EDITOR’S NOTE: This document is subject to editorial revision before its reproduction in final form in the Federal Courts Reports.
Privacy
See also: Administrative Law, Privacy
Consolidated applications brought by Information Commissioner on behalf of applicants (Patrick Cain, Molly Hayes) pursuant to Access to Information Act, R.S.C., 1985, c. A-1 (Act), s. 41(1) challenging Health Canada’s refusal to disclose parts of postal codes, names of cities associated with licenses to grow medical marijuana — Canadian postal codes containing six characters divided into two groups of three: first three characters called Forward Sortation Area (FSA), which identify major geographic divisions in urban or rural location; last three characters called Local Delivery Unit, which identify smallest delivery zone within FSA — Ms. Hayes in August, Mr. Cain in October 2017 making access to information request to Health Canada for list of addresses, first three characters of postal codes of licensed personal production grow operations, producers of medical cannabis — Requested information obtained by Health Canada under Access to Cannabis for Medical Purposes Regulations, SOR/2016-230 regime — This scheme replaced by Cannabis Act, S.C. 2018, c. 16, Cannabis Regulations, SOR/2018-144 — Regarding Ms. Hayes’ request, Health Canada’s Access to Information and Privacy (ATIP) Division found most information to be personal information, thus exempt from disclosure under Act, s. 19 — ATIP Division applied severance to record, only disclosed province names — Information Commissioner agreeing with Health Canada that s. 19(1) exemption for personal information applied to civic numbers, street names, last three digits of postal codes — However, Commissioner asked Health Canada to determine whether additional portions of postal codes, city names could be disclosed — Health Canada subsequently agreed to release first character of postal code but refused to release any other information, claiming it was “personal information” — Also asserted unreasonable to require it to analyze each FSA separately to determine risk of re-identification — Information Commissioner not convinced that risk of identification arising from disclosure of city names or FSAs for more populous areas — Also disagreed with Health Canada’s assertion not reasonable to ask it to analyze each FSA to determine which could be disclosed — Regarding Mr. Cain’s request, Health Canada refused to disclose second, third characters of FSAs pursuant to Act, s. 19(1) — Information Commissioner found that Health Canada’s blanket refusal to release more information not justified, because risk of re-identification of designated persons not meeting legal test — In response to Information Commissioner’s reports on complaints, Health Canada maintained its position that FSAs, cities personal information exempt from disclosure — Asserted that because of risk of identification, information falling within definition of “personal information” — First issue whether respondent Minister of Health authorized to refuse disclosure of records at issue pursuant to s. 19(1) because they constitute personal information — Second issue whether Minister correctly refused to further sever records pursuant to Act, s. 25 — Regarding standard of review for first issue, law clear that under Act, s. 41, reviews heard de novo — As regards second issue, in light of Merck Frosst Canada Ltd. v. Canada (Health), 2012 SCC 3, [2012] 1 S.C.R. 23, question of how much effort required to meet s. 25 severance obligation should be treated as part of de novo review, rather than as discretionary decision — Dispute at centre of present case whether second, third characters of FSAs with larger populations, city names protected from disclosure because of “serious possibility” this data can be linked with other information to identify specific individuals — Related to this is proper approach to assessing risks regarding “structured data sets”, methodology to assess such risks — “Serious possibility” test set out in Gordon v. Canada (Minister of Health), 2008 FC 258, [2008] 3 F.C.R. D-5 governing authority guiding analysis — Releasing second or third character of FSA, names of cities creating serious possibility of re-identification — This information therefore falling within definition of personal information about identifiable individual — Disclosure of information about individual’s medical condition(s) having particularly devastating consequences — Risks of disclosure of such intimate information must be reduced as much as is feasible — Evidence showing progressive release of more information about medical marijuana licenses, details about individuals who received them, including medical conditions, year of birth, gender, type of license issued, dosage — Question whether significant possibility that data can be combined to identify particular individuals — Datasets sufficiently comparable to serve as foundation for assessing risk that mosaic of information could be assembled — Fact that datasets not exactly comparable not impediment to motivated user seeking to identify person licensed for personal production or designated producer under medical marijuana licensing regime — In undertaking de novo review, Court required to take into account more recent developments pertinent to task at hand — Court conducting de novo review of refusal to disclose record should take into account any relevant changes between date of refusal, time of hearing of matter — Ontario (Community Safety and Correctional Services) v. Ontario (Information and Privacy Commissioner), 2014 SCC 31, [2014] 1 S.C.R. 674 not supporting more general proposition that population thresholds suitable to manage privacy risks — Expert’s report highly relevant, persuasive regarding risks associated with further disclosure of second, third characters of FSAs, names of cities — Releasing only first character posing much lower risk — As to whether Minister correctly refused to further sever records pursuant to Act, s. 25, core question whether more effort required by Health Canada to respect its obligations under s. 25 — Reference in French version of s. 25 to “problèmes sérieux” not setting different, more rigorous standard than English version — Only where expenditure of effort disproportionate to quality of access that disclosure becoming unreasonable — Test from Merck Frosst applicable herein — In assessing whether effort reasonably proportionate to quality of access, two points needing to be emphasized: (1) sensitive nature of information suggesting that lowest-risk option should be adopted, (2) with general location of most of licenses revealed, question whether further narrowing of lens would bring significant benefits — Imposing such requirement on Health Canada, in context of particular facts of case, going beyond what s. 25 requiring — Health Canada not required to undertake further severance in order to meet its disclosure obligations under s. 25 — In conclusion, risks to privacy arising from any further disclosure of records simply too great — Evidence compelling conclusion that requiring Health Canada to undertake risk analysis for each FSA separately would impose burden disproportionate to quality of additional access it would provide — Applications dismissed.
Cain v. Canada (Health) (T-645-20, T-641-20, T-637-20, 2023 FC 55, Pentney J., amended public reasons for judgment dated January 25, 2023, 73 pp.)