Chapter 5: Third Party Notice

PDF Version (pdf)

Contents

Overview
5.1 When to Give Third Party Notice
5.2 Initiating the Third Party Notice Process
5.3 Time Limits
5.4 Notice to a Third Party
5.5 Notice to Applicant
5.6 Response from Third Party
5.7 Decision by Public Body and Notice of Decision

This chapter covers

• who is a third party;
• when third party notice is required;
• the notice process for third parties and applicants;
• the response from a third party;
• the decision by a public body, and
• time limits.

See FOIP Bulletin No. 10, Third Party Notice, published by Access and Privacy Branch, Alberta Government Services, for more detailed information on this topic.

Many public bodies hold large quantities of information about individuals, companies, non-profit groups and other third parties. The FOIP Act recognizes that disclosure of this information might result in harm to these third parties (see sections 4.2 and 4.3 in Chapter 4 of this publication). The Act provides for notification of third parties when access to records containing such third party information is requested.

A third party is defined in section 1(r) as a person, a group of persons, or an organization other than an applicant or a public body. It includes individuals, sole proprietorships, partnerships, corporations, unincorporated associations and organizations, non-profit groups, trade unions, syndicates and trusts (see IPC Orders 98-008 and 99-008 for examples of third parties that required notification). An employee of a public body can also be a third party (IPC Order 96-019).

Must give notice

A public body must give notice under section 30(1) of the FOIP Act when the head of the public body is considering giving access to a record that may contain information that affects the interests of a third party under section 16 (disclosure harmful to the business interests of a third party) or section 17 (disclosure harmful to personal privacy).

Section 30(1) requires the public body, where practicable and as soon as practicable, to give written notice to the third party in accordance with section 30(4) of the Act.

If a public body is releasing records in response to a continuing request (section 9), notice under section 30 must be given each time the public body is considering giving access to records that contain information that may be subject to section 16 or 17.

May give notice

A public body may give notice under section 30(3) of the FOIP Act when the head of the public body does not intend to give access to a record that may contain information affecting the interests of a third party under section 16 (disclosure harmful to the business interests of a third party) or section 17 (disclosure harmful to personal privacy).

This provision allows the third party to consent to disclosure of information that the public body was intending to withhold. If notice is given under section 30 and the third party consents to disclosure of the third party information, the record cannot be withheld under section 16 or section 17, as the case may be. The public body cannot refuse to disclose the information unless another exception applies to it.

This provision also allows a public body that does not intend to give access to a record containing third party information to obtain further information to support a decision not to disclose the information. This information may be useful to the public body in the event that an applicant requests a review by the Information and Privacy Commissioner. Also, giving notice to the third party at this stage may expedite the resolution of disagreements at a later stage.

In IPC Order 97-018, the Commissioner commented that there may be circumstances when notifying a third party, even when a public body is not considering giving access to personal information, is reasonable and desirable.

A public body that is not required to give notice may decide not to give formal notice in accordance with the Act, but to advise the third party informally about the request. This kind of informal notice has no standing under the Act.

A public body that gives notice to a third party, formally or informally, must not disclose any personal information in contravention of Part 2 of the FOIP Act, including the identity of an individual applicant.

Notice not given

A notice under section 30 is not normally given under the following circumstances.

• Notice is not normally given when a public body is disclosing a record containing information described in section 17(2)(j). Disclosure of this information is not considered to be an unreasonable invasion of personal privacy. Section 30(2) states that the requirement to give notice established in section 30(1) does not apply to a record containing information to which section 17(2)(j) applies.

• Notice is not normally given when a public body is relying on the Act's exception to disclosure for information that is or will be available to the public (section 29(1)). Section 30(1.1) states that the requirement to give notice under section 30(1) does not apply to information that a public body may refuse to disclose in accordance with section 29.
• Notice is not given in connection with a consultation with another public body. A public body is not a third party under the Act (section 1(r)).
• Notice is not given in connection with a consultation with any person about the application of sections of the Act other than sections 16 and 17. For example, a public body would not give notice to a federal government department for the purpose of a consultation under section 21(2). If the records also included third party business information or personal information, notification of the third parties would be a separate process.
• Notice is not given when a public body is disclosing personal information under Part 2 of the Act. Disclosure under section 40(1)(b), for example, may occur after the public body has done a complete analysis under section 17 and determined that it would not be an unreasonable invasion of a third party's privacy to disclose personal information. If there is some doubt as to whether disclosure of a third party's personal information under section 40(1)(b) would be considered an unreasonable invasion of personal privacy, the public body should withhold the information and ask the person to submit an access request under the Act.

