Bulletin Number 10: Third Party Notice

Revised August 2003

PDF Version (pdf)

• Introduction
• Who is a third party?
• When is third party notice required?
• When is third party notice not required?
• Notification process
• How to serve a notice
• Calculating time limits
• Content of notices to third party and applicant
• Notice to third party
• Notice to applicant
• Practical considerations
• Response from third party
• Decision by public body
• When access to the record is granted
• When access to the record is denied
• Time limit extension

Applicants often ask public bodies for access to records that contain information about individuals, businesses and organizations. The Freedom of Information and Protection of Privacy (FOIP) Act recognizes that disclosure of this information may invade a third party’s personal privacy or result in a loss of confidentiality harmful to an organization’s business interests. For this reason, sections 30 and 31 of the Act contain a process for notifying and consulting with third parties when access to records containing their business or personal information is requested.

The purpose of this Bulletin is to explain: who is a third party, when third party notice is required, how the notification and decision-making process works, and what practical things public bodies may need to consider in order to comply with sections 30 and 31 of the Act.

A "third party" is defined in section 1(r) of the FOIP Act as a person, a group of persons or an organization other than an applicant or a public body. A third party could be an individual, sole proprietorship, partnership, corporation, unincorporated association or organization, non-profit group, trade union, syndicate, or trust.

Some of the cases discussed in Commissioner’s Orders provide examples of third parties as defined in the Act.

In IPC Order 98-008, the applicant requested access to witness statements related to his employment termination. The statements were obtained in interviews conducted during an investigation by Alberta Municipal Affairs into the applicant’s conduct. The individuals who were interviewed were the third parties in that case. In sending them a section 30 notice, the public body was trying to determine whether disclosure of their personal information would unreasonably invade their privacy.

In IPC Order 99-008, an applicant requested access to the specific amount charged by a contractor for providing catering and support services and the percentage above cost charged for providing water, sewage and garbage disposal. Since Alberta Environmental Protection was planning to disclose the contractor’s proprietary information, the contractor was a third party that had to be given notice under section 30.

1. A public body must give notice to a third party under section 30(1)(a) when it is considering giving access to records containing third party business information that has been supplied explicitly or implicitly in confidence (under section 16). (For a discussion of what is meant by "business information" and "supplied in confidence" under section 16 of the Act, see FOIP Guidelines and Practices Chapter 4, section 4.2, "Disclosure Harmful to Business Interests of a Third Party.")

Although a public body may disclose third party business information outside the FOIP Act request process, this must still be done in accordance with the spirit of the Act and in accordance with any other legal duties or obligations.

2. A public body must give notice to a third party under section 30(1)(b) when it is considering giving access to records containing personal information the disclosure of which may be an unreasonable invasion of the third party’s personal privacy (under section 17).

Although third party personal information may be disclosed outside the FOIP Act request process, the disclosure must comply with section 40 of the Act.

3. If a public body is releasing records in response to a continuing request (section 9), notice under section 30 must be given each time the public body is considering giving access to records that contain third party business information under section 16 or personal information that would unreasonably invade a third party’s personal privacy under section 17. A one-time third party consent would not be sufficient for the purposes of section 30 since a third party cannot consent to the release of records that have not yet been created.
   

4. A public body must, where practicable, give notice to a third party before disclosing information that is required to be disclosed in the public interest under section 30. Third party notice under section 32 is a different notice process from that under section 30 and will not be dealt with in this Bulletin. (For a discussion of notification under section 32 of the Act, see FOIP Guidelines and Practices, Chapter 6, section 6.3.)

1. Not all third parties meet the criteria for receiving a section 30(1) notice. If a third party did not supply information that could be characterized as "business information" under section 16 and did not supply the information in confidence, that third party’s interests would not be considered as falling within the scope of section 16.

However, the source of the business information does not necessarily determine which parties receive a section 30(1) notice. Even though the business information of a third party may not have been provided directly to the public body by that third party, it could still fit within the criteria in section 16. In that case, notice would need to be given to that additional third party if the public body intended to disclose its information.

For example, Bidder A in a tendering process requests information about Bidder B’s tender. Bidder B is a third party that would require section 30(1) notice if the public body intended to disclose confidential business information contained in Bidder B’s proposal. Although Bidder B’s proposal may contain information about a sub-contractor, the sub-contractor is not necessarily considered an additional third party for the purpose of receiving a section 30(1) notice. The sub-contractor would be considered an additional third party only if the public body intended to disclose information of the sub-contractor that fit the criteria in section 16, or personal information of the sub-contractor (such as a resume) the disclosure of which would be an unreasonable invasion of the sub-contractor’s personal privacy (under section 17).

