On November 17, 2020, the federal government introduced Bill C-11, the Digital Charter Implementation Act, 2020 (DCIA), which, if passed, will significantly reshape the Canadian privacy landscape. Organizations handling personal information must consider how the CPPA could impact their operations and take steps to implement the necessary data protection procedures to meet their obligations under the new law.read more
NL’s Statutory Review of the Access to Information and Protection of Privacy Act: What businesses need to know.
On 9 June 2021 the Government of Newfoundland and Labrador released Statutory Review 2020 of the Access to Information and Protection of Privacy Act, 2015 (ATIPPA). The Review recommends changes to provisions to ATIPPA that will be of interest to business entities engaged with public bodies in Newfoundland and Labrador.
The Review, conducted by former Chief Justice of the Supreme Court David B. Orsborn, is a comprehensive analysis of the legislation governing access to information for records in the public sector. It provides a number of recommendations to Government for changes to the legislation. A copy of the Review volumes can be found here and here.
Treatment of Third Party Commercially Sensitive Information
One of the most contentious issues under the legislation is the treatment of third-party commercial information in the hands of a public body, and the issues surrounding when such information can and cannot be disclosed. The scenario represents the intersection between two entirely different worlds and points of view when it comes to the disclosure of information. Commercial activities are predicated upon confidentiality as a fundamental principle; information relating to one’s commercial activity is only disclosed to strangers where and to the extent absolutely required. However, in the public sector, access to information legislation is founded on principles of openness and accountability: all information should be publicly disclosed, subject only to specific, narrowly-interpreted exceptions. The result is that when an access to information request to a public body captures commercial information supplied to the public body by a third party, these two philosophies collide.
Under ATIPPA, this conflict plays out under sections 39 and 19. Section 39 establishes the test for the withholding a third party’s commercial information from release. Section 19 sets out when a public body is required to give the third party notice that it is dealing with a request for the third party’s records.
Not surprisingly, the Review noted the release of third-party commercial information is one of the most contested aspects of ATIPPA. It noted that of the 180 ATIPPA challenges adjudicated by the Office of the Information and Privacy Commissioner (OIPC) since 2015, 57 were in relation to disputes relating to the disclosure of third-party commercial information.
Section 39 – The Test for Third Party Commercially Sensitive Information
Section 39 establishes a three-part test for when third party’s commercial information may be withheld from disclosure. As summarized by the Review, the information in question must be (at p. 155):
- A trade secret or information of a commercial nature;
- Supplied to the public body in confidence; and
- Disclosure will lead to a reasonable expectation of probable harm; there are four enumerated types of potential harm.
A failure to satisfy all three aspects of this test results in the information not being able to be withheld from release under section 39.
The Review highlighted a number of concerns with section 39, but took particular issue with the second step of the section 39 test, the “supplied in confidence” requirement. The Review went through examples of the application of this test, which has become a highly technical analysis of the context and process through which the information was originally supplied to the public body. The Review found it had developed into a test “notoriously difficult to establish and, to the objective observer, engages what may be considered an unnecessarily technical and complex analysis” (p.164). The recommendation of the Review was to amend section 39 to delete this second part of the test entirely.
Section 19 – Notice
Section 19 is related to section 39, as it dictates when public bodies are required to notify a third party that its information may be released. The section is restrictive – notice is only to be provided when a public body is planning to release information of a third party and it believes the information might be exempted from disclosure under section 39. The purpose of the notice is to give the third party an opportunity to challenge the release. However, if the public body on its own assessment does not believe the information satisfies section 39, no notice to the third party is required; the information may be released without any such notice. The result has been that third parties who supplied information to a public body on the expectation that it would be treated as commercially sensitive and confidential, instead have had the information has been released by the public body without any notice or opportunity to provide input into the decision to release. Further, they did not receive notice of the release from the public body, but instead learned about it indirectly after it has occurred from other sources.
The Review found that section 19 and the notice practices that had developed around it are too restrictive. Quoting in part from a submission by one of the authors of this article, it noted that one of the issues is that the current process assumes public servants would have sufficient knowledge about a third party’s business to be able to assess whether the release of information could be reasonably expected to cause harm. The Review recommended that section 19 be amended so that public bodies would be able to give notice to and consult with third parties when considering whether the releases of their information would be harmful to their interests.
The cumulative effect of these recommendations would be a significant change the third-party commercial information process under ATIPPA. These changes would be welcome as it would be a move to a more balanced and fairer regime, which better aligns with the reasonable expectations of commercial third parties doing business with public bodies. Third parties would have greater notice as to a public body’s potential release of their information, more opportunities to supply arguments against such release, and have an easier time satisfying the test for withholding such information where a reasonable prospect of harm can be demonstrated.
The Review’s recommendations were submitted to Government in June. The Government of Newfoundland and Labrador has indicated it is taking the Report under review to consider the recommendations and determine a course of action. The earliest legislative action to amend ATIPPA would be the fall of 2021. Hopefully, these changes to sections 19 and 39 will be implemented in the near term per the Review’s recommendations.
If you have any questions about the Review or access to information issues in the public sector please do not hesitate to contact us.