Notice where practicable and as soon as practicable

Section 30(1) requires that third party notice be given where practicable and as soon as possible. This means that third party notice must be given unless, after reasonable attempts to locate and notify the third party, it is impossible to do so. Public bodies are expected to use only their own records and publicly available resources in trying to locate an address for a third party.

Notices must be in writing. Section 30(1) covers notice to the third party and section 30(5) states that, when a notice is given to a third party, a notice must also be provided to the applicant. Where possible, these notices should be given at the same time. If more than one person or organization is affected by the disclosure of information in a record, a notice has to be given to each affected third party.

For some practical considerations regarding the notice process, see FOIP Bulletin No. 10, Third Party Notice, published by Access and Privacy Branch, Alberta Government Services.

Manner of giving notice (Section 83)

Section 83 requires that any notice or document to be given to a person under the Act be given

• by sending it to that person by prepaid mail to the last known address of that person;
• by personal service;
• by substitutional service if so authorized by the Commissioner;
• by facsimile telecommunication; or
• in electronic form other than facsimile telecommunication if the person to whom the notice or document is to be given has consented to accept the notice or document in that form.

Public bodies should choose a delivery method that ensures the notice arrives quickly and conveniently for the third party, but which is also efficient and cost-effective for the public body. Regular mail is not recommended. If there is a small volume of records, the records can be faxed to the third party. For larger volumes, records should be sent by courier or priority post. Prompt delivery will allow the third party as much time as possible to respond.

If sending the notice by fax or other electronic means, care should be taken to prevent unauthorized disclosure of third party information. It may be necessary to telephone the third party before sending the notice to identify the individual best qualified to deal with it or to advise of the electronic transmission. For some measures recommended by the Commissioner, see IPC Investigation Report 2001-IR-001. Public bodies that are government departments or agencies should also refer to the requirements for transmission of personal information in the Government of Alberta Policy for the Transmission of Personal Information via Electronic Mail and Facsimile (revised July 2002), developed by the Office of the Corporate Chief Information Officer.

See Chapter 2.6 of this publication for a further discussion on the manner of giving notice.

Time limits under sections 30 and 31

Time limits for responding to access requests are set out in section 11(1) and section 14 of the Act. When a public body is processing a request involving third party notice, the Act requires public bodies to delay responding to the request so as to allow the applicant and the third party time to exercise their rights under the Act, including their right to request a review by the Information and Privacy Commissioner. The time limits for the parties to exercise their rights are set out in sections 30 and 31.

Prior to giving notice to a third party, a public body may extend a time limit under section 14(1)(a), (b) or (c) or section 14(2). The permission of the Commissioner may be required in certain circumstances. Extensions under section 14(1) and (2) are discussed in Chapter 3.3 of this publication.

After giving notice under section 30, a public body must observe the time limits set out in section 31. Extension of the time limit for responding to the request in order to comply with section 31 is permitted under section 14(3). The permission of the Commissioner is not required.

The applicable time limits are as follows:

• a third party has 20 days to respond to the notice (section 30(4)(c));
• no decision can be made until the third party's response is received, or 21 days after notice is given, whichever comes first (section 31(1));
• the public body must make a decision whether to grant access or not and notify the third party and applicant of this decision within 30 days after the notice is given (i.e. the public body has at least 10 days to consider the response from a third party and make the decision) (section 31(1));
• after the public body's notice of a decision is given, a third party has 20 days to ask for a review (section 31(3)); and
• after the public body's notice of a decision is given, the applicant has 60 days to ask for a review (section 31(4)).

The Act does not allow for extension of any of the time limits in section 31 for any reason.

Effect of time limits

The 20-day time period allowed for a third party to respond to a notice begins on the day after the third party notice is given (i.e. the day after the public body sends the notice), not the date the third party receives it. The date on which the notice is sent is the date marked on it indicating posting or electronic transmission (e.g. the postmark for regular mail, and the transmission date for e-mail or facsimile). For example, if a public body sends a third party notice by regular mail and the envelope is postmarked March 1, the third party has until March 21 to respond. For this reason, public bodies should choose a delivery method that ensures that notice is given promptly.

