Chapter 10 - Information and Privacy Commissioner

PDF Version (pdf)

Contents

Overview
10.1 Appointment
10.2 Mandate and General Powers
10.3 Monitoring Role
10.4 Provision of Advice
10.5 Disclosure to the Commissioner
10.6 Powers, Privileges and Immunities
10.7 Reviews
10.8 Review of Decisions of the Registrar of Motor Vehicle Services
10.9 Investigations
10.10 Privacy Compliance Investigations and Audits
10.11 Adjudicator Process
10.12 Judicial Review

This chapter covers

• the appointment, mandate, general powers and monitoring role of the Information and Privacy Commissioner;
• disclosure of information to the Commissioner;
• investigations, reviews and inquiries;
• review of decisions of the Registrar of Motor Vehicle Services;
• the adjudication process and powers of an adjudicator under the Act; and
• judicial review of Commissioner's Orders.

The Information and Privacy Commissioner is an Officer of the Legislature and is independent of government. Section 45 of the FOIP Act provides that the Lieutenant Governor in Council, on the recommendation of the Legislative Assembly, must appoint an Information and Privacy Commissioner to carry out the duties and functions set out in the Act.

The Commissioner is appointed for a term not exceeding five years and is eligible for reappointment. The Commissioner may not be a Member of the Legislative Assembly (section 45(3)). The Commissioner may resign, but may be removed or suspended from office only for cause or incapacity (section 47). This means that the Commissioner may not be removed by arbitrary or capricious action, but only for some reason affecting or concerning the ability or fitness of the Commissioner to perform the duties of the office.

The Lieutenant Governor in Council may designate a judge of the Court of Queen's Bench of Alberta to act as an adjudicator

• when a FOIP request involves the Information and Privacy Commissioner as the head of the public body; or
• when, in the Commissioner's opinion, the Commissioner has a conflict of interest in a review or investigation (section 75).

The adjudicator has the same powers as the Commissioner in disposing of a review or investigation.

Part 4 of the FOIP Act establishes the position of Information and Privacy Commissioner, the supporting office, and the general powers of the Commissioner. The Office was established in Alberta in 1995. The Commissioner has a continuing responsibility to ensure that public bodies are complying with the letter and spirit of the Act.

The general powers of the Commissioner are listed in section 53. The Commissioner has general responsibility for monitoring how the legislation is administered to ensure that its purposes are achieved. Specifically, the Commissioner may

• conduct investigations to ensure compliance with any provision of the Act or compliance with rules relating to the destruction of records. This includes destruction in accordance with rules set out in any other enactment of Alberta, in a bylaw, resolution or any other instrument by which a local public body acts, or as authorized by the governing body of a local public body (section 53(1)(a));
• make an Order regarding duties imposed by the Act , time extensions, fees, or the collection, correction, use, disclosure or destruction of personal information, as described in section 72(3). Such an Order can be made whether or not a review is requested (section 53(1)(b));
• inform the public about the Act (section 53(1)(c));
• receive comments from the public concerning the administration of the Act (section 53(1)(d));
• engage in or commission research into anything affecting the achievement of the purposes of the Act (section 53(1)(e));
• comment on the implications for access to information or protection of personal privacy of proposed legislative schemes or programs of public bodies (section 53(1)(f));
• comment on the implications for protection of personal privacy of using or disclosing personal information for record linkage (section 53(1)(g));
• authorize the collection of personal information from sources other than the individual the information is about (section 53(1)(h));
• bring to the attention of the head of a public body any failure to assist applicants under section 10 (section 53(1)(i)); and
• give advice and recommendations of general application to the head of a public body on matters respecting the rights or obligations of a head under the Act (section 53(1)(j)).

Further, without limiting the general powers in section 53(1), the Commissioner may investigate complaints from the public that

• a duty imposed by section 10 (duty to assist applicants) has not been performed (section 53(2)(a));
• an extension of time for responding to a request is not in accordance with section 14 (time extensions) (section 53(2)(b));
• a fee required under the Act is inappropriate (section 53(2)(c));
• a correction of personal information requested under section 36(1) has been refused without justification (section 53(2)(d)); and
• personal information has been collected, used or disclosed by a public body in contravention of Part 2 of the Act (section 53(2)(e)).

The Commissioner does not have the power to investigate whether information other than personal information has been improperly disclosed outside the request process under Part 1 of the Act (IPC Order 2001-035).

The Commissioner has sole jurisdiction to investigate matters of access to information and privacy protection that are governed by the Act. The Act specifically prohibits the Ombudsman from investigating any matter within the jurisdiction of the Commissioner unless the Commissioner agrees (section 62).

An Order issued by the Information and Privacy Commissioner is final (section 73). The Courts have their inherent and constitutional jurisdiction to review and determine whether the Commissioner has acted within the authority given to the Office under the Act. This process is known as judicial review.

