What to Expect During a Review With the IPC A Guide for Public Bodies and Trustees This resource outlines best practices for public bodies/trustees when the IPC undertakes a review under: • Part VII of The Freedom of Information and Protection of Privacy Act (FOIP) • Part VI of The Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP) • Part VI of The Health Information Protection Act (HIPA) DISCLAIMER This document is not intended to provide legal advice and is provided for informational use only. September 2024
Office of the Saskatchewan Information and Privacy Commissioner. What to Expect During a Review With the IPC. Updated September 2024. 2 I. Key Terms The following are key terms used throughout this guide. See also IPC’s Guide to FOIP and Guide to LA FOIP for information on common terms and phrases used in the administration of FOIP, LA FOIP and HIPA in Saskatchewan. Term Meaning Applicant Individual who initiates a review of a public body’s/trustee’s decision regarding a correction or access to information request. Calendar Days Includes weekends and all holidays; the first day is not counted (see section 228(3) of The Legislation Act ). Head The individual accountable by law for making the final decision on access requests but may delegate these powers to someone else in the organization. This is typically the Minister of a ministry, the mayor of a municipality, and the CEO of a local authority or Crown corporation. • For purposes of FOIP, includes the member of the Executive Council responsible for the administration of the agency (i.e., Minister, President/CEO) (see subsection 2(1)(e) of FOIP and section 4 of FOIP Regulations). • For purposes of LA FOIP, includes the mayor, reeve or chairman of the local advisory committee, the chairperson of the governing body or the individual designated as the head by the governing body of the local authority (see subsection 2(1)(e) of LA FOIP). • Pursuant to section 58 of HIPA, decisions must be made by the trustee or the trustee’s designate. If instead the trustee is also a government institution as defined by FOIP, the decision maker is the head (or head’s designate) as defined in that FOIP, or if a local authority, its head (or head’s designate) as defined by LA FOIP. Public Body Throughout this document, public body refers to the government institution or local authority identified under FOIP or LA FOIP (respectively).
Office of the Saskatchewan Information and Privacy Commissioner. What to Expect During a Review With the IPC. Updated September 2024. 3 Review The process triggered by an applicant, or a third party of a decision made by a government institution, local authority, or trustee of the following reviewable issues: • Reviewable issues pursuant to section 49 of FOIP or 38 of LA FOIP can include, among other things, a review of late responses, decisions regarding extension of time to respond, refusal to provide access, fee estimates, requests to waive a fee, transfer of an access to information request, refusal to grant access to or to make a correction to personal information. • Reviewable issues pursuant to section 42 of HIPA can include a review of decisions regarding denial of access to one’s own personal health information, denial of an amendment to personal health information or any other matter the person feels has been a contravention of HIPA. Section 7 Decision Means the letter, notice or email provided by the head of a public body to an applicant pursuant to section 7 of FOIP and LA FOIP. Section 36 Decision Means the letter, notice or email provided by the trustee pursuant to section 36 of HIPA. Submission As applicable, depending on the party, the submission may include the public body’s/trustee’s written representation setting out its position along with its arguments or analysis, the index of records, the records in question and other supporting documentation. Notifications provided to the parties by the IPC outline what issues parties are expected to address in its submission in order to meet the burden of proof. Third Party Pursuant to subsection 2(1)(j) of FOIP, a person, including an unincorporated entity, other than an applicant or a government institution; under subsection 2(1)(k) of LA FOIP a person, including an unincorporated entity, other than an applicant or a local authority. A third party may request a review or provide representation in the course of a review in certain circumstances. Trustee Is a trustee pursuant to subsection 2(1)(t) of HIPA with custody or control of personal health information.