Contacting a third party prior to giving written notice is a good practice. It enables the public body to explain the process, the importance of responding, the consequences of not responding and the time lines. See FOIP Bulletin No. 10, Third Party Notice, published by Access and Privacy Branch, Alberta Government Services, for other practical considerations.

Time limit extensions for complex requests

If a public body is processing a request that requires an extension for several reasons – for example, the request involves a large number of records, will necessitate consultation with another public body, and will also require third party notice – the public body should extend the time limit for responding under section 14(1) first. Once notice has been given under section 30, the public body can rely only on section 14(3). Section 14(3) allows a public body to extend the time limit for responding to a request to enable the public body to comply with the requirements of section 31.

If the request involves multiple third parties, the most practical method of working with the time limits is to ensure that all third parties have been identified before beginning the notification process, then to send out all the notices at the same time.

From time to time, a public body identifies an additional third party late in the processing of the request. This may happen because additional records are identified after the initial search or because a third party notice results in information that suggests further that the public body should provide notice to another third party. In these cases, it is recommended that the public body make its decision concerning access to the records on which it has given notice and provide a response to the request with respect to those records. The public body should delay its response only with respect to the records for which the notification process is not complete. Although the Act does not specifically provide for responding to a request in part, this approach to timely release of records is consistent with the spirit of the Act.

Under these circumstances, if the applicant were to request a review, the time limit for requesting the review would be 60 days from the day on which the final response to the request was given.

The applicant has the right to make a complaint to the Information and Privacy Commissioner about any time limit extension.

Content of third party notice

Section 30(4) states that a third party notice must

• state that a request has been made for access to a record that may contain information the disclosure of which would affect the interests or invade the privacy of the third party;
• either include a copy of the record, or the part of it containing the information in question, or include a full description of the contents of the record involved; and
• state that, within 20 days after the notice is given, the third party may, in writing, either consent to the disclosure or make representations to the public body explaining why the information, in whole or in part, should not be disclosed.

If a record that is the subject of a third party notice contains personal information about other third parties, it may be best simply to describe the record in the notice. If a public body sends a third party a record that contains personal information of other third parties, the public body risks the unintentional disclosure of that personal information (see IPC Order 99-030).

A model letter, including the various options for third party notice, is set out as Model Letter L in Appendix 3 of this publication. The notice provides a summary of the particular exception involved (either section 16 or section 17). It also provides an explanation of the points that a third party should address in any representations as to why information should not be disclosed. The version of this letter relating to section 16 notes, in particular, the importance of providing clear and specific information relating to any harm that may be expected to result from disclosure of records to which section 16 may apply.

Although the Commissioner stated in IPC Order 99-023 that he did not have jurisdiction to review the contents of a third party notice, efforts should be made to ensure that the third party understands the significance of the notice.

A public body must make its decision about withholding or granting access to third party information on the basis of factors relevant to the applicability of section 16 or section 17. However, the public body can consider comments or statements from a third party that may be relevant to other exceptions, such as sections 18, 20, 21, 24, 25 or 27, when it is considering whether any other exceptions apply to the record. Also, if there is a question as to whether section 27(2) may apply, the third party that has privileged information should be consulted.

Good communication with the third party is one key to ensuring a smooth notification process and promoting better understanding of the third party's representations when determining the applicability of the exception. As a best practice, the identity of a third party should be confirmed before sending a third party notice. However, if the identity of a third party is unclear, the public body may wish to add a comment to the notice stating that if the receiving party is not the appropriate party to receive the notice, or if another third party may also have an interest in the information, the public body should be notified.

Section 30(5) provides that, when notice is given to a third party, the public body must also provide a notice to the applicant.

The notice must state that

• the requested record may contain information the disclosure of which would affect the business interests or invade the personal privacy of a third party;
• the third party is being given an opportunity to make representations respecting disclosure; and
• a decision whether or not to give access to the requested record(s) will be made within 30 days after the date of notice to the third party.

A model notice to an applicant is included as Model Letter M in Appendix 3 of this publication.

In deciding whether or not to give access to all or a portion of the requested record(s), the public body must consider any third party responses received in reply to notices given under section 30 which are pertinent to section 16 or 17, as applicable. The response from the third party must be in writing.