Under section 61(1), the Commissioner may delegate any duty, power or function under the Act to any person, except for the power to delegate. In most cases, the Commissioner's delegation will be to an adjudicator in his Office to conduct an inquiry or to a portfolio officer in his Office to conduct an investigation. See section 10.6 of this chapter on powers, privileges and immunities.

As an independent Officer of the Legislature, the Commissioner reports annually to the Legislative Assembly, describing the work of the Commissioner's Office, any complaints or reviews resulting from a decision, act or failure to act of the Commissioner as head of a public body, and other matters relating to freedom of information and protection of personal privacy (section 63).

Further information, including copies of brochures, news releases, Orders, Investigation Reports, Practice Notes, and Annual Reports, is available on the web site of the Office of the Information and Privacy Commissioner (www.oipc.ab.ca).

The Commissioner may investigate the administration of the Act by public bodies. The Commissioner may also audit the practices of public bodies in the areas of access to information and protection of privacy.

In the area of access to information, the Commissioner may, for example,

• examine a public body's compliance with the time limits imposed by the Act;
• investigate allegations that records are being destroyed to avoid producing them in response to a request under the Act; or
• investigate whether a public body is acting appropriately in the disclosure of information in the public interest under section 32.

In the area of privacy protection, the Commissioner may, for example,

• investigate a public body's disclosures of personal information to third parties to ensure that they are in accordance with the requirements of section 40 of the Act;
• review the collection of personal information by a public body to ensure that the public body has the legal authority to collect the information (section 33) or is complying with the rules for indirect collection (section 34);
• review the records disposition practices of a public body to ensure that it is retaining personal information as required by section 35(b) of the Act;
• audit a public body's procedures within a program or personal information system to ensure compliance with Part 2 of the Act;
• investigate the application of new information technology to ensure that privacy rights of individuals are being adequately addressed and protected; or
• review and comment upon a privacy impact assessment conducted by a public body when the public body is developing or enhancing a program, administrative practice or information system that may have an impact on an individual's privacy.

The Commissioner may also examine and comment on legislation and program activities in terms of any implications for access to information and protection of privacy. Examples of such legislation and program activities include:

• the amendment of a statute or regulation to include provisions for introducing personal identifiers, or to allow release of personal information. The Commissioner could examine the public body's reasons for including such amendments and comment on their relationship to the provisions and intent of the FOIP Act; and
• changes to programs that involve an expansion of the amount of personal information that is collected (e.g. for security screening), data matching (e.g. to verify eligibility for a program), the use of new information technology for program administration (e.g. smart cards), changes in service delivery (e.g. call centres), and the application of the Act to contracts with the private sector, including organizations outside Alberta.

By commenting on and informing the public about the implications of legislative and other proposals of public bodies, the Commissioner can help public bodies to comply with the spirit of open government and privacy rights and to be accountable for their actions.

The Commissioner also has the mandate to conduct or commission research into any issue affecting the way in which the Act's purposes are being achieved.

The Commissioner's role in dealing with reviews and complaints from persons not satisfied with the handling of a FOIP request or correction of personal information is discussed in section 10.7 of this chapter.

The Commissioner may provide the head of a public body with advice and recommendations on matters respecting the rights or obligations of a head under the Act (section 53(1)(j)). Further, the head of a public body may ask the Commissioner to give advice and recommendations on any matter respecting any rights or duties under the Act (section 54(1)).

The Commissioner may include advice or recommendations in an Order or an Investigation Report. The head of a public body might seek advice from the Commissioner on general procedures, or matters of interpretation relating to an access request or the proper application of the privacy protection provisions of Part 2 of the FOIP Act. The advice will normally be sought through a letter from the head of a public body to the Information and Privacy Commissioner. Advice given in response to a request from the head of a public body will normally be of a general nature and not anticipate or relate to a specific case. It can include recommendations on the administration and application of the Act generally in a particular public body.

Section 54(2) provides that the Commissioner may respond to the head of a public body, in writing, with advice and recommendations that

• state the material facts either expressly or by incorporating facts stated by the head;
• are based on these facts; and
• are based on any other considerations that, in the opinion of the Commissioner, are appropriate.

As discussed in Chapter 2.9 of this publication, section 82(2) of the Act requires the Commissioner to investigate and review any disclosure made to the Commissioner by a public body employee of any information that an employee is required to keep confidential and that the employee, acting in good faith, believes

• ought to be disclosed by a head under section 32 (disclosure in the public interest); or
• is being collected, used or disclosed in contravention of Part 2 of the Act.

The Commissioner must not disclose the identity of the employee to any person without the employee's consent (section 82(3)). In carrying out an investigation and review under this provision, the Commissioner has the powers of investigation, mediation and order-making, as well as the protections provided under Part 4 of the Act (section 82(7)).

