Docket: T-1390-24
Citation: 2025 FC 523
Ottawa, Ontario, March 20, 2025
PRESENT: The Honourable Madam Justice Turley
BETWEEN: |
BERNARD E. BOLAND |
Applicant |
and |
ATTORNEY GENERAL OF CANADA |
Respondent |
JUDGMENT AND REASONS
I. Overview
[1] The Applicant filed a complaint with the Office of the Privacy Commissioner [OPC] under the Privacy Act, RSC 1985, c P-21 [Privacy Act] alleging that the Department of National Defence [DND] failed to disclose all the information he had sought in a Privacy Act request. The Applicant had requested records concerning the authority to delegate the Assistant Deputy Minister (HR-Civ) [ADM] as decision-maker for his harassment complaint against a former Deputy Minister of National Defence [DM].
[2] After investigating, the OPC concluded that the Applicant’s complaint was not well-founded because no additional records existed relating to his request. The OPC made clear that under the Privacy Act, the Applicant was only entitled to his personal information, and that information concerning the employment duties of a third party had to be requested under the Access to Information Act, RSC 1985, c A-1 [Access to Information Act].
[3] The Applicant seeks judicial review of the OPC’s dismissal of his complaint. The Applicant disputes that the records disclosed by DND demonstrate that the ADM had the requisite delegated authority to determine the Applicant’s harassment complaint. However, as I stated at the hearing, the OPC’s mandate was to determine whether DND had disclosed all records that were responsive to the Applicant’s Privacy Act request. Its role was not to determine whether the authority to adjudicate the Applicant’s harassment complaint was properly delegated, nor whether the records support such a delegation. This is not the role of this Court on judicial review either. Rather, the Court must determine whether the OPC’s decision that the Applicant’s complaint was not well-founded is reasonable and procedurally fair.
[4] For the reasons that follow, I am dismissing this application for judicial review.
II. Background
A. The Applicant’s harassment complaint
[5] The Applicant made a harassment complaint against former DM Jody Thomas in January 2021 alleging abuse of authority. The complaint was assigned to the ADM, Mr. Kin Choi. The ADM performed a situational assessment to ensure that the criteria in DND’s Defence Administrative Order and Directive 5012-0, Harassment Prevention and Resolution [DAOD 5012-0] were met and that the complaint was handled under the Department’s harassment complaint resolution mechanism.
[6] By letter dated February 19, 2021, the ADM advised the Applicant that his allegations did not meet the criteria for harassment in accordance with section 4.6 of DAOD 5012-0. As a result, the complaint would not be referred to a third party for further investigation.
B. The Applicant’s Privacy Act request
[7] In February 2023, the Applicant made a request to DND under the Privacy Act for the record(s) authorizing the ADM to be the Responsible Officer for his harassment complaint against the former DM. Because DND did not respond to the request within the requisite timelines prescribed by the Privacy Act, the Applicant filed a complaint with the OPC. The OPC determined that the Applicant’s complaint was well-founded and that DND’s lack of response was considered a deemed refusal.
C. The Applicant’s judicial review of DND’s deemed refusal
[8] The Applicant brought a judicial review application pursuant to section 41 of the Privacy Act to compel DND’s compliance by responding to his request for documents. Prior to the hearing, DND responded to the Applicant’s request and released all available records that had been located.
[9] The Respondent brought a motion to strike the application as moot, which was granted on January 3, 2024: Boland v Canada (Attorney General), 2024 FC 11 [Boland 2024]. The Court concluded that a “deemed refusal application is moot if disclosure has been made, regardless of how complete or adequate it is”
: Boland 2024 at para 18. To the extent that the Applicant was dissatisfied with DND’s response, the Court noted that he had the right to file a new complaint with the OPC under the Privacy Act: Boland 2024 at paras 19–20.
D. The Applicant’s new Privacy Act complaint
[10] The Applicant filed a new complaint with the OPC on January 7, 2024. He asserted that DND’s October 13, 2023 response to his original Privacy Act request was inadequate and that “DND is refusing to provide the record sought”
. Furthermore, the Applicant stated that DND’s response “did not provide the record that delegated the authority and authorized Mr. Kin Choi to be the Responsible Officer (RO) for [his] Harassment Complaint against Jody Thomas”
: Applicant’s Privacy Act complaint dated January 7, 2024, Certified Tribunal Record [CTR], Tab 2 at 1.