2. The third party does not have to be notified under section 30(1) if, in accordance with section 29, the requested information is readily available to the public, available for purchase by the public or is going to be published or released to the public within 60 days after receipt of the request.

It is presumed in these cases that the public body has already considered any confidentiality or privacy matters related to the information before deciding to make it publicly available.

3. A public body does not have to give notice under section 30(1) if it is seeking advice from a third party about disclosure under a section of the Act other than section 16 or 17 (e.g. consultation with a federal government department under section 21(2)). A different consultation process relating to other exceptions is described later in this Bulletin.
   

4. Under section 30(3), a public body may (but does not have to) give notice to a third party if the public body does not intend to give access to the third party’s business or personal information.

A public body may decide to give notice when it is not obliged to do so to allow third parties to provide input on reasons not to disclose the information or to consent to the disclosure.

Providing notice also allows a public body to make its third party clients aware that an access request has been made for their personal or business information. This may be helpful in the event that the applicant requests a review by the Commissioner of the public body’s response to the request.

The Commissioner has said that he cannot impose a duty upon a public body to give notice where the Act does not establish a duty to do so (IPC Order 97-018).

However, if the matter goes to review, the Commissioner may, under section 67(1)(a)(ii) of the Act, give a copy of the request for review to any person, including a third party who, in the Commissioner’s opinion, is affected by the request for review.

If, as a result of consultation, the third party gives written consent to or requests disclosure of personal information (under section 17(2)(a)), the Commissioner has ruled that the public body must disclose the third party information unless another exception applies (see IPC Order 2000-029). This rationale would also require disclosure in the case of a third party consenting to the disclosure of its business information (under section 17(3)(a)).

5. Section 30(2) says that third party notice is not required if a public body is considering giving access to a record containing information described in section 17(2)(j).

Provided it would not be contrary to the public interest, it is not an unreasonable invasion of personal privacy to disclose personal information of a third party which, for example, reveals only enrolment in a school or post-secondary program, receipt of an honour or award, or attendance at or participation in a public event related to the public body.

It is important, however, for public bodies to take steps, when the personal information is collected, to allow individuals to request non-disclosure under section 17(3).

6. It is not necessary for a public body to give notice to a third party if it is disclosing personal information under Part 2 of the Act.

Disclosure under section 40(1)(b), for example, may occur after the public body has done a complete analysis under section 17 and determined that it would not be an unreasonable invasion of a third party’s privacy to disclose personal information.

If there is some doubt as to whether disclosure of a third party’s personal information under section 40(1)(b) would be considered an unreasonable invasion of personal privacy, the public body should have the person who asked for the information submit an access request under the FOIP Act.

Section 30(1) requires that the third party be given written notice "where practicable and as soon as practicable."

Giving notice "where practicable" means giving written notice unless it is impossible to do so after reasonable attempts have been made to locate and notify the third party.

Public bodies are expected to use only their own records and publicly available resources (e.g. telephone and business directories) in trying to locate an address for a third party. Particulars about a third party, such as name, address or phone number, contained in historical records should not be relied upon without further verification since they may no longer be accurate.

Giving notice "as soon as practicable" means giving notice as soon as possible after determining that a third party needs to be consulted. This enables the public body to respond to the request within a reasonable time frame.

Section 11(1) states that a public body must make a reasonable effort to respond to a FOIP request within 30 calendar days of its receipt. The Act permits the head of a public body to extend that time limit to allow for the third party notification process (under section 14(1)(c) or section 14(3)). However, public bodies should not use this time extension to unnecessarily delay responding to the applicant. Time limit extensions are discussed later in this Bulletin.

Notices must be in writing. Section 30(5) says that when notice is provided to the third party, notice must also be provided to the applicant. Where possible, these notices should be given at the same time.

Separate notice must be given to each third party whose interests may be affected by disclosure of the information. Where a public body is notifying multiple third parties, and especially where the public body is notifying multiple third parties about the same or related records, the public body should issue the third party notices on the same day.

How to serve a notice

Any of the methods of serving notice in section 83 may be used to notify third parties. That section requires that any notice or document to be given to a person under the Act be given:

• by sending it to the last known address of that person by prepaid mail;
• by hand-delivering it to the person to be notified (e.g. by courier) so as to be able to prove that the correct person actually received the document;
• by substitutional service if so authorized by the Commissioner; for example, placing a public notice in a trade journal or in other specialized or general media (this method may be used where a large number of third parties must be notified or where a third party cannot be found and the nature of the information lends itself to this type of notice);
• by facsimile telecommunication; or
• in electronic form (e.g. by electronic mail), if the person to whom the notice or document is to be given has consented to accept the notice or document in that form.