Office of the Saskatchewan Information and Privacy Commissioner. What to Expect During a Review With the IPC. Updated September 2024. 4 II. Roles Involved in Reviews III. Intake, Early Resolution and Notices Intake and Early Resolution 1. The MoI assigns requests for review to the IO. The IO receives the request for review and opens the file if the request is received within legislative timelines, all the relevant documentation is provided and if the IPC has jurisdiction and grounds to proceed. See the The Rules of Procedure for the following regarding priority reviews and procedures: • Part 2.1 for priority reviews on failure to provide a section 7 decision • Part 2.2 for priority reviews on fees and fee waivers 2. IO attempts early resolution if it is a possibility. Early resolution is a process that may expedite resolution for the Applicant and may reduce the amount of work a public body or trustee needs to do. 3. To facilitate a possible early resolution of a review, the IO: • Clarifies the role of the IPC in a review and discusses possible outcomes. • Ensures as many records as possible have been provided to the Applicant. • Clarifies the scope and which records the Applicant seeks. • Clarifies the Applicant’s objectives with the public body or trustee. 4. If early resolution is successful, the file is closed without a report. • Analysts – conducts reviews, draft reports • Deputy Commissioner (DC), Executive Director of Research, Policy and Compliance (EDoC) and Director of Compliance (DoC) – managers involved in file assignment and management and vetting of reports • Information and Privacy Commissioner - appointed pursuant to section 38 of FOIP - final decision maker • Intake Officer (IO) – intake, early resolution and provides notice of the review • Manager of Intake (MoI) – manages the intake team which is comprised of Intake Officers
Office of the Saskatchewan Information and Privacy Commissioner. What to Expect During a Review With the IPC. Updated September 2024. 5 5. If early resolution between the parties is not possible, IO sends a notice of the review to all parties – applicants, public bodies/trustees and third parties (see Notice). 6. Note that if a public body/trustee releases new responsive records to an applicant, they should advise the IPC regardless of the stage of the review process. 7. If a public body claims a third-party exemption (subsection 19(1) of FOIP or subsection 18(1) of LA FOIP), the third party is entitled to make representation to the IPC regarding the records that engage their interests. In this case, the IO will ask the public body for the third party’s contact information and also ask the public body to notify the third party of the review pursuant to subsection 52(1) of FOIP or subsection 41(1) of LA FOIP, as detailed in item 10. Once the third party contact information has been received and all other relevant information is received, the IO will prepare and send notice of the review to all parties. Notice of the Review 8. IO sends the notice of review (usually by email) to all parties (i.e., applicant, public body/trustee and any known third parties) once early resolution efforts cease. At this stage, the IO assigns the file to an Analyst who then becomes the point of contact for all parties. For reviews requested pursuant to section 49 of FOIP and section 38 of LA FOIP, the materials public bodies are required to provide may differ. For example, a review of the refusal to grant access to records will require the public body to provide the Analyst with both a clean (non-severed) and a severed copy of the record in question or preferably, a red-lined version of the record. If a review is only about a public body’s search efforts or other procedural issue, a copy of the record is not typically required. The notice will advise what the public body is required to provide the Analyst at the time it is provided, but later the Analyst may ask for additional information or materials. For guidance on what may be required by the IPC in the different types of reviews, including tests that can be applied, see Chapter 3 and Chapter 4 in the Guide to FOIP, and Chapter 3 and Chapter 4 in the Guide to LA FOIP. See also Using Affidavits in a Review with the IPC for information on when it may be appropriate to use an affidavit in a review and what the IPC requires in an affidavit. 9. Reviews requested pursuant to section 42 of HIPA more frequently involve access denied but can involve an investigation of any potential contravention of HIPA. A submission includes the trustee’s arguments and applicable materials (e.g., copy of records). The notice will advise what the trustee is required to provide the Analyst at the time it is provided, but later the Analyst may request additional information or materials.
Office of the Saskatchewan Information and Privacy Commissioner. What to Expect During a Review With the IPC. Updated September 2024. 6 Preliminary Objections 10. If a public body/trustee believes the Commissioner does not have jurisdiction to deal with a request for review, it should advise the Analyst in writing as soon as possible after receiving the notice. The public body/trustee needs to indicate how it concluded the Commissioner does not have jurisdiction, citing applicable legislation and providing arguments. 11. If the public body/trustee believes the Commissioner should discontinue a review pursuant to section 50 of FOIP, section 39 of LA FOIP or section 43 of HIPA, it should advise the Analyst as soon as possible after receiving the notice and provide its argument and evidence to support its position. If such an objection has been newly raised (i.e., the applicant is not aware), the Analyst will share these objections with the applicant. The Analyst may ask the public body’s/trustee’s permission to share the public body’s/trustee’s summary of objections with the applicant or the Analyst may provide their own summary of the objections to the applicant. The Analyst will not share a public body’s or trustee’s written submission or summary without the public body’s/trustee’s permission, but the Analyst is required to advise applicants of newly raised objections so that applicants may provide their own submission or rebuttal. IV. Review and Analysis 1. Typically, the IPC requests that a public body or trustee provide records and an index of records within 30 days and its submission within 60 days from the day the notice is provided. Note that submissions for procedural reviews, or reviews that don’t include records, (e.g., a review of search efforts, failure to provide a response within the legislated timeline) are due in 30 days. Once the IO assigns a file to an Analyst, the Analyst becomes responsible for ensuring the public body/trustee provides what is required (submission, materials, etc.) within the given timeframes. If the public body/trustee does not provide what is requested within these timeframes, the Analyst will follow up by making a request for the records/index and/or submission. The Analyst may provide an extension if it is warranted or may need to consult with the DoC/EDoC/DC or Commissioner on an appropriate extension. If a public body or trustee requests an extension, they should let the Analyst know at the time the request is made.