For example, in IPC Investigation Report F2003-IR-004, allegations made to the Commissioner by Government of Alberta employees about improper collection and use of their personal information in an employee satisfaction survey were investigated under section 82(2).

If an employee of a public body, acting in good faith, discloses information to the Commissioner or exercises any other right under section 82, the public body must not take any adverse employment action against the employee (section 82(5)). A public body employer that contravenes section 82(5) is guilty of an offence and liable to a fine of not more than $10,000 (section 82(6)).

Powers under the Public Inquiries Act

The Commissioner has all the powers, privileges and immunities of a commissioner under the Public Inquiries Act and the powers under section 56(2) of the FOIP Act when conducting an investigation under section 53(1)(a), an inquiry under sections 69 or 74.5, or in giving advice and recommendations under section 54 of the FOIP Act. These include the power to compel witnesses to attend and answer questions at an inquiry, to compel records to be produced, to hold a person in contempt, and to obtain assistance from law enforcement officers.

Power to compel production of records

The Commissioner may require any record to be produced and may examine any information in a record, including personal information, whether or not the record is subject to the provisions of the Act (section 56(2)).

A public body must produce any record or copy of a record requested by the Commissioner under section 56(1) or (2) within 10 days. Records must be produced despite any privilege of the law of evidence that might otherwise apply (section 56(3)). This requirement applies to records that the public body believes to be excluded from the coverage of the Act under section 4(1) (see IPC Practice Note No. 4, Section 4 – Exclusions from the Act). A public body must produce records despite any other enactment of Alberta that prohibits disclosure, but not if a federal Act, such as the Youth Criminal Justice Act, prohibits disclosure (see IPC Order 96-015).

If a public body is required to produce a record and it is not practicable to make a copy of it, the head of a public body may request that the Commissioner examine the original at the site of the public body (section 56(4)).

The Commissioner must return all records or copies of records to the public body after completing a review or investigating a complaint (section 56(5)).

Power to disregard requests

The head of a public body may, under section 55 of the FOIP Act, request the Commissioner's authorization to disregard requests from an applicant. This applies to both requests for access to information and requests for correction of personal information. The public body must present facts in support of its request. The Commissioner then makes a decision. Refer to Chapter 3.2 of this publication for more information on how a public body makes such a request and what supporting information must be provided to the Commissioner.

Statements provided to the Commissioner

A statement made or an answer given by a person during an investigation or inquiry by the Commissioner is inadmissible in evidence in court or in any other proceeding, except

• in a prosecution for perjury in respect of sworn testimony;
• in a prosecution for an offence under the FOIP Act; or
• in an application for judicial review or an appeal from a decision of that review (section 57(1)).

These conditions also apply to evidence from proceedings conducted before the Commissioner (section 57(2)). Anything said, any information supplied or any record produced by a person during an investigation or inquiry by the Commissioner is privileged; the rules that apply are those for a proceeding before a court (section 58).

The phrase a statement made during an inquiry was held by an adjudicator to include a statement made in an agent's request for review letter, which initiated the inquiry process. The inquiry, as an adjudicative process, was held to be a proceeding for the purposes of section 57(1) (see IPC Order 2001-032).

Section 59 of the Act places restrictions on the disclosure of information by the Commissioner and the staff of the Office of the Commissioner. They must not disclose any information they obtain in the performance of their duties, with the following exceptions:

• the Commissioner may authorize disclosure of information that is necessary for the conduct of an investigation under the Act or to establish the grounds for findings and recommendations made under the Act (section 59(2));
• the Commissioner may disclose to the Minister of Justice and Attorney General information relating to the commission of an offence against an enactment of Alberta or Canada, if the Commissioner believes there is enough evidence to justify such disclosure (section 59(4)) (see IPC Order 2001-033); and
• the Commissioner may authorize disclosure of information in the course of a prosecution for perjury or for an offence under the Act, or in an application for judicial review or an appeal arising from that application (section 59(5)).

This section allows the Commissioner to request that the police lay charges under section 92 of the Act.

During the conduct of an investigation, inquiry or audit, the Commissioner and the staff of the Commissioner's Office must not disclose any information that the head of a public body would be required or authorized to withhold from disclosure. They must also ensure that they do not disclose the fact that information exists where, in the notice of refusal to provide access, the public body did not indicate whether or not the information existed (section 59(3)).

Protection from liability

The Commissioner and the staff of the Commissioner's Office are not liable for anything they do or say in good faith in the exercise of their duties under Part 4 of the Act (Office and Powers of the Information and Privacy Commissioner), and Part 5 of the Act (Review and Complaints) (section 60).

As long as the Commissioner and the Commissioner's staff act honestly and with the intention of complying with the Act , no action can be brought against them.