As of the date of this Bulletin, section 83 has not been considered in an order of the Alberta Information and Privacy Commissioner.

Calculating time limits

There are two key points to keep in mind regarding the calculation of time limits:

• When calculating a stated time period, the first day of the period starts the day after a particular action occurs, such as the receipt of a request or the giving of a notice. The day in which the request is received or the notice is given is not counted as the first day of the time limit set out in the Act.
  
• If the authorized office of a public body is closed on the last day of a time period, the next business day will be calculated as the last day of the time limit. For example, if the final day for responding to a third party notice falls on a statutory holiday or a day when the authorized office of the public body is closed, the response is due on the next business day.

Notice to third party

Section 30(4) says that a third party notice must:

• contain a statement that a request has been made for access to a record that may contain information the disclosure of which would affect the business interests or invade the personal privacy of a third party;
• either include a copy of the record, or the part of it containing the information in question, or include a full description of the contents of the record involved; and
• contain a statement that, within 20 days after the notice is given, the third party may, in writing, either consent to the disclosure or make representations to the public body explaining why the information should not be disclosed in its entirety or in part.

See Model Letter L in FOIP Guidelines and Practices, Appendix 3, for an example of a third party notice designed to meet the requirements of section 30(4). The model letters in FOIP Guidelines and Practices may, but do not have to be used by public bodies when notifying third parties and applicants.

The notice should provide a summary of the exception involved (either section 16 or 17) and an explanation of the points that a third party should address in arguing why the information should not be disclosed. In the case of section 16, the notice should stress the importance of the third party’s providing clear and specific information relating to any harm that may be expected to result from disclosure of the information. The Explanatory Notes (for sections 16 and 17) that are attached to Model Letter L set out these points quite clearly for the third party.

Where there is some doubt regarding the identity of the third party, the public body may wish to add a comment that if the third party is not the appropriate party to receive the notice, they should notify the FOIP Office of the public body.

The identity of the applicant must not be included in the notice, unless the applicant has consented to this disclosure (see IPC Investigation Report 98-IR-009).

The notice must also include the name, position title and telephone number of the person in the public body that the third party may contact for more information.

Notice to applicant

[Top of Document]

Under section 30(5), when notice is given to a third party, the public body must also provide a notice to the applicant. The notice must state that:

• the requested record contains information the disclosure of which may affect the business interests or invade the personal privacy of a third party;
• the third party is being given an opportunity to make representations respecting disclosure; and
• a decision whether or not to give access to the requested record(s) will be made within 30 days after the day notice is given to the third party under section 30(1).

(See Model Letter M in FOIP Guidelines and Practices, Appendix 3. This model letter provides notice of the decision as well as the time limit extension. If the model letter is not used to notify the applicant, the public body’s letter should address both of those matters.)

The identity of the third party should not be included in the notice sent to the applicant.

Public bodies should choose a delivery method that ensures that notice is given promptly.

In the case of third party business information, it is a good practice to call the third party before sending the notice so as to identify the individual best suited to handle the request. This informal consultation with the third party may also lead to timely identification of other third parties that have an interest in the information and therefore require notice, as well. This might be the case if, for example, the information formed part of the assets in a sales transaction.

Contacting a third party prior to giving written notice also allows the public body to explain the process, the importance of responding, any consequences of not responding, and the time lines.

If there is a small volume of records, the records can be faxed to the third party. For larger volumes, records should be sent by courier or priority post. Prompt delivery allows the third party as much time as possible to respond, so regular mail is not recommended.

If a public body is sending the notice by fax or other electronic means, care should be taken to prevent unauthorized disclosure of third party information. (For some measures recommended by the Commissioner, see IPC Investigation Report 2001-IR-001.)

Although the Commissioner stated in IPC Order 99-023 that he did not have jurisdiction to review the contents of a third party notice, public bodies should try to ensure that third parties understand the significance of the notice.

Good communication can make the process easier. Public bodies should make it clear that, for the purposes of section 30, they will consider only comments that are related to whether sections 16 and 17 apply to the information.