Section 31(1) provides that a public body must decide whether or not to give access within 30 days of giving notice. A decision cannot be made until the third party responds, or on the 21st day after notice is sent, whichever comes first.

Consent

If the third party consents in writing to disclosure of the information, the public body must release the information unless another exception in the Act applies to it.

Although it is not the responsibility of the public body to enquire into an organization's decision-making processes, the public body should be satisfied that the person giving consent to disclose information on behalf of an organization is an officer, employee or corporate officer authorized to provide such consent.

Representations opposing disclosure

If a third party makes representations as to why the information should not be disclosed, the public body must consider the representations in reaching a decision on access.

If there is any doubt that the third party has understood the significance of the notice or the criteria that apply in decisions regarding access, the public body should contact the third party by telephone to discuss the matter.

Non-response

If a third party does not respond to the notice by the 21st day after the notice was given, the public body must make a decision based on the information available.

Public bodies should contact the third party by telephone, fax or electronic mail to discuss why a response has not been made and advise the third party of the consequences of not responding. The opportunity for contact extends up to the point of disclosure of the information. It may be helpful, in the event of a review by the Commissioner, for the public body to be able to provide documentation of its efforts to contact a third party.

The public body is required to decide whether or not to give access to all or part of the record within 30 days after the third party notice is given.

Section 31(1) states that the public body must not make this decision until after the third party has had an opportunity to respond to the notice. Since the third party has up to 20 days to respond, the public body cannot make a decision on access until the earlier of

• 21 days after the notice was given; and
• the day a response is received from the third party.

Section 31(2) provides that once a public body has made a decision on access, it must give written notice of this decision, including reasons, to both the applicant and the third party. This notice will vary according to circumstances.

When a public body decides to grant access to the record

Notice to applicant

The public body must inform the applicant of the decision and the reasons for it, and provide notice that access will be provided on the 21st day if the third party does not ask for a review by the Information and Privacy Commissioner.

Notice to third party

The public body must inform the third party of the decision and the reasons for it, and provide notice that the third party can request a review of the decision by the Commissioner within 20 days. This 20-day period is calculated from the day after the public body gives the notice, not from the date the third party receives it. The relatively short period for the third party to request a review is based on two considerations. First, the public body must exercise its decision-making authority properly, regardless of whether the third party responds to a notice of not. Second, the third party will already have had at least 20 days to prepare its case, so the third party should not require much additional time to decide whether or not to request a review.

The public body should set out its reasons for the decision in a comprehensive way, both to assist the third party in understanding how the Act applies to the information and because it is the decision of the public body that will be the subject of any request for review by the Information and Privacy Commissioner (IPC Order 98-006).

If the third party does not request a review within the 20-day period, the applicant is given access to the records that were the subject of third party representations on the 21st day. A public body must contact the Office of the Information and Privacy Commissioner to determine whether a request for review has been submitted. The applicant is not given access to any record or part of a record that is the subject of the review until the review is completed.

If the review affects only some of the records proposed for disclosure, the public body must release the remainder of the records to the applicant unless they are subject to other exceptions. The outcome of the review determines whether or not access is given to any record that is the subject of review.

Even if the third party has consented to the disclosure of the records, the public body should not disclose the records before the expiry of the time allowed to request a review. This is because misunderstandings may arise regarding the authority of the employee or officer who consented and what the third party believed he or she was consenting to disclose.

When a public body decides to deny access to the record

Notice to applicant

The public body must inform the applicant of the decision and the reasons for it, and provide notice that the applicant may, within 60 days, request a review of the decision by the Information and Privacy Commissioner in accordance with either section 65(1) or 77(2), as appropriate.

Notice to third party

The public body must inform the third party of the decision and the reasons for it, and that the applicant may, within 60 days, request a review of the decision by the Information and Privacy Commissioner.

Model Letters N and O in Appendix 3 of this publication outline the options for this type of notice.

In IPC Order 2000-014, the Commissioner outlined his expectations as to how public bodies should notify applicants and third parties of their decisions. When giving notice of a decision under section 31, the public body should avoid using the words partial access. The response should specify which records are going to be disclosed and which records cannot be disclosed. The Commissioner's expectations are discussed in more detail in FOIP Bulletin No. 10, Third Party Notice, published by Access and Privacy Branch, Alberta Government Services.

Application of third party notice

Figure 12 page 1 and page 2 contains a flowchart setting out the process for giving third party notice.