Office of the Saskatchewan Information and Privacy Commissioner. What to Expect During a Review With the IPC. Updated September 2024. 7 2. Once the Analyst receives the records and submission, they: a. Review the submission for completeness and missing documentation or records and follow up with the public body/trustee as required. For more on communicating with the Analyst regarding information required and evidence, see PART 8 of IPC’s Rules of Procedure. b. Share the index of records with the applicant if the public body agrees to this. c. If the public body/trustee provides permission, the Analyst shares the submission with the applicant. If the public body does not mention in its submission that the index or the submission may be shared, the Analyst may ask the public body if it can be shared. The Analyst does not share a submission with an applicant without the public body’s or trustee’s permission. To eliminate doubt, public bodies/trustees may consider clearly marking submissions as “Submissions Can be Shared” or “Submissions Cannot be Shared”. 3. The Analyst undertakes their analysis and completes the review report. Once completed, the Analyst reviews it with the DoC or EDoC, then the DC and Commissioner. Analysts will contact public bodies/trustees before a report is issued if they have any questions or require any clarification regarding the factual circumstances of the review. In some limited circumstances, our office may exercise discretion to provide excerpts or an entire draft report to public bodies/trustees and invite them to comment on any factual errors before issuing a final report. All final findings and recommendations are made by the Commissioner unless decision making is delegated to the DC. 4. Note that throughout the review and analysis stage, the Analyst may attempt to resolve certain reviewable issues if the opportunity arises. For example, if a public body agrees to share its submission with an applicant, the applicant may be satisfied with the public body’s arguments on a reviewable issue (e.g., an exemption it applied or its search strategy), and indicate they no longer want that issue reviewed. As a result, in consultation with the DC and Commissioner, the issue may be considered resolved and dropped from the review. In such cases, the Analyst notifies both the Applicant and the public body/trustee. V. Final Report 1. The Commissioner issues a final review report for every review file that is not otherwise resolved. Analysts send final copies of the review report to parties as follows: • Public body/trustee (typically in care of the Access and Privacy Coordinator or designate) • Applicant
Office of the Saskatchewan Information and Privacy Commissioner. What to Expect During a Review With the IPC. Updated September 2024. 8 • Deputy Minister of Justice, Ministry of Justice and Attorney General and Executive Director, Audit and Information Management, Ministry of Justice and Attorney General • To third parties, as applicable • Any other individual the Commissioner identifies, or as per the IPC’s Rules of Procedure 2. The IPC usually publishes final review reports on IPC’s website home page under New Reports and on the Reports section 7 calendar days after issuing the final review report. Depending on the circumstances of the review, the Commissioner may post a final report to IPC’s website earlier than this, or on the same day it is issued. Note that the date on the review report is the date that the Commissioner has issued the report and it is not subject to change. 3. Public bodies and trustees must respond in writing to final reports within 30 calendar days to the IPC and the applicant. This is 30 calendar days from the date on the review report. The IPC may send one reminder to a public body or trustee of their obligation to provide its response before the 30 days elapses as a courtesy, but public bodies/trustees are responsible for ensuring that they keep track of their obligations with respect to timelines and responses. 4. Six months after issuing a final report, the IPC deletes copies of records provided by the public body or the trustee unless an appeal is pending. In the event of an appeal, the IPC deletes copies of the records after the appeal is concluded. VI. Helpful Information Preparing the Record 1. In most cases, there is no need to send the IPC records that have already been released in full to an applicant. In rare circumstances, the Analyst may require them; in that event, the Analyst will ask the public body/trustee to provide them. 2. The IPC requires a copy of records containing information that has been withheld from the applicant in full or in part (note the IPC does not share or release records provided by public bodies/trustees to applicants or any other party). When preparing the record: a. Outline or highlight (“redline”) the withheld portions of information. b. Clearly indicate next to the highlighted/redlined portions which exemptions are being applied to those portions of information (see IPC’s webinar on severing) and consider
