Court upholds privacy commissioner’s refusal to reveal documents considered in data breach decision

The Ontario Superior Court of Justice has upheld the refusal of the Information and Privacy Commissioner of Ontario (Ontario IPC) to reveal documents it considered in arriving at a decision relating to a healthcare data breach incident in 2019.

The case of LifeLabs LP v. Information and Privacy Commr. (Ontario) concerns investigations by the Ontario IPC and the Office of the Information and Privacy Commissioner for BC (BC IPC) into the alleged unauthorized disclosure of personal information stored on computer systems of the applicant, LifeLabs LP, as a result of a criminal cyber-attack in 2019. In the wake of the cyber-attack, the applicant had to respond to inquiries from privacy commissioners across Canada and eleven proposed class proceedings in Ontario and British Columbia.

The applicant reported the unauthorized disclosure to the Ontario IPC and the BC IPC, who in turn launched investigations into the incident. During the investigations, they required the applicant to produce various documents. The applicant produced some of the documents but declined to produce the others on the basis that they are privileged.

The Ontario IPC and the BC IPC issued a joint request for representations to the applicant about the information they proposed to include in their final investigation report. The applicant argued that certain documents over which claims of confidentiality and privilege were asserted should not be included in the public version of the report.

In 2020, the Ontario IPC and the BC IPC released their joint privilege decision and joint investigation report.  In their decision, they rejected all of the applicant’s claims of privilege and confidentiality. The applicant then commenced applications for judicial review of the decision with the Superior Court.

In line with the applications, the applicant filed a motion to require, apart from the record of the decision produced by the Ontario IPC, the disclosure of certain documents, such as: (a) documents, including background policies and internal memoranda, that governed the decision-making process of the Ontario IPC resulting in the decision; and (b) documents that the Ontario IPC generated during the decision-making process resulting in the decision.

In dismissing the motion, the Superior Court found that the requested documents are not properly part of the record, and all are protected by adjudicative privilege.

The court explained that under the doctrine of adjudicative privilege, a judge or an administrative tribunal adjudicator cannot be compelled to testify about the deliberations or the substance of the decision-making process or how or why a particular decision was reached by the court or administrative tribunal.

However, the testimonial immunity of adjudicative privilege for the administrative aspects of the decision-making process is not absolute and can be lifted if a litigant can show “clearly articulated and objectively sound reasons” for believing that the process did not comply with the rules of natural justice or procedural fairness.

The applicant argued that it alleged breaches of natural justice and procedural fairness that grounded its request for additional documents to complete the record. The court disagreed.

“The onus rests on the litigant seeking to displace adjudicative privilege and this onus is not discharged on the basis of speculation, conjecture or simple allegation alone: there must be a foundation before the court for the allegation that not only raises an issue of procedural fairness, but also justifies displacing the privilege in order to adjudicate the procedural fairness issue,” Justice David Corbett wrote.

The court identified that one document under the first category of the requested documents has been produced by the Ontario IPC. That document is the Personal Health Information Protection Act Code of Procedure, which addresses claims of confidentiality for documents provided to the Ontario IPC during an investigation.

However, “LifeLabs has not identified any other documents or category of documents that ‘governed the decision-making process,’” Justice Corbett wrote. “During oral argument, reference was made to internal policy documents, precedents, memos to the Ontario IPC from staff, and other similar documents that were argued to be producible as part of the record. I reject this argument.”

The court ruled that these documents do not govern the decision-making process and are well within the cone of adjudicative privilege. The Code of Procedure, by contrast, is a code that contains principles that guide the decision and can be said to govern it, much in the same way the Rules of Civil Procedure constrain and govern proceedings in court, the court added.

As to the second category of the requested documents, the court said that the record should include the evidence considered by the Ontario IPC, including submissions it received and any other documents relied upon to establish the facts upon which it based its decision. However, the evidence does not include internal documents “generated” by the Ontario IPC staff in reviewing documents relied upon to establish facts.

“Thus, if the Ontario IPC reviewed documents available on the internet and relied on those documents, or reviewed policies and reports from other Canadian privacy commissioners to establish the facts, those must be disclosed as part of the record,” Justice Corbett wrote.

Based on the evidence, the court determined that all of the information gathered by the Ontario IPC staff that was relied on to establish the facts has been disclosed by citation in the decision.