Delegation of the Commissioner's powers

Section 61(1) provides that the Information and Privacy Commissioner may delegate, in writing, to another person any duty, power or function of the Commissioner under the Act. The only exception to this provision is that the Commissioner cannot delegate the power to delegate.

This allows the Commissioner to delegate, for example, the power

• to examine law enforcement information and Cabinet documents,
• to authorize public bodies to disregard requests, and
• to hold inquiries and issue Orders on completion of those inquiries.

Section 65 of the FOIP Act provides persons who have made a FOIP request with the right to ask the Information and Privacy Commissioner to review any decision, act or failure to act of the head of a public body that relates to the request (section 65(1)).

Third parties have the right to ask the Commissioner to review the decision of a public body to provide access to records where disclosure might be an unreasonable invasion of their personal privacy under section 17 or might harm their business interests under section 16. If the public body decides to grant access in response to a request under Part 1 of the Act, a third party that has been given notice under the Act may request a review before any records or parts of records are disclosed (section 65(2)). A third party does not have the right to review by the Commissioner of the sufficiency of a third party notice (IPC Order 99-023).

A person who believes that his or her personal information has been collected, used or disclosed in contravention of Part 2 of the Act may also ask the Commissioner to review the matter (section 65(3)). Only an individual whose personal information has allegedly been collected, used or disclosed in contravention of Part 2 has a right to request a review under section 65(3) (IPC Order 2001-004).

The surviving spouse or adult interdependent partner or a relative of a deceased individual may ask the Commissioner to review a decision of the head of a public body under section 40(1)(cc) not to disclose personal information about the deceased individual (section 65(4)).

The right to an impartial review of decisions or actions of a public body is fundamental to guaranteeing access to information and protection of privacy rights. The review mechanism ensures that these rights are interpreted consistently among public bodies and the purposes of the Act are achieved. Commissioner's Orders, which summarize the issues, arguments, findings and reasons of the Commissioner, also provide guidance to public bodies regarding the proper interpretation of the Act.

A review by the Commissioner of the decision of a public body is intended to be an avenue of last resort. In most cases, a person will be satisfied that the public body has acted responsibly and any outstanding issues can be settled between the public body and the person concerned. Even in cases where the person asks the Commissioner to review a decision, issues can often be settled through mediation and an inquiry may not be necessary.

Certain matters that may be the subject of a request for review can also be grounds for a complaint to the Commissioner under section 53(2) of the Act. These are

• matters relating to the public body's duty to assist the applicant (section 10);
• a decision to extend the time limit under section 14 for responding to a request;
• the amount of a fee charged or the refusal to waive all or part of a fee under section 93;
• a refusal to make a correction to personal information, as requested under section 36(1); and
• the collection, use or disclosure of personal information in contravention of Part 2 of the Act.

Requesting a review

Section 66 of the Act sets out the process for requesting a review. A flowchart of the review process is provided in Figure 13. The Office of the Information and Privacy Commissioner provides a Request for Review Form for this purpose. A copy of the form is included in Appendix 5 of this publication.

Applications for a review can be made on this form or by letter, but in all cases must be in writing. Section 84 establishes classes of individuals who may act for deceased persons, incompetent persons, minors and any other individuals in exercising this right under the Act. (See Chapter 2.5 of this publication for a discussion of the exercise of rights by others.)

A person must deliver a request for a review to the Commissioner within 60 days of receiving notification of a public body's decision or a longer time when allowed by the Commissioner (section 66(2)(a)). Third parties have 20 days in which to seek a review (section 66(2)(b)).

Failure by a public body to respond in time to a request for access to a record is treated as a decision to refuse access (deemed refusal). In this case, there is no notification by the public body and the 60-day time limit does not apply.

Preparation for a review

A public body must be able to show that it has properly fulfilled its duties under the Act. It should document the reasons for each decision relating to the withholding of records, or parts of records, and should ensure that the circumstances surrounding the request and the provisions of the Act support each action it takes.

To reduce the need for review of decisions, public bodies should provide applicants and third parties with clear explanations of their decisions, the provision(s) of the Act that apply and the reasons why they are applicable in the particular instance. These explanations provide a basis for discussion of the decision and may help the public body and the person to settle any outstanding issues without recourse to the Office of the Information and Privacy Commissioner. This point is discussed in IPC Practice Note No. 2, Informing the Applicant of Grounds for Refusal.

If a particular case for review deals with an issue that has implications across government or affects most public bodies, the public body should consult with Access and Privacy Branch, Alberta Government Services.

Review process

The FOIP Act has a number of provisions governing the review process. In addition, the Office of the Information and Privacy Commissioner has developed procedures for conducting reviews and public inquiries and these are available from that Office. See, in particular, IPC Practice Note No. 5, Preparing Records and Submissions for Inquiries.