[11] During its investigation, the OPC asked DND about the Instrument of Delegation of Labour Relations, Human Rights, and Political Activities Authorities dated July 15, 2018 [Instrument of Delegation] that had been released to the Applicant as part of DND’s disclosure package in October 2023. More specifically, the OPC inquired about the ADM’s power to administer harassment complaints and asked, “how this authority would have been delegated”
. As the OPC articulated, they were “asking this question to determine if any documents should exist relating to this request”
: Email from the OPC dated April 16, 2024, CTR, Tab 9 at 2.
[12] DND responded to the OPC’s inquiry as follows, including an excerpt of the Instrument of Delegation:
• Delegation of authority goes with the position, therefore anyone that occupies that position, pending they have the appropriate training can exercise the delegation. I believe this would be held more on the individual’s personnel file to show that they have completed the training and have the delegate authorities assumed by the position.
• Although the ADM of HR-Civ does hold different delegations in certain areas, he also falls under the Level 1 authority under ADM showed below, which entitles him to receive/administer and respond to harassment complaints. Also see note 6, where is [sic] states: “where a grievance or complaint related to harassment or discrimination required that the second level of the grievance procedure or RO be bypassed, the next higher management in the Chain of Command will respond.
Email from DND dated April 18, 2024, CTR, Tab 9 at 2
[Highlighting in original]
[13] On April 26, 2024, the OPC advised the Applicant that it had completed its investigation and determined that “[a]ll records that exist relating to your request have been released to you”
. In addition, it shared the second bullet point above and the portion of the Instrument of Delegation. Furthermore, the OPC noted that it is not their office’s “responsibility to determine whether a specific individual had the delegated authority to make a decision or not”
: Email from the OPC dated April 26, 2024, CTR, Tab 8 at 2–3.
[14] An exchange of emails then ensued between the Applicant and the OPC on April 26, 2024. The Applicant took issue with DND’s explanation about the delegation of authority. Moreover, the Applicant alleged a breach of procedural fairness, stating that the OPC had completed its investigation without giving him an opportunity to address what DND had provided.
[15] In response, the OPC advised the Applicant that he could make any final representations concerning why he believes “DND has not provided [him] with all documents related to [his] request, that contain [his] personal information”
. It further stated that “[a]ny information you are seeking that is not your own personal information, such as the authorities of a third-party, should be requested under the Access to Information Act”
: Email from the OPC dated April 26, 2024, CTR, Tab 8 at 2.
[16] The Applicant submitted final representations to the OPC on May 7, 2024. He acknowledged that the OPC “does not determine who will have what delegated authority within government institutions”
but argued that “[n]othing in the Privacy Act […] precludes [the OPC] from confirming with the institutional authorities who authored the delegated authorities purported by the ATI collection process, that the interpretation of bureaucrats feeding the ATI process, is the correct interpretation being proffered by the bureaucracy”
: Email from the Applicant dated May 7, 2024, CTR, Tab 10 at 2.
[17] By letter dated May 15, 2024, the OPC determined that the Applicant’s complaint was not well-founded. It concluded that DND had not contravened the Applicant’s rights under the Privacy Act as all records relating to his request had been released. The OPC reiterated that under the Privacy Act, the Applicant was only entitled to his personal information, and that information about a third party’s employment duties would need to be requested under the Access to Information Act. This is the decision that is the subject of this judicial review.
III. Issues and Standard of Review
[18] The Applicant argues that the OPC failed to conduct a thorough investigation of the substantive issues raised in his Privacy Act complaint. He further asserts that the OPC failed to exercise the diligence mandated by the Court in Boland 2024.
[19] The parties agree that the standard of review applicable to the merits of the OPC’s decision is reasonableness. A reasonable decision is “one that is based on an internally coherent and rational chain of analysis and that is justified in relation to the facts and law that constrain the decision maker”
: Canada (Minister of Citizenship and Immigration) v Vavilov, 2019 SCC 65 at para 85 [Vavilov]; Mason v Canada (Citizenship and Immigration), 2023 SCC 21 at para 8 [Mason]. A decision should only be set aside if there are “sufficiently serious shortcomings”
such that it does not exhibit the requisite attributes of “justification, intelligibility and transparency”
: Vavilov at para 100; Mason at paras 59–61. Furthermore, the reviewing court “must be satisfied that any shortcomings or flaws relied on by the party challenging the decision are sufficiently central or significant to render the decision unreasonable”
: Vavilov at para 100.