There are other exceptions where third party interests may be affected but there is no requirement in the Act to provide the third parties with notice under section 30. This does not, however, prevent a public body from consulting with these third parties and it may be necessary to do so, in some instances, such as when the public body is considering applying the exceptions in section 21, 22 or 28. Also, if there is a question as to whether or not section 27(2) may apply, the third party should be consulted.

On the other hand, comments from a third party about other exceptions, such as sections 20 and 24, are not relevant to the decision that the public body has to make regarding the release of third party information.

It may be helpful to provide the third party with a copy of the records showing the parts of the record that the public body is considering severing. The "severed" information can be highlighted for ease of reference. This may help the third party understand what information the public body intends to release. The third party can then concentrate its efforts on providing input to satisfy the harms test in section 16 or to explain why the disclosure would be an unreasonable invasion of their personal privacy (section 17).

The response from the third party must be in writing. A third party has 20 days after the notice is given to respond, either by consenting to the release of the information or by making representations as to why the information should not be released.

If the third party consents in writing to disclosure of the information, the public body would normally release the information to the applicant unless it decides to apply a discretionary exception.

Although it is not the responsibility of the public body to inquire into an organization’s decision-making processes, the public body should be reasonably satisfied that the person giving consent on behalf of a business or other organization is an officer, employee or corporate officer who is authorized to provide such consent. A written response from the third party, signed by a person in a responsible position, should be sufficient.

If the third party makes representations to the public body about non-disclosure of the information, the public body must consider the representations. If it appears that the third party has not understood the process, the public body should contact the third party by telephone to discuss the matter further.

If no response has been received by the 21^st day after the notice was given, the public body has to make a decision about releasing the information, based upon other available information and upon the consideration of any applicable exceptions in the Act.

The public body should not draw any conclusions from the lack of response. The third party should be contacted by telephone or fax to discuss why a response has not been made and advised of the consequences. A follow-up letter confirming the discussion may be sent to the third party.

If the third party requests a few extra days to respond, and the public body agrees, these days would be subtracted from the 10 days in which the public body must make a decision.

The Act does not allow public bodies to provide time limit extensions to third parties. However, a third party that does not meet a time limit for making representations regarding non-disclosure is not without further recourse if the public body decides to disclose the third party’s information. After notification of the public body’s decision, the third party has 20 days to request a review by the Commissioner.

The public body is required to decide within 30 days after the third party notice has been given whether or not to give access to all or part of a requested record. Section 31(1) says that a decision cannot be made until the third party responds or on the 21^st day after notice has been given to the third party, whichever comes first.

Under section 31(2), the public body must give written notice of its decision, including reasons for the decision, to the applicant and the third party. This notice is required whether the decision is to release or withhold records, and whether the public body agrees or disagrees with the third party. Notification of the public body’s decision regarding access to the record must be given by the 30^th day after notice was given to the third party.

When access to the record is granted

If the public body decides to give an applicant access to a record containing third party information, the public body must inform the applicant of the decision. The notice must state that access to the record or part of it will be provided within 20 days after that notice is given, unless the third party asks for a review by the Information and Privacy Commissioner (section 31(3)).

The public body must inform the third party of its decision and the reasons for it, and advise the third party of the right to request a review by the Commissioner, within 20 days of the decision to grant access. The Commissioner emphasized the importance of the content of this notice for the review process in IPC Order 98-006.

The public body must not give immediate access to the record(s) because of the third party’s right to request a review of that decision (IPC Order 98-006). A public body may consider it unnecessary, and even contrary to the spirit of the Act, to delay disclosure for 20 days in a case where the third party has consented to the release of the records. However, it needs to be taken into consideration that misunderstandings may arise regarding whether the person who consented was authorized to do so; whether the third party actually consented; or what the third party believed he or she was consenting to disclose.

The public body should contact the Commissioner’s office on the 21^st day to see whether a request for review has been submitted.

If the third party does not request a review within the 20-day period after notice of the decision has been given, the applicant should be granted access to the records on the 21^st day, subject to the application of any other discretionary exceptions. It is important for the public body to respond to the applicant on the 21^st day in order to comply with the time limits in the Act.

The applicant must not be given access to any record or part of a record that is the subject of a Commissioner’s review until the review is completed.

If the review affects only some of the records proposed for disclosure, as part of its duty to assist, the public body may wish to consult with the applicant about the release of other responsive records in the meantime. The outcome of the review will determine whether or not access is given to any record that is the subject of review.

When access to the record is denied

If access to part of the record containing third party information is denied, the public body must inform the applicant of the decision and the reasons for it. The severed records must then be released to the applicant and the applicant informed that he or she has 60 days to request a review by the Commissioner of the public body’s decision, under section 65(1), or by an Adjudicator under section 77(2).