Upon receiving a request for review, the Commissioner must provide a copy of the request to the head of a public body and to any other person who, in the opinion of the Commissioner, is affected by the request (section 67(1)).

The Commissioner may sever any information in the request that is considered appropriate before providing copies as stated above (section 67(2)). This is necessary because applicants may include personal information as a part of their requests for review, and it may not be appropriate to disclose this to the public body or other persons.

The staff of the Commissioner's Office, the public body and the applicant or third party will jointly review the request for review to determine whether or not the concerns raised in it can be addressed through mediation.

The Commissioner will also likely ask the public body to submit copies of the following documentation, where applicable:

• the FOIP request;
• notice of the public body's decision;
• any correspondence related to the request, issue or decision;
• an index of the relevant records and exceptions relied upon;
• severed and unsevered copies of the records; and, where applicable,
• descriptions of personal information in the public body's personal information banks and policies and procedures for its management under Part 2 of the Act.

The public body will initially be more familiar with the issues involved than the Office of the Commissioner. If the public body has any information concerning affected persons who should be notified of the review, it should inform the Commissioner's Office as soon as possible.

The public body should also make known any relevant issues, considerations or factors that affected the making of the particular decision. The Commissioner will have a better understanding of the public body's position if the public body can demonstrate that it made every effort to meet a person's needs and to resolve outstanding issues.

Mediation

Section 68 provides that the Commissioner may authorize a mediator to investigate and try to settle any matter that is the subject of a request for a review. In most cases, the Commissioner will instruct a portfolio officer to proceed in this way. The mediator does not impose a settlement. Rather, mediation is intended to help the public body and the person requesting a review to arrive at a settlement before a formal inquiry is initiated.

Inquiry

If a mediator is not appointed, or the matter is not resolved with the help of a mediator, the Commissioner must conduct an inquiry unless section 70 applies (section 69(1)). Section 70 specifies circumstances under which the Commissioner may refuse to conduct an inquiry. In the course of the inquiry, the Commissioner will decide all questions of law and fact.

The Commissioner's powers in conducting inquiries are set out in sections 56 and 69 of the Act. The Commissioner has broad discretion to determine how an inquiry will be conducted. It may be conducted in private (section 69(2)), and the Commissioner may decide whether representations are to be made orally, or in writing or a combination of the two (section 69(4)).

The person who asked for the review, representatives of the public body concerned, and any person given a copy of the request for review are entitled to make representations to the Commissioner during the inquiry (section 69(3)). They may choose to be represented by counsel or an agent (section 69(5)).

No party has a right to be present during another party's representations, to have access to or to comment on representations made by another person during the inquiry process (section 69(3)). Representations in this context means the whole of a party's case, including both evidence and legal argument (IPC Order 2001-039).

The Commissioner can allow certain evidence to be submitted in camera. The Commissioner has ruled that holding in camera sessions during oral inquiries does not breach the principle of procedural fairness (IPC Order 98-006).

In the case of a refusal of access, the Commissioner has the right and duty to view all records that have been withheld from disclosure in whole or in part. This right pertains regardless of the exception that the public body has used or the fact that the public body believes the records are excluded from the scope of the Act.

The Commissioner may require the records to be produced within 10 days (section 56(3)). The Commissioner must return such records to the public body upon completion of the review (section 56(5)).

The head of a public body may require the Commissioner to examine a record at the site at which it is being held, if it is not practical to make a copy (section 56(4)). This could occur, for example, when a record is too fragile to copy or the copying process would damage the record. Public bodies should avoid, as much as possible, requiring on-site examination of records since this is likely to place an additional administrative burden on their own, and the Commissioner's, operations.

The Commissioner may compel witnesses to attend an inquiry and answer questions. The Commissioner has all the powers of a Commissioner provided under the Public Inquiries Act. These include the power to hold a person in contempt and to obtain the assistance of law enforcement officers to compel attendance at an inquiry or to compel records to be produced.

Refusal to conduct inquiry

The Act allows the Commissioner to refuse to conduct an inquiry under certain circumstances. If the Commissioner believes that the subject matter of a request has already been dealt with in an Order or an Investigation Report, the Commissioner may refuse to conduct an inquiry (section 70(a)).

For example, in a Decision Regarding Section 70 of the FOIP Act in August, 2003, the Commissioner agreed with a public body that he had already decided in IPC Order 2001-007 that the public body had made every reasonable effort to search for and provide the requested records. The Commissioner exercised his discretion to refuse to conduct inquiries into the applicants' requests for reviews.