[20] While the Applicant did not explicitly raise procedural fairness in his written submissions, he did take issue with DND’s response being shared only after the OPC had completed its investigation: Applicant’s Memorandum of Fact and Law at paras 51, 68. I have therefore considered whether the OPC’s decision-making process was procedurally unfair.
[21] With respect to breaches of procedural fairness, no standard of review is applied. Rather, the Court’s reviewing exercise is “best reflected on a correctness standard”
: Canadian Hardwood Plywood and Veneer Association v Canada (Attorney General), 2023 FCA 74 at para 57; Canadian Pacific Railway Company v Canada (Attorney General), 2018 FCA 69 at para 54 [CPR]. The ultimate question is “whether the applicant knew the case to meet and had a full and fair chance to respond”
: CPR at para 56.
IV. Analysis
A. The Legislative Framework
[22] Under the Privacy Act, Canadian citizens and permanent residents have a right to access their personal information held by a government institution. Personal information is defined in section 3 of the Act.
[23] Pursuant to section 29 of the Privacy Act, the OPC investigates complaints related to obtaining access to personal information under subsection 12(1). It then produces a report of findings and recommendations which are not legally binding: Azubuike v Canada (Attorney General), 2020 FC 911 at para 39 [Azubuike]. Justice Strickland aptly compared the OPC’s role to “that of an ombudsman”
: Azubuike at para 39.
[24] Once the OPC has made a finding about a complaint under section 29, there are two possible routes of review before this Court. First, where an individual has been refused access to personal information, they may seek judicial review of the government institution’s refusal under section 41 of the Privacy Act. In that case, the Court performs a de novo review to determine whether the government institution’s refusal was unauthorized or lacked reasonable grounds: Azubuike at para 43.
[25] Second, an application for judicial review of the OPC’s decision may be brought pursuant to subsection 18.1(1) of the Federal Courts Act, RSC 1985, c F-7. In this case, the Court must determine “whether the investigation was conducted in a procedurally fair manner, and with the reasonableness of the Report’s determination that the Applicant’s complaint was not well-founded”
: Azubuike at para 46. This is the route taken by the Applicant here.
B. The OPC’s determination is reasonable
[26] The OPC’s determination that the Applicant’s complaint was not well-founded is reasonable. As set out below, I can find no reviewable error in its finding that DND had disclosed all records that were relevant to the Applicant’s Privacy Act request.
[27] The Applicant disputes that DND’s disclosure is responsive to his February 2023 Privacy Act request for the record(s) that delegated the authority and authorized the ADM to be the Responsible Officer for his harassment complaint against the former DM. In particular, he challenges DND’s position that the Instrument of Delegation supports that the ADM had the requisite delegated authority.
[28] However, as I explained at the hearing, the ADM’s authority is not a matter for the Court to adjudicate in the context of this judicial review application. Any challenge to the ADM’s authority should have been raised within the context of the ADM’s February 2021 determination that the Applicant’s complaint did not meet the criteria for harassment. It is not properly the subject of either the OPC complaint, or this judicial review application.
[29] As the OPC advised the Applicant, it is not their responsibility “to determine whether a specific individual had the delegated authority to make a decision or not”:
Email from the OPC dated April 26, 2024, CTR, Tab 8 at 3. Rather, the OPC made specific inquiries with DND about the Instrument of Delegation to ensure that all relevant records had indeed been disclosed. The OPC was satisfied that DND’s disclosure was complete. Furthermore, it sought approval to share DND’s response about the delegation of authority with the Applicant, in an effort to resolve the complaint.
[30] Notably, the OPC advised the Applicant that DND had actually provided more information than he was entitled to: “They further released documents to you that were not your own personal information, and were not required to release under the
Privacy Act”
: Email from the OPC dated April 26, 2024, CTR, Tab 10 at 6. A review of DND’s disclosure package supports this as it largely consists of various Instruments of Delegation, as well as a DND directive related the Delegation of Authorities for Civilian Human Resources Management: CTR, Tab 6.
