this Court stated in Canada (Information Commissioner) v Canada (Transport), 2016 FC 448 at para 66 that in exercising a discretion under the ATIA, “the decision-maker cannot simply state that he has considered all of the relevant factors; he must concretely demonstrate how he has considered them.”
[89]
In the present case, neither the reasons nor the record provides any indication as to why or how the RCMP reached its conclusion regarding public interest. The RCMP pointed to two aspects of the record as providing a reasonable basis for the exercise of discretion. I disagree that either provides any explanation as to why the RCMP exercised the discretion as it did.
[90]
First, the RCMP pointed to Mr. Smith’s opinion that in light of “the impact on individuals, the effect on law enforcement, and the current practice of non-disclosure of the serial number information, that it is not good public policy, or in the public interest, to disclose serial numbers of firearms.”
However, as counsel accepted during argument, Mr. Smith was presented as an independent expert and not as a witness to attest to the RCMP’s reasons for the exercise of the discretion. There is no evidence that the issues considered by Mr. Smith were considered by the access officer. In any event, Mr. Smith’s evidence does not address the issue raised in subparagraph 8(1)(m)(i) of the Privacy Act, namely whether the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure.
[91]
Second, during oral argument counsel suggested that the RCMP’s letter to the Information Commissioner showed that in exercising discretion under paragraph 19(2)(c), the RCMP considered that there was no consent to release from the individuals and that the information was not otherwise public. However, these are simply the circumstances in which discretion may be exercised under paragraphs 19(2)(a) or (b). Paragraph 19(2)(c) is set out in the ATIA as a separate basis for the exercise of discretion. Even if these were the reasons given for exercise of discretion under paragraph 19(2)(c) and not—as it appears—the RCMP’s conclusions with respect to paragraphs 19(2)(a) and (b), it would be insufficient and unreasonable to simply conclude that the discretion under paragraph 19(2)(c) should not be exercised because the circumstances of paragraphs 19(2)(a) and (b) are not met.
[92]
I hasten to point out that the explanation given for a decision on the exercise of discretion under paragraph 19(2)(c) of the ATIA and subparagraph 8(2)(m)(i) of the Privacy Act need not be extensive or detailed. Similarly, an explanation need not be given for every paragraph in subsection 8(2) where, as here, it is perfectly clear that most of the exceptions can have no application at all. However, exercise of the discretion requires a sufficiently “transparent and intelligible”
explanation of why it is considered that the public interest in disclosure does or does not clearly outweigh the relevant invasion of privacy. The RCMP did not meet that standard.
VI.
Conclusion
[93]
The only ground raised for refusing release of the firearm serial numbers was that the numbers were “personal information.”
I conclude that the serial numbers are not “personal information”
within the definition of section 3 the Privacy Act. Having found that the refusal to disclose is not authorized by subsection 19(1) of the ATIA, and in accordance with section 49 of the ATIA, the firearm serial numbers shall be ordered released to the requester. Neither party requested costs, and no costs are ordered.
Email this Content