Section 70(b) allows the Commissioner to refuse to conduct an inquiry if, in the opinion of the Commissioner, the circumstances warrant. Consideration might be given to refusing to conduct an inquiry if the Commissioner were satisfied that

• the matter could more appropriately be dealt with by means of a procedure under another law,
• an inquiry would not result in any useful remedy (e.g. because a public body has already disclosed all available records in response to a FOIP request), or
• a request for review is frivolous, vexatious or made in bad faith.

A person who believes that the Commissioner has improperly refused to conduct an inquiry may apply to the Court of Queen's Bench for judicial review of the Commissioner's decision.

Time limits for review

Normally, the Commissioner's inquiry must be completed within 90 days after receipt of the request for review (section 69(6)). This time limit encompasses all elements of the review process, including mediation and any formal inquiry.

However, the Commissioner may extend the period for the review. The Commissioner must notify all parties to a review of the extension and provide an anticipated date for the completion of the review (section 69(6)). The intent of the Act is to ensure that an independent review of decisions can take place, so, even if the process is not completed within the extended time limit, the Commissioner has the power to complete the inquiry (see IPC Order 99-011).

Burden of proof

Section 71 establishes where the burden of proof lies in various situations relating to access to records. Generally, the burden of proof rests with the public body refusing access to all or part of a record (section 71(1)), unless the request is for a record or part of a record that contains personal information about a third party.

This means that, under most circumstances, the public body must prove, on a balance of probabilities, that particular information may or must be excepted from disclosure under the Act or that information in records responsive to a request is excluded from the scope of the Act.

Careful documentation of the reasons for refusing to disclose information in responsive records will provide the basis for meeting the burden of proof.

When a public body has refused to disclose personal information under section 17, which requires public bodies not to disclose personal information if the disclosure would be an unreasonable invasion of an individual's privacy, the burden of proof rests with the party requesting disclosure of the personal information. The applicant requesting the personal information must show that disclosure would not be an unreasonable invasion of the personal privacy of the individual to whom the information relates (section 71(2)).

When a third party has requested a review of a public body's decision to disclose a record or part of a record containing personal information about the third party, the burden of proof also lies with the applicant who has requested disclosure of the personal information. The applicant must show that disclosure would not constitute an unreasonable invasion of the privacy of the individual the information is about (section 71(3)(a)).

When the inquiry concerns a public body's decision to disclose third party business information (section 16), the burden of proof lies with the third party resisting disclosure. That is, the third party must demonstrate that the applicant has no right of access to the record (section 71(3)(b)).

For more information on this topic, including a table setting out the way the Commissioner has ruled on who has the burden of proof under different sections of the Act, refer to FOIP Bulletin No. 9, Burden of Proof, published by Access and Privacy Branch, Alberta Government Services.

Commissioner's Orders

Upon completion of an inquiry, section 72 of the Act requires the Commissioner to make an Order. If the inquiry concerns a refusal to grant access to all or part of a record, the Commissioner must order one of the following:

• require the public body to give access to all or part of the record;
• confirm the decision of the public body or require the head to reconsider a decision to refuse disclosure; or
• require the head to refuse access to part or all of the record requested.

When the Commissioner finds that a refusal to grant access is authorized under the Act, and the head of the public body has properly exercised his or her discretion, the Commissioner can only confirm the decision of the public body or request that the head reconsider the decision.

The Commissioner can require the head of a public body to reconsider only a decision to refuse access, not a decision to grant access (see IPC Order 98-001).

If the inquiry concerns any other matter, the Commissioner may make an Order requiring compliance with the applicable provision(s) of the Act, as listed in section 53(2).

Section 72(4) provides that the Commissioner may specify any terms or conditions in an Order. A copy of the Order is given to the person who asked for the review, the head of the public body concerned, any person given notice of the review under section 67 of the Act , and the Minister responsible for the administration of the Act.

The head of a public body that has received an Order from the Commissioner must comply with the Order no earlier than 45 days after the Order, and no later than 50 days after the Order (section 74(1)). This is to allow an applicant, a third party or the public body time to apply for judicial review. If an application for judicial review is made, the Commissioner's Order is stayed until the Court has dealt with the application (section 74(4)).

In practice, the Commissioner will normally courier copies of orders to all parties at the same time and will not review a file for a letter of compliance until after day 50. The Court has the power to extend the 45-day time limit if it considers an extension appropriate.

There is no appeal from an Order made by the Commissioner (section 73), except a limited appeal through judicial review (see section 10.12 of this chapter).

It is an offence to fail to comply with an Order made by the Commissioner under section 72. The Commissioner may choose to file a copy of an Order with the clerk of the Court of Queen's Bench and, after filing, the Order is enforceable as a judgment or Order of that Court (section 72(6)).

Copies of the Commissioner's Orders are available on the Commissioner's web site at www.oipc.ab.ca.