[31] Furthermore, the OPC explained that the proper recourse to obtain material other than the Applicant’s own personal information, “such as the authorities of a third-party [
sic]”
or “information relating to the duties of employment of a third party”
, was under the Access to Information Act: Email from the OPC dated April 26, 2024, CTR, Tab 10 at 6; Letter from the OPC dated May 15, 2024, CTR, Tab 10 at 17. According to DND’s response to the OPC’s inquiry, authority is delegated to a position such that any individual who occupies the position can exercise that authority, provided they have the appropriate training. The DND official further stated that they believed “this would be held more on the individual’s personnel file to show that they have completed the training and have the delegate authorities assumed by the position”
: Email from DND dated April 18, 2024, CTR, Tab 9 at 2.
[32] Finally, I do not agree that the OPC ignored the Court’s direction in Boland 2024 in investigating this new complaint. The Applicant asserts that the OPC was obligated to test the completeness and adequacy of DND’s response to his Privacy Act request. This misconstrues the Court’s use of “adequacy”
and “completeness”
. These references are to the Court’s consistent jurisprudence holding that a deemed refusal application is moot if disclosure has been made, regardless of how complete or adequate it is: Boland 2024 at para 18. In other words, even where an applicant is not satisfied with a government institution’s response to a Privacy Act request, the adequacy of that response (i.e., whether all records responsive to the request have been disclosed) is not a question before the Court on the deemed refusal application: Boland 2024 at para 19.
[33] Contrary to the Applicant’s assertion, the Court was not in any fashion directing the OPC as to how to conduct its investigation should a new complaint be filed. The OPC’s role in investigating complaints is to ensure all documents responsive to a Privacy Act request have been disclosed. Its role was not to assess “the completeness and adequacy of the real and tangible documents DND provided in rendering the information sought”
: Applicant’s Memorandum of Fact and Law at para 46.
[34] Having thoroughly reviewed the record, I am satisfied that the OPC’s determination that the Applicant’s complaint is not well-founded is reasonable. The OPC’s reasoning is justified, intelligible and transparent.
C. The OPC did not breach procedural fairness
[35] Furthermore, I find that the OPC’s decision-making process was procedurally fair. The Privacy Act provides the Privacy Commissioner with “broad latitude to craft investigative processes as she sees fit and, provided that the requirements of procedural fairness are met, the Court will not substitute a different process simply because the applicant can conceive of a fairer or different process”
: Oleinik v Canada (Privacy Commissioner), 2011 FC 1266 at para 10.
[36] Pursuant to subsection 33(2) of the Privacy Act, an individual who makes a complaint must be given an opportunity to make submissions. A review of the record demonstrates that the Applicant was given a fair and full opportunity to be heard and to provide submissions throughout the course of the OPC’s investigation.
[37] The OPC advised the Applicant that it had completed its investigation on April 26, 2024, and shared DND’s response about the delegation of authority (as set out in para 12 above). At that time, the Applicant raised procedural fairness concerns, stating that he was not given an opportunity to address what DND had provided: Email from the Applicant dated April 26, 2024, CTR, Tab 10 at 7.
[38] In response, the OPC explained that, according to subsection 33(2) of the Privacy Act, “no one is entitled as of right to be present during, to have access to or to comment on representations made to the Commissioner by any other person”
. The OPC further stated that it had requested DND’s approval to share the information “[a]s a courtesy”
: Email from the OPC dated April 26, 2024, CTR, Tab 10 at 6.
[39] Nevertheless, the OPC provided the Applicant an opportunity to make any final representations concerning why he believed DND had not provided him with all documents related to his request. The Applicant provided further submissions on May 7, 2024.
[40] Based on the foregoing, the OPC’s investigation was procedurally fair. The Applicant was aware of the case he had to meet and was given ample opportunity to make submissions throughout the OPC’s investigative process.
D. Costs
[41] The Respondent has sought its costs in accordance with the lower end of Column III of Tariff B of the Federal Courts Rules, SOR/98-106 [Rules] in the amount of $2,520.00. Pursuant to Rule 400 of the Rules, costs are at the complete discretion of the Court.
[42] I am sympathetic to the Applicant’s circumstances as a self-represented litigant unfamiliar with court procedures. In the circumstances, I exercise my discretion and decline to award costs against the Applicant.
V. Conclusion
[43] The application for judicial review is dismissed. The Applicant has failed to establish that the OPC’s decision is either unreasonable or made in a procedurally unfair manner.
Email this Content