Office of the Saskatchewan Information and Privacy Commissioner. What to Expect During a Review With the IPC. Updated September 2024. 9 assigning a different sequential redaction number to each line item/paragraph severed. 3. Number all pages in a record and any severances sequentially. Ensure the index of records can be cross-referenced to the records. 4. If a public body/trustee determines that portions of the record is not responsive to an access to information request, the public body/trustee may consider releasing that information or record subject to any exemptions that are found to apply. If a public body determines information or records should be withheld as not responsive, it needs to indicate this in its section 7/36 response to the applicant and include on the index of records. The response should include reasons as to why the information is being withheld as not responsive (e.g., it is unrelated to the access to information request because the information or record falls outside the timeframe set by the applicant in their access to information request). For further information, see Chapter 3 in the Guide to FOIP or Chapter 3 in the Guide to LA FOIP. Preparing the Index of Records 1. Prepare an index of records in table format. 2. For the purposes of the IPC, the index of records can be descriptive, and should contain the following elements (see FORM A: Index of Records in Rules of Procedure): • Page numbers and severance numbers. • Description of the records (e.g., letter, email, memo, handwritten note, etc.) which could also include dates, job titles and organization affiliation of those involved. • Exemptions applied to each portion of the record. 3. If the public body does not want the index of records shared with the applicant, the public body/trustee could prepare a modified index that can be shared with the applicant. The modified index must not contain confidential comments, personal information or information that discloses the contents of the records. As the index of records is an opportunity for applicants to know the exact number and types of records involved in a review, a modified index still needs to include factors such as page numbers, descriptions of records (can be brief) and the exemptions applied. 4. For email threads or strings that are difficult to capture (e.g., those that go back and forth for a period of time), public bodies/trustees may consider using date ranges rather than
Office of the Saskatchewan Information and Privacy Commissioner. What to Expect During a Review With the IPC. Updated September 2024. 10 each individual date. 5. Where emails have attachments, a public body should list and identify them and describe them in the index of records. Preparing a Submission A submission informs the Commissioner of the public body’s/trustee’s main arguments and presents supporting information to make its case with respect to its position. The burden of proof in establishing that access to a record may or must be refused or granted rests with the head (section 51 of LA FOIP and section 61 of FOIP) or the trustee (section 47 HIPA). The burden is the obligation of the head or trustee (or delegate) to make their case as to why access should be refused. A submission is an opportunity to inform the Commissioner about the case and to persuade the Commissioner of the head’s or trustee’s position. This requires information and evidence to establish facts upon which the Commissioner will base his decision. For information on preparing a submission, see the following resources on IPC’s website: • A Guide to Submissions– helps public bodies/trustees in preparing a successful submission. • IPC Guide to FOIP – a reference tool for the application of FOIP; it is designed to assist government institutions that are subject to FOIP. • IPC Guide to LA FOIP – a reference tool for the application of LA FOIP; it is designed to assist local authorities that are subject to LA FOIP. • The Rules of Procedure – sets out the rules of procedure for reviews of complaints under section 49 of FOIP, section 38 of LA FOIP and section 42 of HIPA. • Using Affidavits in a Review with the IPC – how to prepare a statement under oath that public bodies/trustees can use to support their case. See also FORM B: Affidavit of Records pages 43 & 44 of Rules of Procedure. Note: the IPC has available a secure file transfer that can manage large files. Public bodies or trustees can ask the IO or Analyst for a link to the secure file transfer through which the public body or trustee may directly forward its documentation.
Office of the Saskatchewan Information and Privacy Commissioner. What to Expect During a Review With the IPC. Updated September 2024. 11 Contact Information If you have any questions or concerns during any stage of the intake or review process, please contact the IO or the Analyst assigned the file, or for general inquiries, contact us at the following: 306-787-8350 | toll free 1-877-748-2298 503 – 1801 Hamilton Street | Regina SK S4P 4B4 intake@oipc.sk.ca | www.oipc.sk.ca | @SaskIPC | Linkedin
RkJQdWJsaXNoZXIy MTgwMjYzOA==