Division 1.1 (sections 74.1 to 74.91) of the FOIP Act allows the Information and Privacy Commissioner to review a decision of the Registrar of Motor Vehicle Services regarding the disclosure of personal driving and motor vehicle information to determine whether the decision is in accordance with criteria established in the Access to Motor Vehicle Information Regulation under the Traffic Safety Act.

Personal driving and motor vehicle information has the same meaning as the definition in section 8(1) of the Traffic Safety Act (section 74.1).

The Commissioner's powers to review decisions under Division 1.1 are comparable to his powers to conduct reviews of decisions under the FOIP Act, including the power to refuse to conduct inquiries (section 74.6).

The power of the Commissioner to review a decision under the Access to Motor Vehicle Information Regulation does not otherwise affect the status of records made from information in the office of the Registrar of Motor Vehicle Services, which is excluded from the scope of the FOIP Act under section 4(1)(l)(ii). A person cannot request access to this information under Part 1 of the Act, and Part 2 does not govern the use or disclosure of information in the motor vehicle registry.

The Access to Motor Vehicle Information Regulation provides for the disclosure of personal driving and motor vehicle information in the motor vehicle registry and contains some provisions that mirror provisions in Part 2 of the FOIP Act. For example, section 2(e) permits disclosure to an officer or employee of a public body or to a member of the Executive Council if the information is necessary for the performance of the duties of the officer, employee or member or if the disclosure is necessary for the delivery of a program or service. Other provisions permitting disclosure to a public body may also apply.  

Section 53(1) of the FOIP Act enables the Commissioner to monitor compliance with the Act and carry out investigations into how the Act is being administered to ensure that its purposes are achieved. Section 53(2), without limiting these more general powers, enables the Commissioner to investigate and attempt to resolve complaints that

• a duty imposed by section 10 (duty to assist) has not been performed;
• an extension of time for responding to a request is not in accordance with section 14;
• a fee under the Act is not appropriate;
• a correction of personal information requested under section 36(1) has been refused without justification; and
• personal information has been collected, used or disclosed by a public body in contravention of Part 2 of the Act.

The main difference between an investigation and a review is that an investigation may not be a result of a FOIP request. A complaint that does not arise from a FOIP request is most likely to occur in cases involving disclosure in the public interest or allegations of improper collection, use or disclosure of personal information.

The Commissioner has the general power under section 53(1) to initiate an investigation. He does not have to wait until a complaint has been submitted in order to conduct an investigation, especially where there is a possible breach of a provision in Part 2 of the Act. See IPC Investigation Reports 2000-IR-009 (surveys by third parties of students in schools) and F2003-IR-001 (disclosure of children's personal information on adoption web site).

In order to find a breach of Part 2 of the Act, there must be a satisfactory level of evidence presented in support of the allegation. Otherwise, a public body would be put in the position of having to “prove a negative” (see IPC Order F2002-020).

When an investigation is held into an alleged breach of privacy (section 53(2)(e)), a portfolio officer in the Commissioner's Office is assigned to investigate the matter. When the investigation is complete, an Investigation Report is prepared and sent to both parties. It includes the portfolio officer's findings and recommendations. The complainant is asked whether the report satisfies his or her concerns, and the public body is asked to inform the portfolio officer how it will comply with the recommendations.

If the complainant is satisfied with the report's findings and recommendations, and the public body accepts the recommendations, the portfolio officer forwards the report to the Commissioner and advises that the complaint has been resolved. The Commissioner's Office then publicly releases the Investigation Report.

If the complainant is not satisfied with the findings and recommendations, he or she can request that the matter proceed to inquiry in accordance with section 65(3). In this case, the report of the portfolio officer is not forwarded to the Commissioner and is not publicly released. Evidence collected during the investigation is not normally forwarded to the Commissioner for the inquiry.

For further details on the process of dealing with complaints, see IPC Practice Note No. 7, Privacy Complaints – Investigations and Inquiries.

Public bodies are always informed by the Office of the Information and Privacy Commissioner as to whether an issue is subject to a review (section 65) or an investigation (section 53). The preparation and response to an investigation will be very similar to those outlined for the review process described above (see IPC Practice Note No. 3, Complaints about Public Bodies – “Reviews” versus “Investigations”: Sections 51(2) and 62(1)).

Time limits on complaints

When an investigation arises from a FOIP request, the applicant must deliver the complaint to the Commissioner within 60 days of receiving notification of the public body's decision (section 66(2)(a)). A longer time may be allowed by the Commissioner (section 66(2)(b)). When allowing a delay, the Commissioner will consider all relevant circumstances.

The Act does not specify a time limit for privacy complaints, since these do not, for the most part, arise from a FOIP request.

The Commissioner can take an active role in investigating compliance with Part 2 of the Act. An investigation can be undertaken as a result of a complaint that personal information is not being collected, used, disclosed or protected in accordance with the provisions of the FOIP legislation.