If the record is being withheld in its entirety, no records would be released to the applicant. The applicant would be advised of his or her right to request a review of that decision, as above.

The public body must also inform the third party of this decision and the reasons for it, and advise that the applicant may, within 60 days, request a review of the decision by the Information and Privacy Commissioner.

(See Model Letters N (Notice to Third Party of Decision) and O (Notice to Applicant of Decision) in FOIP Guidelines and Practices, Appendix 3.)

In IPC Order 2000-014, the Information and Privacy Commissioner provided several instructions under section 31 for the guidance of public bodies.

• If a public body decides to disclose records to which the exception for third party business interests (section 16) or personal privacy (section 17) applies, but withholds others, the public body must notify the applicant and the third party at the same time.
  
• When giving notice of a decision under section 31, public bodies should avoid using the phrase "partial access" and should be as specific as possible about records to which they have decided to give access and those which they have decided to withhold.
  
• If a public body has decided to give an applicant access to records, notified the third party under section 31, and later decides not to give access to some or all of the records, it should immediately notify the applicant of that decision.
  
• If a public body decides to give an applicant access to records and gives a notice under section 31, and later the public body and the third party decide that some or all of the records are no longer at issue, it should immediately respond to the applicant, as required by section 11 of the Act. Any extension allowed under section 14(1)(d) immediately ends when the records are no longer at issue in a review. A failure to respond under section 11 at that time is a deemed refusal to provide access.

A public body may be able to consult with a third party and still respond to an applicant within the original time limit of 30 days from the receipt of the request (section 11). This could happen if, for example, the applicant expressly requested the personal information of a third party, the third party was notified quickly and the third party responded quickly.

However, in most cases, a period of 30 days after the date of notice (allowed under section 31(1)), plus the 20 days allowed for the third party to request a review (section 31(3)), will be needed to complete the third party consultation process.

A public body does not need to request a time extension from the Commissioner in order to comply with the requirements of section 31.

A public body may extend the time limit for responding to a request under section 14(1) in order to:

• obtain more detail to identify the records (section 14(1)(a));
• search a large volume of records, which would unreasonably interfere with the operations of the public body (section 14(1)(b));
• consult with a third party or another public body (section 14(1)(c)); or
• allow time for a Commissioner’s review (section 14(1)(d)).

Only the Commissioner can approve a request for a time extension for one of the reasons set out in section 14(1) for longer than 30 days. Such a request must be made in writing to the Commissioner.

If there is no requirement to consult with a third party but the public body needs more time to deal with the circumstances in section 14(1)(a) or (b), then the public body would extend the time limit in accordance with section 14(1).

If there is a requirement to consult with a third party under section 30(1), but the head of the public body believes that more time will be needed to respond to the request than the 30 days permitted under section 31, the time limit should first be extended under section 14(1)(c). Examples of this type of extension would be where the public body needs to consult with another public body, level of government or with another third party not requiring notice.

If the public body then needs more time to complete the third party notice process, the time limit may be further extended under section 14(3) to comply with the requirements of section 31 (see IPC Investigation Report 2000-IR-001). This situation may occur, for example, if a third party is identified late in the processing of a large request.

Public bodies need to keep in mind that once the third party notice process under section 30(1) has been initiated, the only time limit extension that the Act permits is the extension under section 14(3). Public bodies should try to plan the processing of complicated requests so that there is a need to invoke only one time limit extension.

If the third party requests a review by the Commissioner under section 65(2), or by an Adjudicator under section 77(3), the time limit for responding to the request is extended under section 14(1)(d). The Commissioner’s office will send a notice of acceptance of the request for review to the third party, the head of the public body and others affected, including the applicant. Normally, the Commissioner’s office has 90 days after receiving a request for a review to complete it. The Commissioner may extend that time period by giving notice of the extension to all parties.

Purpose

FOIP Bulletins are intended to provide FOIP Coordinators with more detailed information for interpreting the Freedom of Information and Protection of Privacy Act. They supply information concerning procedures and practices to aid in the effective and consistent implementation of the FOIP Act across public bodies. FOIP Bulletins are not a substitute for legal advice.

Government of Alberta
Access, Privacy and Security
Service Alberta
3rd Floor, 10155 - 102 Street
Edmonton, Alberta T5J 4L4
Phone: (780) 422-2657
Fax: (780) 427-1120
Web site: http://foip.gov.ab.ca