As well, the Commissioner may decide to conduct an audit of privacy protection in a program of a public body that has custody or control of sensitive personal information. The Commissioner's practice is to make all Investigation Reports and Privacy Audit Reports public.

Chapter 9.1 of this publication suggests a method of reviewing a public body's protection of personal information to help in determining whether the public body is in compliance with the requirements of Part 2 of the Act. It also serves as a guide for remedial measures that may be necessary to adequately protect the personal information in its custody or under its control.

Section 75 provides for the designation of an adjudicator. The Lieutenant Governor in Council may designate an adjudicator in situations where the Commissioner is not in a position to conduct a review because he has a conflict in relation to the subject matter of the review. For example, the Commissioner may have a conflict if the Commissioner has been a member or employee of the public body that is the subject of the review. The designation of an adjudicator may also occur when the matter under review relates to the Commissioner's Office or to any other legislative Office of which the Commissioner is the appointed Officer.

The determination that the Information and Privacy Commissioner has a conflict of interest is made by the Commissioner. The Commissioner is in the best position to decide whether his or her decision on a particular matter might later be the subject of a judicial review by the Court on the grounds that the Commissioner had a conflict of interest (a reasonable apprehension of bias).

An applicant or third party seeking a review under these circumstances may request, under section 79(1) of the Act, that an adjudicator be appointed to conduct the review.

The request for designation of an adjudicator must be in writing and made to the Minister responsible for the FOIP Act. The request must be made within 60 days of the person receiving notice of the decision to be reviewed, or 20 days if a third party is challenging disclosure of information. The adjudicator may decide that a longer period should be allowed.

Upon receipt of the request, Access and Privacy Branch, Alberta Government Services, will confirm with the Commissioner's Office that a conflict exists and will verify that the request is valid. Documentation needed to allow the Minister and Cabinet to review the request will be compiled. Alberta Justice is responsible for requesting the Chief Justice of Alberta to nominate a judge of the Court of Queen's Bench to act as adjudicator.

A submission is made to Cabinet to authorize the Lieutenant Governor in Council to designate the judge to act as an adjudicator. The Minister must provide a copy of the applicant's request for review, together with a summary of the review procedures that will govern the process, to the adjudicator, the Information and Privacy Commissioner and any other person affected by the request.

An adjudicator has the same powers and duties as the Commissioner and can dispose of a matter in the same way. An adjudicator cannot review an Order of the Information and Privacy Commissioner (section 75(2)). A copy of the adjudicator's Order must be given to the Commissioner. An Order made by an adjudicator is final (section 81(6)). Adjudication Orders are made available on the Commissioner's web site at www.oipc.ab.ca.

The Minister responsible for the FOIP Act is responsible for paying the adjudicator's expenses related to the adjudicator's inquiry.

Note that the Commissioner may, under section 61, delegate one of his portfolio officers to act as an adjudicator in his office. This officer may be delegated to conduct inquiries and issue Orders. The purpose of this delegation is to distribute the Commissioner's workload in the area of inquiries, not to deal with a specific issue of conflict of interest on the part of the Commissioner. The name of “adjudicator” that may be chosen for the delegate is simply an assigned title. It should not be confused with an adjudicator that has been designated by the Lieutenant Governor in Council for the purposes of section 75.

The Information and Privacy Commissioner has exclusive jurisdiction to conduct a review and investigate complaints against a public body under the FOIP Act. Courts do not have the power to issue Orders under the Act.

However, a person may apply to the Court of Queen's Bench of Alberta to exercise its inherent jurisdiction to review any action or failure to act on the part of the Information or Privacy Commissioner. The Court may also review the decisions of the Commissioner for an error of law on the face of the record, jurisdictional error or breach of natural justice (fairness). In addition, a person who believes that the Commissioner has improperly refused to conduct an inquiry (under section 70) may apply for judicial review of the Commissioner's decision.

Application for judicial review of a decision of the Commissioner must be made not later than 45 days after the party applying for judicial review is given a copy of the decision.

The Court has the power to compel the Commissioner to do something or to refrain from doing something and the power to send a matter back to the Commissioner for reconsideration.

A judicial review is not an appeal of the Commissioner's decision. The Court cannot substitute its own decision for that of the Commissioner. The Commissioner is the final arbiter of questions of fact but is always subject to the overriding jurisdiction of the Court to ensure that the Commissioner acts within his or her authority. The issue of judicial deference to the Commissioner has been considered in the following decisions:

• Alberta (Minister of Justice) v. Roy (10 December 1996), Edmonton 9603-16335 (Alta. Q.B.)
• University of Alberta v. Pylypiuk, 2002 ABQB 22
• Shields v. Information and Privacy Commissioner, 2004 ABQB 353